Securing WordPress by Jeff Hoffman
1 like1,222 views
The document provides various strategies for securing a WordPress site against hacking, detailing the importance of server security, strong passwords, and proper file permissions. It advises on specific configurations, regular updates, and the use of security plugins, while emphasizing the necessity for backups and cleanup post-installation. Additional tips include altering default settings and monitoring for vulnerabilities to reduce risk.
![SECURE /WP-INCLUDES*
• Add this to .htaccess...
# Block the include-only files.
RewriteEngine On
RewriteBase /
RewriteRule ^wp-admin/includes/ - [F,L]
RewriteRule !^wp-includes/ - [S=3]
RewriteRule ^wp-includes/[^/]+.php$ - [F,L]
RewriteRule ^wp-includes/js/tinymce/langs/.+.php - [F,L]
RewriteRule ^wp-includes/theme-compat/ - [F,L]](https://image.slidesharecdn.com/wordpresssecurity-120502232419-phpapp02/85/Securing-WordPress-by-Jeff-Hoffman-19-320.jpg)
Securing WordPress by Jeff Hoffman
- 1. SECURING WORDPRESS Presented by Jeff K. Hoffman VP of R&D, MyLeadSystemPRO http://facebook.com/jeff.k.hoffman
- 2. WHY DO HACKERS HACK? • Easy SEO • Malware Distribution • Entertainment & Peer Recognition
- 3. HOW DO HACKERS HACK? • Bots - like the Google Bot, but Evil. • Widely available, frequently updated. • Viral spread
- 4. BEFORE YOU BEGIN • Backup your site! • Implement one tip and test, then another and test, etc. • If it’s over your head, just skip it (or, hire help.)
- 5. SECURE YOUR SERVER • Your blog is only as secure as your Web Host. • Ifa hacker gets into your hosting account (via FTP, SSH, etc.), they win before they even worry about hacking WordPress. • Use strong passwords. (StrongPasswordGenerator.com) • Ask your Web Host how to best secure your account.
- 6. PERMISSIONS • In general... • Files should be 644. • Folders should be 755. • /wp-content/uploads/ should be 775. • /wp-content/themes/ should be 775 for Theme Editor.
- 7. PERMISSIONS find /path/to/wordpress/ -type f -exec chmod 644 {} ; find /path/to/wordpress/ -type d -exec chmod 755 {} ; chmod -R 775 /path/to/wordpress/wp-content/uploads chmod -R 775 /path/to/wordpress/wp-content/themes
- 8. PERMISSIONS
- 9. DEFY CONVENTION • Change admin username • Never post as admin! • Move wp-config.php • Change database table prefix** • In wp-config.php • In your database
- 10. USE SECRET KEYS Edit wp-config.php... /**#@+ * Authentication Unique Keys and Salts. * * Change these to different unique phrases! * You can generate these using the {@link https://api.wordpress.org/secret-key/1.1/salt/ WordPress.org secret-key service} * You can change these at any point in time to invalidate all existing cookies. This will force all users to have to log in again. * * @since 2.6.0 */ define('AUTH_KEY', 'put your unique phrase here'); define('SECURE_AUTH_KEY', 'put your unique phrase here'); define('LOGGED_IN_KEY', 'put your unique phrase here'); define('NONCE_KEY', 'put your unique phrase here'); define('AUTH_SALT', 'put your unique phrase here'); define('SECURE_AUTH_SALT', 'put your unique phrase here'); define('LOGGED_IN_SALT', 'put your unique phrase here'); define('NONCE_SALT', 'put your unique phrase here');
- 11. CLEAN UP • After WordPress is installed, delete /wp-admin/install.php • Delete unused/inactive plugins & themes
- 12. UPDATE OFTEN • Always use the latest version of... • WordPress • Theme • Plugins
- 13. MAKE DAILY BACKUPS • BuyBackupBuddy.com ($75/year) • VaultPress.com ($180/year) • NOTE: Backups of a hacked site are ONLY useful for forensics!
- 14. STRONG PASSWORD • StrongPasswordGenerator.com • 1Password
- 15. AVOID DETECTION • Remove WordPress Footprints • Don’t use the Meta sidebar widget • http://wordpress.org/extend/plugins/secure-wordpress/
- 16. MINIMIZE PLUGINS • Every plugin you install increases risk • Popular, widely used plugins are less risky • Example: TimThumb
- 17. SECURE /WP-ADMIN* • http://www.cpanel.net/media/tutorials/passwdprotect.htm • Add to .htaccess... <FilesMatch ".(css|js|jpg|jpeg|gif|png)$"> Order Allow,Deny Allow from All Satisfy Any </FilesMatch> <Files admin-ajax.php> Order Allow,Deny Allow from All Satisfy Any </Files>
- 18. SECURE /WP-ADMIN • SSL • http://codex.wordpress.org/Administration_Over_SSL
- 19. SECURE /WP-INCLUDES* • Add this to .htaccess... # Block the include-only files. RewriteEngine On RewriteBase / RewriteRule ^wp-admin/includes/ - [F,L] RewriteRule !^wp-includes/ - [S=3] RewriteRule ^wp-includes/[^/]+.php$ - [F,L] RewriteRule ^wp-includes/js/tinymce/langs/.+.php - [F,L] RewriteRule ^wp-includes/theme-compat/ - [F,L]
- 20. BLOCK ATTACKS • WordPress Firewall 2 • Login Lockdown
- 21. MONITORING • Google Webmaster Tools • WordPress File Monitor