Essential checks before going online

First of all, make all the checks explained here.

Google Analytics

To add Google Analytics to your WordPress site, just add the google analytics code inside footer.php, above </body>.

If your site has a search function, make sure that you enable site search in Google Analytics.

If your site is an e-shop, make sure that you enable the ecommerce tracking feature in Google Analytics.

Install the Limit Attemps plugin

Protect your site from spam and unwanted visitors.

Install the Email Adress Encoder

Protect plain email addresses and mailto links from email-harvesting robots by encoding them into decimal and hexadecimal entities.

Install the Sucuri Security plugin

Make sure you use it in order to prevent possible attacts and protect your site.

Use the Yoast WordPress SEO Plugin

Definitely a must. Check here for what it can do for you.

Robots.txt

Search Engines read a yourserver.com/robots.txt file to get information on what they should and shouldn’t be looking for, and where.

Specifying where search engines should look for content in high-quality directories or files you can increase the ranking of your site, and is recommended by Google and all the search engines.

An example WordPress robots.txt file:

User-agent: *
Disallow: /wp-admin/
Disallow: /wp-includes/
Disallow: /wp-content/plugins/
Disallow: /wp-content/cache/
Disallow: /trackback/
Disallow: /feed/
Disallow: /comments/

Hide unnecessary items from the WordPress backend

Create a user with ‘editor’ role. This will be used by your client. Make sure that you use adminimize plugin, so that you let the client see only the necessary items in the WorPress backend.

Next, log in as the editor, go to the various sections (eg. post, page, etc.) and customize the screen options that you want the user to see.

Lastly, you can deactive through adminimize the screen options.

Remove meta content generator

WordPress adds this line to your html files

<meta name="generator" content="WordPress 2.7" />

If you display the “Generated by WordPress version #” in your source code then it’s easier for someone to find your site (like a hacker) who is searching for WP sites of that particular version to exploit.

To remove it put

remove_action('wp_head', 'wp_generator');

add_filter( 'wp_mail_from', 'my_mail_from' );
 function my_mail_from( $email )
 {
 return 'info@mydomain.com';
 }

add_filter( 'wp_mail_from_name', 'my_mail_from_name' );
 function my_mail_from_name( $name )
 {
 return 'My desired username';
 }

function remove_wp_update_notice() {
    if ( !current_user_can('manage_options') ) {
      remove_action( 'admin_notices', 'update_nag', 3);
      }
}
add_action('admin_init', 'remove_wp_update_notice');

<?php wp_redirect(get_option('home')); ?>

// disable comments
function __disable_feature($data) { return false; }
add_filter('comments_number', '__disable_feature');
add_filter('comments_open', '__disable_feature');

UPDATE wp_posts SET ping_status="closed";

Options -Indexes

upload_max_filesize = 64M
post_max_size = 64M