DEV Community

Discussion on: Need help regarding self-hosted WordPress (installing plugins, FTPS?, markdown editor, backup?)

Collapse
 
lwndwsk1 profile image
Frank Lewandowski • Edited

First i wanna Quote from my WordPress 101 "Stay secure, never ever use plugins!" :-)

The critical component of Wordpress, especially when it comes to security, are plugins from external developers. Keep that in mind, so less is more - also from a security point of view.

As a web.dev enthusiast, I would like to advise you to test your site with Google Insights. Wordpress themes in particular do not do so well without optimization.
web.dev/measure/ Read up on the topic.

There are really many topics to consider:

  • web.dev is a great place to go, read up on the optimization of your site.
  • DNS prefetch for external sites
  • Browser cache / server cache
  • Minify the JS / CSS
  • Lazy Load Images
  • gzip / brotli compression
  • Minimize the database queries => through a cache.

Since external plugins are essential, and must be used, I can recommend the following to you.

Developer / DevOps workflow

Performance is also a big issue. Use one of the cache plugins to generate static pages from your WordPress theme. I have used WP Super Cache successfully in several projects.
wordpress.org/support/article/opti...

Optimize the Web Vitals, as they are also elemental for your Ranking in Search Engines.
web.dev/learn-web-vitals/

Content workflow

You should install a plugin that will automatically compress your images.
de.wordpress.org/plugins/wp-smushit/

SEO is also a big topic. de.wordpress.org/plugins/wordpress...

Security workflow

Secure your wp-admin so that only you can see the backend. During my installations only my IP address was on / wp-admin /wp-login.php. This is how you avoid brute force attacks on your backend.

You should also use 2FA.
de.wordpress.org/plugins/search/au...

If that is possible for your side, then I would block entire countries.
sitepoint.com/how-to-block-entire-...

Test your Server! There are many tools e.g. wp-scan, nmap and so on. If you have ssh open, do not use a password Authentication. Use ssh keys instead.

To your question:
I have not tested the last versions of WordPress anymore, in the past there was the possibility that you could also write a post by email.

If you have further Questions.. Ask ;-)
Greetz Franky

P.S. Go with a JAMStack! It is way faster, way securer and you dont need weeks to figure out all the topics in cleaning up your WordPress Installation.