WordPress Security - Battening down the hatches
Download as PPTX, PDF0 likes1,202 views
A brief overview talk on WordPress Security, presented at WordCamp Netherlands 2015.
![SECURITY OP SERVER-NIVEAU:
.HTACCESS
Blokkeer de includes
# Block the include-only files.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^wp-admin/includes/ - [F,L]
RewriteRule !^wp-includes/ - [S=3]
RewriteRule ^wp-includes/[^/]+.php$ - [F,L]
RewriteRule ^wp-
includes/js/tinymce/langs/.+.php - [F,L]
RewriteRule ^wp-includes/theme-compat/ -
[F,L]](https://image.slidesharecdn.com/wcnl2015talk-150926130953-lva1-app6892/85/WordPress-Security-Battening-down-the-hatches-11-320.jpg)
![SECURITY OP SERVER-NIVEAU:
.HTACCESS
Blokkeer Track & Trace en vermijd XSS
attack
#Block track & trace
RewriteEngine On
RewriteCond %{REQUEST_METHOD}
^TRACE
RewriteRule .* - [F]](https://image.slidesharecdn.com/wcnl2015talk-150926130953-lva1-app6892/85/WordPress-Security-Battening-down-the-hatches-13-320.jpg)
WordPress Security - Battening down the hatches
- 1. WORDPRESS SECURITY – BATTENING DOWN THE HATCHES @brechtryckaer t
- 2. @BRECHTRYCKAERT - WordPress Specialist bij Combell.com - Auteur van WordPress Security 101 ebook (Kindle, Kobo, iBooks, Gumroad)
- 3. WIE WERD AL EENS SLACHTOFFER VAN HACKING?
- 4. SOORTEN HACKS Backdoors & Shells Pharma hack Drive By Downloads Malafide redirects
- 5. HOE GERAKEN HACKERS BINNEN? Oorzaken van hacking Lekken in thema's en plugins Verouderde versies Wordpress Server config & andere oorzaken
- 6. HOE KUNNEN WE DE BEVEILIGING VERSCHERPEN? Waar aanpakken? SERVER WORDPRESS
- 7. SECURITY BINNEN WORDPRESS De basics: Security plugin (iThemes, Wordfence, Sucuri, ...) Sterke wachtwoorden “admin” gebruiker uit den boze
- 8. SECURITY BINNEN WORDPRESS Maar ook: 2-factor authentication (bvb Clef) Inactieve plugins en thema’s verwijderen UPDATES! UPDATES! UPDATES! Geen core-file tweaken!
- 9. SECURITY OP SERVER-NIVEAU Verschillende tweaks aan de wp-config.php Aanpassingen aan .htaccess Mappen 755-rechten, files 644. Robots.txt
- 10. SECURITY OP SERVER-NIVEAU: WP-CONFIG.PHP define( 'DISALLOW_FILE_EDIT', true ); => uitschakelen thema & plugin editor define('WP_AUTO_UPDATE_CORE', true); add_filter( 'auto_update_plugin', '__return_true' ); add_filter( 'auto_update_theme', '__return_true' ); => forceert automatische updates van WordPress (alle releases) alsook plugins en thema’s.
- 11. SECURITY OP SERVER-NIVEAU: .HTACCESS Blokkeer de includes # Block the include-only files. <IfModule mod_rewrite.c> RewriteEngine On RewriteBase / RewriteRule ^wp-admin/includes/ - [F,L] RewriteRule !^wp-includes/ - [S=3] RewriteRule ^wp-includes/[^/]+.php$ - [F,L] RewriteRule ^wp- includes/js/tinymce/langs/.+.php - [F,L] RewriteRule ^wp-includes/theme-compat/ - [F,L]
- 12. SECURITY OP SERVER-NIVEAU: .HTACCESS Beperk backend access Afzonderlijke .htaccess voor in /wp- admin # Limit backend acces. order deny,allow deny from all allow from xx.xx.xx.xx
- 13. SECURITY OP SERVER-NIVEAU: .HTACCESS Blokkeer Track & Trace en vermijd XSS attack #Block track & trace RewriteEngine On RewriteCond %{REQUEST_METHOD} ^TRACE RewriteRule .* - [F]
- 14. SECURITY OP SERVER-NIVEAU: .HTACCESS Afzonderlijke .htaccess in /wp- content/uploads/ #Block PHP execution <Files *.php> deny from all </Files>
- 15. SECURITY OP SERVER-NIVEAU: FILE PERMISSIONS Mappen 755 Bestanden 644 Geen 777!!!
- 16. SECURITY OP SERVER-NIVEAU: ROBOTS.TXT Vermijd dat bots kritieke locaties kunnen crawlen Voeg volgende toe als robots.txt: User-agent: * Disallow: /feed/ Disallow: /trackback/ Disallow: /wp-admin/ Disallow: /wp-content/ Disallow: /wp-includes/ Disallow: /xmlrpc.php Disallow: /wp-
- 17. SECURITY: USER & EXTERN Security op de pc’s/mac’s van eindgebruiker Illegale/”gevonden” software UPDATES UPDATES UPDATES!!! Komt meestal neer op het heropvoeden van de gebruiker
- 18. SECURITY: USER & EXTERN CDN, bijvoorbeeld CloudFlare
- 19. PENETRATION TESTING! WPScan (http://www.wpscan.org) Sucuri Sitecheck (https://sitecheck.sucuri.net/)
- 20. VRAGEN??? Contacteer me! Twitter: @brechtryckaert Blog: http://brechtryckaert.be 50% korting op mijn e-book: https://gum.co/WPS101/WCNL2015