Securing your WordPress powered Website
- 1. Securing your WordPress powered Website Pratik Jagdishwala
- 2. About Me Sr. Product Manager, Endurance APAC
- 3. Popularity ● 26% of Internet is powered by WordPress ● Great Community & Commercial support ● Freely available Themes, Plugins and Scripts
- 4. Issues ● Not possible to control all content available online ● Poorly written plugins, themes and scripts ● Usage of poorly managed repositories for addons ● Usage of cracked plugins, themes and scripts ● Un-optimized/Un-secure ● Bad practices ● Lack of long term maintenance strategy
- 5. Some numbers According to a recent report by wpscan.org, out of 3792 known WordPress security vulnerabilities ● 52% are from WordPress plugins ● 37% are from core WordPress ● 11% are from WordPress themes As per codex.wordpress.org ● 41% were hacked due to a security vulnerability on their hosting platform ● 29% were hacked via a security issue in WordPress theme being used ● 22% were hacked via a security issue in WordPress plugin being used ● 8% were hacked because of weak password
- 6. Repercussions ● Loss of traffic and SEO ● Warning in browser ● Host disabling of website ● Loss of reputation/trust ● Website flagged as distributing malware ● Readers complaining their AV’s flagging website ● Visible content changed without knowledge/authorization ● Iframes/pop-ups on opening of web site ● Monetary/Non-Monetary loss
- 7. How to Avoid? Prevention is better than cure! ● Keep WordPress, Themes, Plugins updated ● Move wp-config.php out of DocRoot ● Hide WordPress version number ● Disable PHP Error Reporting ● Change the Default Secret Keys ● Delete unused/unmaintained Themes/Plugins
- 8. How to Avoid? Prevention is better than cure! ● Disable directory listing ● Do not use default user, change admin username ● Use a secure password ● Consider Dual factor auth ● Limit login attempts ● Force SSL usage ● Move WP Login URL ● Protect wp-admin directory ● Disable XML-RPC is not needed
- 9. How to Avoid? Prevention is better than cure! ● Use strong MySQL password ● Change default WP DB Table Prefix ● Connect using secure methods (SFTP, SSH) ● Disable 777 perms ● Limited perms to 644 max ● Monitor for Malware
- 10. How to Avoid? Prevention is better than cure! ● Install a good security plugin ○ Jetpack (VaultPress) ○ WordFence ○ All in one WP Security ○ SiteLock ● Use CDN’s with WAFs
- 11. How to Avoid? Prevention is better than cure! ● Backup your WordPress Site regularly ● Use third party backup solutions and backup websites to Remote Locations