10 Steps to Secure Wordpress Sites
2 likes953 views
The document presents a 10-step guide for enhancing the security of WordPress sites, emphasizing the importance of unique usernames, strong passwords, and limiting login attempts. It covers file permissions, protecting configuration files, and preventing SQL injection attacks using .htaccess modifications. Additionally, it suggests disabling file editing, changing the default database table prefix, and using security audit plugins.
![Use .htaccess to stop SQL Injection
attacks.
Add to .htaccess –
Options +FollowSymLinks
RewriteEngine On
RewriteCond %{QUERY_STRING} (<|%3C).*script.*(>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|[|%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|[|%[0-9A-Z]{0,2})
RewriteRule ^(.*)$ index.php [F,L]
Wordpress security](https://image.slidesharecdn.com/10stepstosecurewordpresssites-151214051743/85/10-Steps-to-Secure-Wordpress-Sites-13-320.jpg)
10 Steps to Secure Wordpress Sites
- 2. Area: Username and Password 1 Wordpress security
- 3. Use random username generator to set a unique username Change default “Administrator" usernames Avoid typical “Administrator” usernames like admin, administrator, root, manager, debug, user, system, default, netman, superuser, guest, backup, sys, sysadmin, siteadmin, test, … Wordpress security
- 4. Area: Username and Password 2 Wordpress security
- 5. Set a secure password Use a password service such as LastPass Use a random 16 (at least) character password UPPER, lower, digits, punctuation Wordpress security
- 6. Area: Login Limits 3 Wordpress security
- 7. Block IP address after X number of login attempts within a period. Use Limit Login Attempts plugin – http://wordpress.org/plugins/limit-login- attempts/ Wordpress security
- 8. Area: Folder and File permissions 4 Wordpress security
- 9. Change directory permissions. WordPress folders/directories = 755 WordPress files = 644 .htaccess, php.ini, wp-config.php = 444 Wordpress security
- 10. Area: Protect configuration files 5 Wordpress security
- 11. Use .htaccess to protect your wp- config.php file. Add to .htaccess – <files wp-config.php> order allow,deny deny from all </files> Wordpress security
- 12. Area: SQL Injection Protection 6 Wordpress security
- 13. Use .htaccess to stop SQL Injection attacks. Add to .htaccess – Options +FollowSymLinks RewriteEngine On RewriteCond %{QUERY_STRING} (<|%3C).*script.*(>|%3E) [NC,OR] RewriteCond %{QUERY_STRING} GLOBALS(=|[|%[0-9A-Z]{0,2}) [OR] RewriteCond %{QUERY_STRING} _REQUEST(=|[|%[0-9A-Z]{0,2}) RewriteRule ^(.*)$ index.php [F,L] Wordpress security
- 14. Area: Prevent Directory Browsing 7 Wordpress security
- 15. Use .htaccess to stop SQL Injection attacks. Wordpress security Add to .htaccess – Options - Indexes
- 16. Area: Disable User File Editor 8 Wordpress security
- 17. Remove the WordPress dashboard Editor for themes and plugins. Add to wp-config.php – define('DISALLOW_FILE_EDIT', true); Wordpress security
- 18. Area: Change Default Table Prefix 9 Wordpress security
- 19. Default MySQL DB table prefix is wp_ Change before installing new WP sites. Add to wp-config.php – $table_prefix = ‘mynewprefix_'; Wordpress security
- 20. Area: Audit Changes 10 Wordpress security
- 21. Default MySQL DB table prefix is wp_ Change before installing new WP sites. Add WP Security Audit Log plugin - http://wordpress.org/plugins/wp-security- audit-log/ Wordpress security
- 22. This presentation has been submitted by:- Anuj Mathur Anuj has over 14 years experience in planning, managing and executing software projects on the open source platform. At AAPNA Infotech, he is presently managing product initiatives and process improvements. Wordpress security