Optimizing and Securing Your WordPress Site Without Plugins

Optimizing and securing your WordPress site without relying on plugins is a valuable skill that can significantly enhance your website’s performance and safety. With years of experience building various websites—from nonprofit organizations to over 250 professional athlete sites—we’ve learned that speed, security, and overall performance are crucial for success. Not only do these factors improve your SEO ranking, but they also influence how visitors interact with your site. A slowdown of just a few seconds can lead to increased abandonment rates; research shows that 40% of users will leave a site that takes longer than three seconds to load.

Why Avoid Plugins?

While many plugins promise to improve speed and security, they can sometimes do more harm than good. For instance, poorly coded plugins might slow down your site or create compatibility issues. Instead, let’s explore how you can optimize your WordPress site effectively without the need for multiple plugins or extensive file modifications. Before making any changes, remember to back up your website and database to prevent data loss.

Performance Enhancements

Here are some straightforward methods to boost your WordPress website’s speed:

• Move JavaScript to the Footer: Placing your JavaScript files in the footer (footer.php) can significantly improve load times. Ensure you use wp_register_script and wp_enqueue_script correctly in your functions file.
• Reduce Database Calls: Edit your theme files to replace calls like <?php get_bloginfo('wpurl'); ?> with the actual URL. This change is typically found in header.php and footer.php.
• Define URLs in wp-config.php: To minimize database queries, you can hard-code the home and site URLs in your wp-config.php file:

define('WP_HOME', 'https://www.example.com');
define('WP_SITEURL', 'https://www.example.com');

• Limit Database Writes: Control how often WordPress saves drafts and revisions by adding the following lines to your wp-config.php file:

define('AUTOSAVE_INTERVAL', 120);
define('WP_POST_REVISIONS', 5);
define('EMPTY_TRASH_DAYS', 7);

• Enable Compression: Activate mod_deflate in your .htaccess file to compress your content, which reduces the amount of data sent over the network:

<IfModule mod_deflate.c>
AddOutputFilterByType DEFLATE text/plain
AddOutputFilterByType DEFLATE text/html
AddOutputFilterByType DEFLATE text/xml
AddOutputFilterByType DEFLATE text/css
AddOutputFilterByType DEFLATE application/xml
AddOutputFilterByType DEFLATE application/xhtml+xml
AddOutputFilterByType DEFLATE application/rss+xml
AddOutputFilterByType DEFLATE application/javascript
AddOutputFilterByType DEFLATE application/x-javascript
</IfModule>

• Set Expiration Headers: Configure expiration headers in .htaccess to dictate how long browsers should cache your content:

<IfModule mod_expires.c>
ExpiresActive On
ExpiresDefault "access plus 5 seconds"
ExpiresByType image/x-icon "access plus 2500000 seconds"
ExpiresByType image/jpeg "access plus 2500000 seconds"
ExpiresByType image/png "access plus 2500000 seconds"
ExpiresByType image/gif "access plus 2500000 seconds"
ExpiresByType text/css "access plus 600000 seconds"
ExpiresByType application/javascript "access plus 200000 seconds"
</IfModule>

• Add Cache Control Headers: Implement cache control headers in .htaccess to optimize browser caching:

<IfModule mod_headers.c>
<filesMatch ".(ico|jpe?g|png|gif|swf)$">
Header set Cache-Control "public"
</filesMatch>
</IfModule>

Enhancing Security

To secure your WordPress site, consider the following best practices:

• Delete the Default Admin User: The first user created during installation often has the user ID “1”, making it easy for hackers to guess. Create a new admin user, log in, and delete the default admin account.
• Use Strong Passwords: Create complex passwords that are difficult to guess. Consider using a memorable phrase that includes a mix of uppercase and lowercase letters, numbers, and symbols.
• Change the Database Table Prefix: Alter the default “wp_” prefix to something unique to add a layer of obfuscation. This requires database access and should be done cautiously.
• Disable File Editing Through Admin: Prevent hackers from modifying your files by adding the following line to your wp-config.php file:

define('DISALLOW_FILE_EDIT', true);

• Update Security Salts: Regularly update your security salts, which can be found in your wp-config.php file.
• Disable WordPress Version Display: Hide your WordPress version from potential attackers by adding this snippet to your functions.php file:

add_filter('the_generator', '__return_false');

• Disallow HTML in Comments: Prevent users from submitting HTML in comments by adding the following code:

add_filter('pre_comment_content', 'esc_html');

• Disable Login Hints: Customize the error message when login attempts fail:

function no_wordpress_errors(){
return 'Please try the right user/pass combination';
}
add_filter('login_errors', 'no_wordpress_errors');

While these tips are not exhaustive, they provide a solid foundation for optimizing and securing your WordPress site. Always stay proactive about updates and backups, and consult your hosting provider for tailored advice on enhancing performance and security.

For further assistance or expert guidance, feel free to reach out to us. We are dedicated to helping you navigate the complexities of website management.