Things You Should Do After Installing WordPress Quick Tips

You can install WordPress in 2 minutes but it is recommended that you tweak some of the default settings to optimize the performance and also improve the security of your WordPress website.

 

1. Move out the media upload folder

WordPress store all your uploaded images and files in the wp-content/uploads folder. You should however move this folder outside the main WordPress folder, preferably on a sub-domain. Thus your WordPress backups will be more manageable (the uploaded files and themes can be backed up separately) and, most important, serving images from a different domain will allow parallel downloads in the browser improving the page loading time.

Open your wp-config.php file and add the following lines to change the location of the wp-content folder. You may also deselect the option – “Organize my uploads into month- and year-based folders.”

define( 'WP_CONTENT_URL', 'http://files.domain.com/media' );
define( 'WP_CONTENT_DIR', $_SERVER['HOME'] . '/files.domain.com/media' );

2. Remove unnecessary meta tags from WordPress header

If you look at the HTML source code of your WordPress site, you will find a couple of meta tags in the header that aren’t really required. For instance, the version of WordPress software running on your server can be easily retrieved by looking at your source header.

<meta name="generator" content="WordPress 4.1" />

This information is a good hint to WordPress hackers who are looking to target blogs that are using the older and less secure versions of WordPress software. To completely remove the version number and other non-essential meta-data from your WordPress header, add this snippet to the functions.php file found in your WordPress themes folder.

  remove_action( 'wp_head', 'wp_generator' ) ;
  remove_action( 'wp_head', 'wlwmanifest_link' ) ;
  remove_action( 'wp_head', 'rsd_link' ) ;

3. Prevent people from browsing your folders

Since you would not like anyone to browse your WordPress files and folders using the explorer view in web browsers, add the following line to your .htaccess file that exists in your WordPress installation directory.

Options All -Indexes

Also make sure that there’s a blank index.php in the wp-content/themes and wp-content/plugins folder of your WordPress directory.

4. Disable HTML in WordPress comments

The comment box in WordPress allows commenters to use HTML tags and they can even add hyperlinks in their comment. The comments have rel=nofollow but if you would like to completely disallow HTML in WordPress comments, add this snippet to your functions.php file.

Eg. wp-content/your-theme/functions.php

add_filter( 'pre_comment_content', 'esc_html' );

or

add_filter( 'comment_text', 'wp_filter_nohtml_kses' );
add_filter( 'comment_text_rss', 'wp_filter_nohtml_kses' );
add_filter( 'comment_excerpt', 'wp_filter_nohtml_kses' );

Update: Replaced wp_specialchars with esc_html as the former is deprecated since WordPress 2.8+

Update #2 :

5. Turn off Post Revisions in WordPress

WordPress includes a helpful document revisions feature to help you track changes to post edits and you can also revert to any previous version of your blog posts. Post revisions do however increase the size of your WordPress wp_posts table as each revision means an additional row.

To disable post revisions in WordPress, open the wp-config.php file in your WordPress directory and add the following line:

define( 'WP_POST_REVISIONS', false);

Alternatively, if you would like to retain the Post Revisions functionality, you may just limit the number of posts revisions that WordPress stores in the MySQL database. Add this line to the wp-config file to only store the recent 3 edits.

define( 'WP_POST_REVISIONS', 3);

6. Change the Post Auto-Save Interval

When you are editing a blog post inside the WordPress editor, it will auto-save your drafts as-you-type and this will help in recovering your work in case the browser crashes. The drafts are saved every minute but you can change the default duration to say 120 seconds (or 2 minutes) by adding a line to your wp-config.php file.

define( 'AUTOSAVE_INTERVAL', 120 );

7. Hide the non-essential WordPress RSS Feeds

Your WordPress installation generates multiple RSS Feeds – the blog feed, article feeds, comments feed, category feeds, archive feeds, etc. – and these are auto-discoverable as they are included in the HTML header of your blog pages using the <link> meta tag. If you just want to publicize your main RSS feed and remove the other feeds from the , add a line to your functions.php file:

remove_action( 'wp_head', 'feed_links', 2 );
remove_action( 'wp_head', 'feed_links_extra', 3 );

8. Maintain a Single RSS Feed, Redirect Others

In the previous step, we simply removed the RSS feeds from printing inside the site header but the RSS feeds still exist. If you would like to have only one RSS feed served through FeedBurner and disable all the other feeds, add this to your .htaccess file. Do remember to replace the feed URL with your own.

<IfModule mod_rewrite.c>
 RewriteEngine on
 RewriteCond %{HTTP_USER_AGENT} !^.*(FeedBurner|FeedValidator) [NC]
 RewriteRule ^feed/?.*$ http://feeds.labnol.org/labnol [L,NC,R=301]
</IfModule>

9. Disable WordPress Login Hints

When you type a non-existent username or an incorrect password while logging into WordPress, it will provide a very detailed error message telling you exactly whether your username is wrong or the password doesn’t match. That could offer an hint to people who are trying to break into your WordPress blog but, fortunately, we can disable the login warnings.

function no_wordpress_errors(){
  return 'GET OFF MY LAWN !! RIGHT NOW !!';
}
add_filter( 'login_errors', 'no_wordpress_errors' );

10. Enable 2-factor Authentication

This is highly recommended. If someone gets hold of your WordPress credentials, they will still need your mobile phone to get into your WordPress dashboard.

Unlike Dropbox or Google, 2-step authentication isn’t part of WordPress but you can always use the Authy plugin to enable 2-factor authentication.

11. Change the Permalink Structure

Do not use the default Permalink structure of WordPress since it is bad for SEO. Go to Options -> Permalinks inside your WordPress dashboard and change yourWordPress Permalink structure to something like:

Option 1. /%post_id%/%postname%
Option 2. /%category%/%postname%/%post_id%/

12. Add Favicon and Touch Icons

Your WordPress theme may not even include references to the favicon (favicon.ico) or the Apple touch icons but web browsers and feed readers may still request them from your server. It’s always better to serve a file than returning a 404.

First, create a 16×16 favicon.ico and a 144×144 apple-touch.png file and upload them to the home directory of your blog. Then add this line to your .htaccess to redirect all apple touch icon requests to that particular file.

RedirectMatch 301 /apple-touch-icon(.*)?.png http://example.com/apple-touch.png

13. Disallow Indexing of WordPress scripts

You want Google and other search engines to crawl and index your blog pages but not the various PHP files of your WordPress installation. Open the robots.txt file in your WordPress home directory and add these lines to block the bots from indexing the backend stuff of WordPress.

User-agent: *
Disallow: /wp-admin/
Disallow: /wp-includes/
Disallow: /wp-content/plugins/
Disallow: /wp-content/themes/
Disallow: /feed/
Disallow: */feed/

14. Make the Admin a Subscriber

If your WordPress username is “admin,” create a new user and grant them administrator privileges. Now logout out of WordPress, log in as the new user and change the privilege of the user “admin” from Administrator to Subscriber.

You may even consider deleting the user “admin” and transfer any existing posts /pages to the new user. This is important for security reasons because you don’t want anyone to guess the username that has administrator privileges to your WordPress installation.

15. Hide XML Sitemaps from Search Engines

XML Sitemaps will help search engines better crawl your site but you don’t want search engines to actually show your sitemap in search results pages. Add this to your .htaccess to prevent indexing of XML sitemaps.

<IfModule mod_rewrite.c>
 <Files sitemap.xml>
  Header set X-Robots-Tag "noindex"
 </Files>
</IfModule>

16. Do Not Use WordPress search

Make sure your site search is powered by Google Custom Search and do not use the built-in search feature of WordPress. WordPress search returns less relevant results and the other advantage is that it will reduce strain on your WordPress server /database since the search queries will be handled through Google.

Alternatively, if you plan to continue with WordPress built-in search, use the Nice Search plugin. It creates better permalinks for your WordPress search pages (/search/tutorials vs /?s=tutorials).

17. Password Protect the wp-admin Directory

You can easily add another layer of security to your WordPress installation bypassword protecting the wp-admin directory. You’ll however have to remember two sets of credentials for logging into WordPress – your WordPress password and the password that is protecting the wp-admin directory.

18. Log 404 Errors in Google Analytics

404 errors are a missed opportunity. You can use events in Google Analytics to log your 404 errors including details about the referring site that is pointing to that 404 page of your site. Add this snippet in your 404.php file.

<? if (is_404()) { ?>
 _gaq.push(['_trackEvent', '404',
              document.location.pathname + document.location.search,
              document.referrer, 0, true]);
<? } ?>

19. Delete Unused Themes & WordPress plugins

The unused plugins and themes won’t affect the performance of your WordPress website but the aim should be to have as little executable code as possible on our server. Thus deactivate and delete the stuff that you no longer need.

20. Stop WordPress from Guessing URLs

WordPress has a strange habit of guessing URLs and it does make mistakes in most cases. Let me explain. If a user request labnol.org/hello URL but if that page doesn’t exist, WordPress may redirect that user to labnol.org/hello-world just because the URLs have some common words.

If you would like WordPress to stop guessing URLs and instead issue a 404 Not Found error for missing pages, put this snippet in the functions.php file:

add_filter('redirect_canonical', 'stop_guessing');
function stop_guessing($url) {
 if (is_404()) {
   return false;
 }
 return $url;
}

21. Set Expiry Headers for Static Content

The static files hosted on your WordPress website – like images, CSS and JavaScript- won’t change often and thus you may set Expire Headers for them so that the files get cached on the user’s browser. Thus, on subsequent visits, your site will load relatively faster as the JS and CSS files would be fetched from the local cache.

Refer to the HTML5 Boilerplate for details on setting up expiry and compression headers for performance. If you are using a caching plugin like W3 Total Cache, the cache control is managed by the plugin itself.

<IfModule mod_expires.c>
 ExpiresActive on

# Perhaps better to whitelist expires rules? Perhaps.
 ExpiresDefault      "access plus 1 month"

# cache.appcache needs re-requests
# in FF 3.6 (thx Remy ~Introducing HTML5)
 ExpiresByType text/cache-manifest "access plus 0 seconds"

# Your document html
 ExpiresByType text/html "access plus 0 seconds"

# Data
 ExpiresByType text/xml "access plus 0 seconds"
 ExpiresByType application/xml "access plus 0 seconds"
 ExpiresByType application/json "access plus 0 seconds"

# RSS feed
 ExpiresByType application/rss+xml "access plus 1 hour"

# Favicon (cannot be renamed)
 ExpiresByType image/x-icon "access plus 1 week"

# Media: images, video, audio
 ExpiresByType image/gif "access plus 1 month"
 ExpiresByType image/png "access plus 1 month"
 ExpiresByType image/jpg "access plus 1 month"
 ExpiresByType image/jpeg "access plus 1 month"
 ExpiresByType video/ogg "access plus 1 month"
 ExpiresByType audio/ogg "access plus 1 month"
 ExpiresByType video/mp4 "access plus 1 month"
 ExpiresByType video/webm "access plus 1 month"

# HTC files  (css3pie)
 ExpiresByType text/x-component "access plus 1 month"

# Webfonts
 ExpiresByType font/truetype "access plus 1 month"
 ExpiresByType font/opentype "access plus 1 month"
 ExpiresByType application/x-font-woff   "access plus 1 month"
 ExpiresByType image/svg+xml "access plus 1 month"
 ExpiresByType application/vnd.ms-fontobject "access plus 1 month"

# CSS and JavaScript
 ExpiresByType text/css "access plus 1 year"
 ExpiresByType application/javascript "access plus 1 year"
 ExpiresByType text/javascript "access plus 1 year"

 <IfModule mod_headers.c>
  Header append Cache-Control "public"
 </IfModule>
</IfModule>

or

ExpiresActive On
ExpiresByType image/gif "access plus 30 days"
ExpiresByType image/jpeg "access plus 30 days"
ExpiresByType image/png "access plus 30 days"
ExpiresByType text/css "access plus 1 week"
ExpiresByType text/javascript "access plus 1 week"

23. Improve WordPress Security

I have discussed WordPress security in detail earlier. The gist is that you should addsecret keys to your wp_config.php file, install a file monitoring plugin (like Sucuri or WordFence), change the WordPress table prefix and also limit login attempts to prevent brute force attacks.

24. Disable File Editing inside WordPress

When you are logged into your WordPress dashboard as an admin, you can easily edit any of the PHP files associated with your WordPress plugins and themes. If you would like to remove the file editing functionality (one missing semicolon can take down your WordPress site), add this line to your wp-config.php file:

define( 'DISALLOW_FILE_EDIT', true );

25. Remove extra Query Parameters from URLs

If the web address of your WordPress site is abc.com, people can still reach your site if they add a few query parameters to the URL. For instance, abc.com/?utm=ga or abc.com/?ref=feedly are, technically speaking, completely different URLs but will work just fine.

This is bad because it dilutes your link equity (SEO) and, in an ideal situation, you would like all URLs to point to the canonical version. Add this little snippet to your .htaccess file and it will strip the unnecessary query parameters from all incoming requests.

<IfModule mod_rewrite.c>
 RewriteEngine On
 RewriteCond %{QUERY_STRING} !=""
 RewriteCond %{QUERY_STRING} !^p=.*
 RewriteCond %{QUERY_STRING} !^s=.*
 RewriteCond %{REQUEST_URI} !^/wp-admin.*
 RewriteRule ^(.*)$ /$1? [R=301,L]
</IfModule>

26. Remove the Admin Bar

This is an annoying feature of WordPress – it adds an admin bar on top of all pages and that is visible to all users who are logged into their WordPress.com accounts. This can however be removed by adding a line to your functions.php file.

add_filter('show_admin_bar', '__return_false');

27. Deal with Ad Blockers

Some of your blog readers may be using ad-blocking software to block ad serving from your site. You can serve alternate content like a list of your popular WordPress posts or embed a YouTube video instead.

28. Add Branding to your RSS Feed

You can easily add your brand logo to all articles in the RSS feed. And since these are served from your server, you can serve a different image for sites that are plagairising your content by republishing your feed. Add this to your functions.php file.

function add_rss_logo($content) {
  if(is_feed()) {
    $content .= "<hr><a href='blog_url'><img src='logo_url'/></a>";
  }
  return $content;
}
add_filter('the_content', 'add_rss_logo');
add_filter('the_excerpt_rss', 'add_rss_logo');

29. Optimize your Database

There are a few plugins available which can take responsibility to optimize and maintain the WordPress database. I’ll list just a few below, but if you search the WordPress Plugin Directory, you should be able to find quite a few more:

• Yoast Optimize DB
• WP DB manager

Keep in mind that lots of the bigger “Optimization/Caching Plugins” that help with caching and other stuff will do their own optimization as well – so if you have a caching plugin, you might already have this covered. Advanced users can also simply use PHPMyAdmin to optimize your WordPress database.

30. Compress and Combine JS and CSS Files

Compressing the JS and CSS will give you a good improvement in site loading time. As compressing the JS and CSS files will decrease your overall page size.
Another good points to keep in mind is to combine CSS and JS files. Combining the multiple files into single file will reduce the number of HTTP request to your web server.

JS compressor:

• Closure Compiler
• Minify JavaScript

CSS compressor:

• Minify CSS
• CSS Compressor

Alternatively you can use WordPress wp minify plugin for combining various JS and CSS files into one file.

31. Compress Images

Like compressing CSS and JS files its also good to compress the images of your WordPress site. We have plugin which uses the API of the smush.it and provide the compressed images for your WordPress site.

• WP Smush IT

Use of CSS Sprite is also beneficial in case of reducing the number of HTTP request.

32. Compress Your Static Content with gZip

Compressing the static contents with gZip compression will drastically change your site loading time. Its a good practice for general web development too. Again I will go with the HTML 5 Boiler Plate for this trick.

	<IfModule mod_deflate.c>
  # force deflate for mangled headers
  # developer.yahoo.com/blogs/ydn/posts/2010/12/pushing-beyond-gzipping/
  <IfModule mod_setenvif.c>
    <IfModule mod_headers.c>
      SetEnvIfNoCase ^(Accept-EncodXng|X-cept-Encoding|X{15}|~{15}|-{15})$ ^((gzip|deflate)s*,?s*)+|[X~-]{4,13}$ HAVE_Accept-Encoding
      RequestHeader append Accept-Encoding "gzip,deflate" env=HAVE_Accept-Encoding
    </IfModule>
  </IfModule>

  # HTML, TXT, CSS, JavaScript, JSON, XML, HTC:
  <IfModule filter_module>
    FilterDeclare   COMPRESS
    FilterProvider  COMPRESS  DEFLATE resp=Content-Type $text/html
    FilterProvider  COMPRESS  DEFLATE resp=Content-Type $text/css
    FilterProvider  COMPRESS  DEFLATE resp=Content-Type $text/plain
    FilterProvider  COMPRESS  DEFLATE resp=Content-Type $text/xml
    FilterProvider  COMPRESS  DEFLATE resp=Content-Type $text/x-component
    FilterProvider  COMPRESS  DEFLATE resp=Content-Type $application/javascript
    FilterProvider  COMPRESS  DEFLATE resp=Content-Type $application/json
    FilterProvider  COMPRESS  DEFLATE resp=Content-Type $application/xml
    FilterProvider  COMPRESS  DEFLATE resp=Content-Type $application/xhtml+xml
    FilterProvider  COMPRESS  DEFLATE resp=Content-Type $application/rss+xml
    FilterProvider  COMPRESS  DEFLATE resp=Content-Type $application/atom+xml
    FilterProvider  COMPRESS  DEFLATE resp=Content-Type $application/vnd.ms-fontobject
    FilterProvider  COMPRESS  DEFLATE resp=Content-Type $image/svg+xml
    FilterProvider  COMPRESS  DEFLATE resp=Content-Type $application/x-font-ttf
    FilterProvider  COMPRESS  DEFLATE resp=Content-Type $font/opentype
    FilterChain     COMPRESS
    FilterProtocol  COMPRESS  DEFLATE change=yes;byteranges=no
  </IfModule>

  <IfModule !mod_filter.c>
    # Legacy versions of Apache
    AddOutputFilterByType DEFLATE text/html text/plain text/css application/json
    AddOutputFilterByType DEFLATE application/javascript
    AddOutputFilterByType DEFLATE text/xml application/xml text/x-component
    AddOutputFilterByType DEFLATE application/xhtml+xml application/rss+xml application/atom+xml
    AddOutputFilterByType DEFLATE image/svg+xml application/vnd.ms-fontobject application/x-font-ttf font/opentype
  </IfModule>
  </IfModule>

33. Manage eTags

eTags are also used for caching purpose, but if you have set a expire headers for the static contents then its good to disable the eTags functionality. Let’s see how to disable the eTag using .htaccess file.

You need to place one line in your .htaccess file to disable the eTag.

	FileETag none

To know more about the eTag, you can visit this link.

34. Use a CDN for High Traffic Websites

Using a CDN (Content delivery network) is the better option for the high traffic site. CDN is the Content Delivery Network of the optimized servers all over the world. These servers works together to server your content via number of servers.

Most of the CDN’s out there right now are paid and can be very costly. We have only one CDN which is free 🙂

• Amazon S3
• Max CDN
• Media Temple CDN
• Free CDN

Good luck !!!