Wordpress security 101 202
0 likes1,781 views
Script kiddies and inside attackers are common threats to WordPress sites. To prevent attacks, site owners should keep their WordPress core, plugins, and themes up to date, use strong permissions on files and directories, and enable security features from their host like mod_sec. Logging and monitoring errors and traffic is also important to detect any suspicious activity.
![Script kiddies vandalize websites both for the thrill of it and to increase their reputation among their peers. Some more malicious script kiddies have used virus toolkits to create and propagate the Anna Kournikova and Love Bugviruses.[1] Script kiddies lack, or are only developing, coding skills sufficient to understand the effects and side effects of their work. As a result, they leave significant traces which lead to their detection, or directly attack companies which have detection and countermeasures already in place, or in recent cases, leave automatic crash reporting turned on. – Wiki Definition KiddieScripters6](https://image.slidesharecdn.com/wordpresssecurity101-202-110410041608-phpapp02/85/Wordpress-security-101-202-6-320.jpg)
Wordpress security 101 202
- 1. Wordpress Security 101-202By James F. Ruffer III C|EH1
- 2. Bio of a Ethical Hacker:I am always thinking how can I break that?Open source brain and help as many as possible…within reason.2
- 3. My wordpress sites www.unixbox.orgwww.resolutegames.com < hackedwww.resoluteinteractive.commemphis.issa.orgwww.socialowl.cowww.securityevents.infowww.socialmediasecurity.com3
- 4. FireTalk – 3, 2, 1. GO!4
- 5. Who is attacking “you”?Kiddie Scripter'sInnocent bystandersEasy targets – inside attacksYou5
- 6. Script kiddies vandalize websites both for the thrill of it and to increase their reputation among their peers. Some more malicious script kiddies have used virus toolkits to create and propagate the Anna Kournikova and Love Bugviruses.[1] Script kiddies lack, or are only developing, coding skills sufficient to understand the effects and side effects of their work. As a result, they leave significant traces which lead to their detection, or directly attack companies which have detection and countermeasures already in place, or in recent cases, leave automatic crash reporting turned on. – Wiki Definition KiddieScripters6
- 7. Innocent bystanders Wrong place at the wrong time.7
- 8. Easy Targets – Inside Attacker8
- 9. “You” 9
- 10. Why are they attacking you?Kiddie Scripter'sInnocent bystandersEasy targets – inside attacksYou10
- 11. Scanned for certain information or pluginsBroadcasting wrong information Testing out tools before attacking real targetIdiots!KiddieScripters11
- 12. Innocent bystanders Wrong place at the wrong time.Alabama KKKPorn bloggerCanadian Pills12
- 13. Easy Targets – Inside Attacker13
- 14. “You” 14
- 15. How to preventKiddie Scripter'sInnocent bystandersEasy targets – inside attacksYou15
- 16. Keep your site up to dateKeep your plugins up to date / Use reliable / popularKeep your widgets up to date / tested and approvedAdd .htaccess to wp-admin pageRead your hosting status updates “godaddy”Ask for mod_sec to be installed by hosting providerKiddieScripters16
- 17. Innocent bystanders DNS – What is it?Whoiswww.yourdomain.com Go up 2 down 2 Misspelling your names17
- 18. Easy Targets – Inside Attacker18
- 19. “You” 19
- 20. Experts / Hosting on managed serverPermissions and Root Kill blogs4x316x920
- 21. All files should be owned by your user account, and should be writable by you. Any file that needs write access from WordPress should be group-owned by the user account used by the web server. / -- the root Wordpress directory: all files should be writable only by your user account.EXCEPT .htaccess if you want WordPress to automatically generate rewrite rules for you/wp-admin/ -- the WordPress administration area: all files should be writable only by your user account./wp-includes/ -- the bulk of WordPress application logic: all files should be writable only by your user account./wp-content/ -- variable user-supplied content: intended by Developers to be completely writable by all (owner/user, group, and public)./wp-content/themes/ -- theme files. If you want to use the built-in theme editor, all files need to be group writable. If you do not want to use the built-in theme editor, all files can be writable only by your user account/wp-content/plugins/ -- plugin files: all files should be writable only by your user account.other directories under /wp-content/ should be documented by whatever plugin / theme requires them. Permissions may vary.File Permissions – Hosting your own21
- 22. Error logs Please customize your error handlers.Check your logs /var/logs/ /apache2 /httpdForce SSL Usage - NoClear TXT!Traffic is keyUse .htaccess To Protect The wp-config File Remove Your WordPress Version Number… Seriously!22
Editor's Notes
- #5: I am going to run through this as if you don’t know anything about security per se. At the end I will get into more advanced tools and techniques. Some of this might be common sense but I have to say it so I can tell you I told you so later.