are the updated newer major-versions significantly more secure than updated older ones? This is quite ambiguous. How significant or insignificant security changes might be, it is totally irrelevant. There might or might not be significant security enhancements between minor and major versions or even major versions as such. To really know how significant changes are … Read more
It sounds like you were on WordPress.com previously, which has options that are not built in to the core of WordPress. There are various plugins out there to accomplish a similar end result, such as Restricted Site Access.
After upvoting @pieter’s answer…. In recent time I came to the realization that it is much better to handle “bad” data gracefully when it is used (usually it means escaping, but also validation) than at input time. Data corruption can happen not only because of some rouge process “shitting” over your data, but also when … Read more
Just to add to the answer by @birgire, check this post on how to hide the fact that you are using WordPress. I also think that no post basically covers this, but it really help nothing following and applying everything to hide the fact you are using WordPress and to secure WordPress, and your code … Read more
Though I am no expert in XSS, I do know some of the ways someone can abuse these techniques. For example, I was once pointed to the fact that visitors were able to execute javascript via the search field of a website, because the input of the search field didn’t get stripped of it’s html … Read more
Securing a multi-user permission structure
How to allow internal links using wp_kses filtration
I’m currently working on a plugin to do this on a large scale, since I have multiple sites that I want to sync; but I don’t mind sharing the info with you. I understood [from what you said] that the user’s credentials have already been verified on site2 – so there’s no need to use … Read more
@birgire has a right answer And they can use WPScan for example, with a brute force attack on wp-login.php I recommand to rename your login page, you can do it manually or with a plugin.
Akismet comes pre-installed with WordPress. You will, however, need to activate it from the ‘Plugins’ menu and sign up for an API key (free plans are available). And no, captchas are not needed (Akismet catches almost everything), but you can find a plugin to add one if you wish. If you’re concerned about sercurity, I … Read more