Security
The security of your site and your personal data is always a priority. This page describes what we do to help protect your site and your personal data, along with added steps we recommend you take to do the same.
How We Protect your Site And Your Data
Encryption, by Default
Firewalls
Monitoring Suspicious Activity
Security Testing
Data Backup and Recovery
Our Security Team
How You Can Protect Your Site and Your Data
Keep Your Secrets Secret
Choose a Strong Password
Log Out of Your Account
Control Site Access
Two Step Authentication
Selecting a Strong Password
Traditional Passwords Are No Longer Safe
Choose a Modern Method
Best Method: Password Manager
Good Method: Passphrases
Additional Tips For Both Password Methods
How We Protect Your Site and Your Data
Encryption, by Default
Strong encryption is critical to help ensure your privacy and security. We encrypt (serve over SSL) all WordPress.com sites, including custom domains hosted on WordPress.com. We consider strong encryption so important that we do not offer the option to disable it, which would compromise the security of your WordPress.com site. We also 301 redirect all insecure HTTP requests to the secure HTTPS version. Learn more about HTTPS and SSL for your site.
We automatically install an SSL certificate for your site. Very rarely, a site’s specific configuration prevents the SSL certificate from working correctly. If there’s a problem with your SSL certificate, please contact us.
Firewalls
We run firewalls and have processes in place to alert us about unauthorized attempts to access WordPress.com accounts.
Monitoring Suspicious Activity
We continuously watch web traffic and monitor suspicious activity. We also have security measures in place to help protect against distributed denial of service (DDoS) attacks.
Security Testing
We regularly check the security of our services and look out for potential vulnerabilities. We also operate a bug bounty program via HackerOne to reward people who find bugs and help us improve the security of our services.
Please bear in mind that if you wish to attempt to test our security measures on your own WordPress.com hosted site, we do not allow for any whitelisting. You are free to test whatever you wish but as our system has no way of ensuring you are not malicious in nature, your IP address may be temporarily blocked.
Data Backup and Recovery
Our systems back up your WordPress.com site data on a regular basis, so in case of an event that causes data loss (like power supply failure or a natural disaster, for example) we can recover it.
Our Security Team
We have a dedicated security team committed to protecting your data. They work directly with our product teams to address potential security risks and maintain our strong commitment to keeping your data safe.
No way of transmitting data over the Internet and no method of electronic storage is perfectly secure. We can’t guarantee absolute security of your site or account — no one can. But keeping your site and personal data well-protected is very, very, very important to us.
How You Can Protect Your Site and Your Data
There are also a few things you can do to help protect your data (read on!).
Keep Your Secrets Secret
The weakest link in the security of anything you do online is your password. It’s the key to your blog, your email, your social networking accounts or any other online service you use. If your password is easy to guess, your online identity is vulnerable.
All it takes is one person to guess your password and they can delete every post you ever made. They could deface your site. They could read your emails or hijack your address and impersonate you. They could ruin what you have taken time to build.
Choose a Strong Password
Every password you use has to be easy to remember and hard to guess. A random set of numbers and characters make for a hard-to-guess password, but they’re also hard to remember. On the other hand, you’ll probably never forget your birthdate or the name of your first pet, but these make for very bad passwords, as they are increasingly easy to guess or find out.
On WordPress.com, you can use a very long password with any combination of letters, numbers, and special characters, so the security of your password – and by extension, of your blog – is really up to you. We’ve collected some tips for creating strong passwords.
Log Out of Your Account
You can protect your account by logging out when you are finished working. This is especially important when you are working on a shared or public computer. If you don’t log out, someone may be able to access your account just by viewing the browser history and going back to your WordPress.com Dashboard.
You can protect your account by logging out when you are finished working.
To log out of your WordPress.com account, click on your Gravatar in the upper right. Then, under your Gravatar click on Log Out.
Control Site Access
WordPress.com provides a rich multi-user platform. While each site has only one owner, you can have as many users as you want – this is ideal for group blogs with multiple authors, for magazine-style sites with an editorial workflow, or for any other large site where you want to share some of the administrative load.
However, sharing the load also means sharing the responsibilities. That’s why on WordPress.com, you can set different Roles for each user you add to your site. Roles determine a user’s access level.
- Contributor: the most limited role, can only write draft posts, but can’t publish them.
- Author: can publish posts and upload images, but can’t touch other users posts.
- Editors: can not only edit or publish any user’s posts, they can also moderate comments and manage categories and tags.
- Administrators: have full control of the site – they can even delete it.
When adding users, try to find the role that best describes what you want them to do on your site. If you’re setting up an account for a user that only plans to contribute a few posts, make them a Contributor. Reserve the Author and Editor roles for trusted users that have a long-term commitment to your site.
Finally, be particularly stingy with the Administrator role. When you make another user an Administrator on your site, you’re literally creating a separate set of keys for your site and handing them to someone else. Not only will they be able to take your site for a joyride, just having an extra set of keys laying around significantly increases the risk of your site being hijacked.
In fact, we suggest you avoid the Administrator role entirely. In almost all cases, the Editor role would be a better choice.
Read more about this on the support pages for Adding Users and User Roles.
Two Step Authentication
With Two Step Authentication, you can use any iOS, Android, Blackberry, or SMS-capable mobile device as a unique key to your blog. After you sign up for the service, you will need to enter a specially generated one-time code whenever you try to log in to your blog. This means that even if someone gets your password, they won’t be able to log in without possessing your mobile device as well.
You can learn more about this service in the Two Step Authentication support page.
Selecting a Strong Password
The weakest point in any security for your online accounts is usually your password. At WordPress.com, we go to great lengths to make sure your content is secure, protected, and can’t be accessed by anyone other than you.
But if someone else is able to guess or retrieve your password, they bypass almost every security measure we have because WordPress.com will see this person as you. They could then make any changes they wish to your WordPress.com blog or account including the deletion of your content.
To avoid this scenario, this guide will help you create strong passwords that are hard to guess or crack. Read through the following tips and double-check your own password. If you feel your password isn’t secure enough, we strongly recommend that you change it.
Traditional Passwords Are No Longer Safe
Password-cracking techniques have matured quickly and significantly in the past few decades, but the way we create our passwords hasn’t kept pace. As a result, the most common advice you’ll hear about creating a strong password today is very outdated and impractical.
A password created with that advice, like jal43#Koo%a, is very easy for a computer to break and very difficult for a human to remember and type.
The latest and most effective types of password attacks can attempt up to 350 billion guesses per second, and that number will no doubt increase significantly over the next few years.
Creating a strong password today requires modern techniques, and we’ll show you two of them in the next section.
Choose a Modern Method
There are many different approaches to generating a strong password, but password managers and passphrases are the best. Choose the one that works for you, and then read its corresponding section further along in this article to learn how to get started.
Best Method: Password Manager
A password manager is a software application on your computer or mobile device that generates very strong passwords and stores them in a secure database. You use a single passphrase to access the database, and then the manager will automatically enter your username and password into a website’s login form for you. If you only have to remember one password, you can make it as random and as hard to guess as you want.
You never have to worry about choosing a good password, remembering it, or typing it again. This is the easiest and most secure method available today, and we strongly recommend that you use it.
How to Use a Password Manager
There are many different manager applications to choose from, so you’ll want to pick which one you’d like to use, and then install it on your computer. These are the general steps, but you may want to check the documentation for your specific application for more details.
- Choose a password manager. Some popular ones are:
- Install it on your computer.
- Install any extensions or plugins for the web browser(s) you use.
- Create a strong master password to open the password database. See the How to Create a Passphrase section of this document for advice on how to do that.
- (optional) Write down the master password, and store it in a secure location, like a safe-deposit box or a locked safe. It’s important to have a backup in case you ever forget the master password.
- (optional) Share your password database across multiple devices with the application’s built-in tools or via a service like SpiderOak. If you use an external service, make sure you have a strong password for it and enable two-factor authentication on the account (if possible).
Now that you have your password manager setup, you can start to generate strong passwords with it. Find your manager’s built-in password-generation tool, and configure it to create 30-50 random characters, with a mixture of upper- and lower-case letters, numbers, and symbols.
You want to end up with something that looks like this: N9}>K!A8$6a23jk%sdf23)4Q[uRa~ds{234]sa+f423@.
That may look intimidating, but keep in mind that you’ll never need to remember it or type it in; your password manager will handle that for you automatically.
Good Method: Passphrases
A passphrase is similar to a password, except that it’s based on a random collection of words, rather than just one. For example, copy indicate trap bright.
Because the length of a password is one of the primary factors in how strong it is, passphrases are much more secure than traditional passwords. At the same time, they are also much easier to remember and type.
They’re not as strong as the kinds of passwords generated by password managers, but they’re still a good option if you don’t want to use a password manager. They’re also the best way to generate the master password for a password manager or your operating system account, since those can’t be automatically filled in by the password manager.
How to Create a Passphrase
Creating a passphrase follows similar rules to creating a traditional password, but it doesn’t need to be as complex, because the length of the phrase will provide enough security to outweigh the simplicity.
- Choose 4 random words. You can use the xkcd Passphrase Generator if you’d like, but it’s better if you make up your own.
- Add spaces between the words if you prefer.
At this point, you should have something that looks like: copy indicate trap bright
You can stop there if you’d like, or you can add some extra strength by following these steps:
- Make a few of the letters upper-case.
- Add in a few number and symbols.
After applying those rules, it will look something like: Copy indicate 48 Trap (#) bright
Things to avoid:
- Don’t place the words in a predictable pattern or form a proper sentence; that would make it much easier to guess.
- Don’t use song lyrics, quotes or anything else that’s been published. Attackers have massive databases of published works to build possible passwords from.
- Don’t use any personal information. Even when combined with letters and numbers, someone who knows you, or can research you online, can easily guess a password with this information.
Additional Tips For Both Password Methods
Beyond your account at WordPress.com, there are other things to remember as you compose passwords that will help you keep your information secure.
- Don’t use the same password twice. Many popular websites fail to adequately secure your password in their systems, and hackers routinely break into them and access hundreds of millions of accounts. If you reuse passwords from site to site, then someone who hacks into one site will be able to login to your account on other sites. At the very least, make sure that you have unique passwords for all sites that store financial or other sensitive data, or ones that could be used to hurt your reputation.
- Make sure your email password is also strong. With many online services like WordPress.com, your email address serves as your identification. If a malicious user gains access to your email, they can easily reset your passwords and login to your account.
- Don’t share your passwords. Even if you trust the person, it’s possible an attacker could intercept or eavesdrop on the transmission, or hack that person’s computer. If you suspect that someone else knows your password, you should change it immediately.
- Don’t send your password to anyone in an email. E-mails are rarely encrypted, which makes them relatively easy for attackers to read. WordPress.com staff will never ask you for your password. If you must share a password, use a secure method of transmission like pwpush.com, and set the link to expire after the first view.
- Don’t save your passwords in a web browser. They often fail to store the passwords in a secure manner, so use a password manager instead. See the section on password managers above for more information.
- Don’t save passwords or use “Remember Me” options on a public computer. If you do, then the next person to use the computer will be able to access your account. Also make sure you log out or close your browser when you are done.
- Don’t write down your password. If it’s written down somewhere and someone can find it, it’s not secure. Store passwords in a password manager instead, so that they’ll be encrypted. See the section on password managers above for more information. The exception to this rule is storing unrecoverable passwords (like the master password for a password manager, or your operating system account) in a secure manner. One good way to secure them is to keep it in a safe deposit box, or locked in a safe.
- Don’t change your passwords, unless you suspect they’ve been compromised. As long as you have the type of strong password recommended in this article, changing it frequently will not do anything to minimize the risk of it being compromised. Because changing them can be a burden, it often tempts people to adopt bad practices in order to make the process easier, which increases their vulnerability to attacks. If you suspect someone has gained access to your account, though, then it’s always a good precaution to change your password.
Versatile plans and pricing
-
Free
Best for students
-
Personal
Best for hobbyists
-
Premium
Best for freelancers
-
Business
Best for small businesses
Still confused?
Help us improve:
We're always looking to improve our documentation. If this page didn't answer your question or left you wanting more, let us know! We love hearing your feedback. For support, please use the forums or contact support form. Thanks!
