Website security


Published on

Published in: Education, Technology, Business
  • Be the first to comment

  • Be the first to like this

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide

Website security

  1. 1. WEBSITE SECURITY GUIDELINESAs I have been providing supoort for websites beinghacked, I advice you to implement these securities toprevent your website from being hacked.Also there are over millions of results in google for thekeyword “prevent wordpress hack“. Everyone has theirown opinion and I dont think all of these posts areupdated frequently. It’s been a while I have postedhere. If you have been following me on my twitter thenyou should know what I have been up to. First, here arefew things you should know- I have made severalchanges to this blog.
  2. 2. Recently, some of my blogs were hacked. It wasfunny how the index file had an image of a smurfshowing the middle finger with a text saying“where’s your security?” I was glad the hacker lefthis email address so I could thank him for mockingthe security of my blogs and so, I did. The amazingpart- This guy didn’t even touch the database; hedidn’t even inject any shit virus. I felt it was weirdbut after checking out each files, I found they wereall clean.
  3. 3. I was so involved in other projects that I didn’t pay muchattention to security which is actually the most important thinghere. If this dude didn’t breach my security, I wouldn’t haveknown it was vulnerable and hence wouldn’t have bothered totake action. Whatever it is, I have sent him a “Thank You” NoteI have removed some shitty plugins, transferredto HostGator, tweaked codes and more…Today, I have decided towrite a post on how I did what I did- that is, strengthen thesecurity of my blog to keep off hackers and all creepy people. Iwill have a video tutorial created for this later this month but fornow, check this out. Some basic tweaks can help protect all yourhard earned content. Check out the following tips to preventwordpress hack.
  4. 4. 14 Tips To Prevent WordPress Hack1. BackupThis is the first step and the most important. Before youplan on making any changes, make sure you backup yourentire DB. You can do this manually or use an availableplugin. I recommend backup buddy which backs up yourentire wordpress blog. Unlike free pluginswhich onlybackup your database, backup buddy exports your entiredatabase with images, files and whatever you have inyour blog’s content folder- Pretty sweeet!
  5. 5. 2. Update WordPress VersionSecond crucial step after backing up your blog is to update itto the latest version. You should always make sure that yourblog’s version is up to date. WordPress team creates patchesto help fix security holes. Follow wordpress feed to find outabout the latest updates or you could simply login to youradmin.I would also recommend that you follow WordPressDevelopment and BlogSecurity as they will inform youwhenever a new patch/fix is released.I also strongly advice to keep on following these twowebsite’s rss feeds or keep a check on whats latest :1. 2.
  6. 6. 3. Change your Login/Password to safeguard from BRUTE FORCETOOL of hackersThe default wordpress login is “admin” and most hackers know that.We should change this to something else that would be difficult toguess. Something like “rogers12” or “donhoe2” is good examples.The best thing to do is delete the default admin and create a newcustom login.I suggest that you use strong passwords which include upper/lowerkeys, numbers and symbols. Something like “rockSTAR19!@” or“Anabel2@!” is a great example of a strong password.Most hackers try to brute force the password so if your password isreally strong as I mentioned earlier, you should be fine.Do not use birth days, names, pet names or hobbies as passwords.People who are close to you know a little more about you; you don’twant any wild guesses.
  7. 7. 4. WordPress Keys in wp-config.php( most important) as this isalready done in latest wordpress, so no need to do thisI didn’t know much about wordpress keys but it is another important securitymeasure. These keys work as salts for WordPress cookies thus, ensuring betterencryption of user data.Use the WordPress Key Generator to generate these keys. Now open up your wp-config.php, find the lines that look like below and simply replace with the generated ones:define(‘AUTH_KEY’, ‘put your unique phrase here’); define(‘SECURE_AUTH_KEY’, ‘putyour unique phrase here’); define(‘LOGGED_IN_KEY’, ‘put your unique phrasehere’); define(‘NONCE_KEY’, ‘put your unique phrase here’);Save and you are done!
  8. 8. 5. Install WP Security Scan or bullet proofsecurity pluginThis plugin is the real deal. It’s simple andautomates stuff. It will scan your wordpress blogfor vulnerabilities and inform you if it finds anymalicious codes etc. If the texts are in green inthe admin panel then you should be good.However, they will not just be green; sometimesyou have to make them . And I will tell you how.
  9. 9. 6. Change Table Prefix(very very very important)The default table prefix for wordpress is wp_ . I know that, you knowit and I am sure the hacker does too. SQL Injection attacks are easierwith the default table prefix because it is easier to guess. A goodprefix would be “mashjg23_” or “sasdoe265_”. Changing yourdatabase table prefix is highly recommended and you can do this intwo ways. The manual way requires some work and is not suitablefor newbie; here’s when WP Security Scan Plugin makes your workmuch easier. It has a tab called “Database”. Once you are in it, youhave the option to rename your entire table prefix to something thatis tough to guess. Do this and you will be a step closer tostrengthening your blog’s security.
  10. 10. DB Password: How strong is your databasepassword? Both your wordpress loginpassword and database password should bestrong. Include upper/lower keys, numbersand symbols.
  11. 11. 7. Prevent WordPress Hack by Blocking Search Engine Spidersfrom Indexing the Admin Section(very important)Search engine spiders crawl over your entire blog and indexevery content unless they are told not to do so. We do not wantto index the admin section as it contains all the sensitiveinformation. The easiest way to prevent the crawlers fromindexing the admin directory, is to create a robots.txt file in yourroot directory. Then place the following code in the file:# User-agent: * Disallow: /cgi-bin Disallow: /wp-admin Disallow: /wp-includes Disallow: /wp-content/plugins/ Disallow: /wp-content/cache/ Disallow: /wp-content/themes/ Disallow: */trackback/ Disallow:*/feed/ Disallow: /*/feed/rss/$ Disallow: /category/*
  12. 12. 8. .htaccess Hacks (most imporatant).htaccess (hypertext access) is the default nameof directory-level configuration files that allowfor decentralized management of configurationwhen placed inside the web tree. .htaccess filesare often used to specify the security restrictionsfor the particular directory. This is not an exacttip that falls under the list but you should knowabout .htaccess because you can do a lot with itto prevent wordpress hack. I am not going to getin depth for this term but I found out somesweet .htaccess hacks which can tighten yourwordpress security. See them below.
  13. 13. 9. Protect your .htaccessAfter tweaking your .htaccess to protect yourblog from hackers, you cannot simply leave the.htaccess open itself to attacks. The hack belowprevents external access to any file with .hta .Simply place the code in your domain’s root.htaccess file.# STRONG HTACCESSPROTECTION</code> <Files ~“^.*.([Hh][Tt][Aa])”> order allow,deny denyfrom all satisfy all </Files>
  14. 14. 10. No Directory BrowsingIts not a good idea to allow your visitors to browsethrough your entire directory. This is an easy wayto find out about directory structures and thismakes it easier for hackers to lookout for securityholes.In order to stop this, simply add the piece of 2lines in your .htaccess in the root directory of yourWordPress blog.# disable directory browsing Options All -Indexes
  15. 15. 11. Secure wp-config.phpWp-config.php is important because it containsall the sensitive data and configuration of yourblog and therefore we must secure it through.htaccess. Simply adding the code below to the.htaccess file in the root directory can do the trick# protect wp-config.php <files wp-config.php> Order deny,allow Deny fromall </files>The code denies access to the wp-config.php fileto everyone (including me )
  16. 16. 12. Limit Access to the Wp-Content DirectoryWp-content contains everything. This is a veryimportant folder and you should secure it. Youdon’t want users to browse and get access tounwanted/other data. Users should be only able toview and access certain file types like images (jpg,gif, png), Javascript, css and XML.Place the code below in the .htaccess file within thewp-content folder (not the root).Order deny,allow Deny from all <Files ~“.(xml|css|jpe?g|png|gif|js)$”> Allow fromall </Files>
  17. 17. 13. Protect WordPress Admin FilesWp-admin should be accessed only by you and your fellow bloggers (ifany). You may use .htaccess to restrict access and allow only specific IPaddresses to this directory.If you have static IP address and you always blog from your computer, thenthis can be a good option for you. However, if you run a multiple user blogthen either you can opt out from this or you can allow access from a range ofIPs. You can refer to Apache’s documentation on mod_access for completeinstruction on how to set this up.Copy and paste the code below to the .htaccess in wp-admin folder (not rootfolder)# deny access to wp admin order deny,allow allow from xx.xx.xx.xx # This isyour static IP deny from allThe above code will prevent browser access to any file in these directoriesother than “xx.xx.xx.xx” which should be your static IP address.There is another way you could restrict access to the directory and that is byusing a password in the .htaccess. I am planning to write a detailed .htacesshack where I will include all of these.
  18. 18. 14. Prevent script injectionI found this code on wprecipes and it works like a charm. Nowyou can protect your WordPress blog from script injection, andunwanted modification of _REQUEST and/or GLOBALS.Simple copy and paste the code below to your .htaccess in theroot# protect from sql injection Options+FollowSymLinks RewriteEngine On RewriteCond%{QUERY_STRING} (<|%3C).*script.*(>|%3E)[NC,OR] RewriteCond %{QUERY_STRING} GLOBALS(=|[|%[0-9A-Z]{0,2}) [OR] RewriteCond %{QUERY_STRING}_REQUEST(=|[|%[0-9A-Z]{0,2}) RewriteRule ^(.*)$ index.php[F,L]Bonus
  19. 19. Take a note at the files permission. Wp Security scanshows this in a nice way. Browse the specific files onyour root using your favorite ftp client and Chmod thefiles if required.Last but not the least; you can install WordPress Firewall2 which actually protects your blog from malicioushackers. It blocks the attempts of the hacker andnotifies you when abused. Only the negative point ofthis plug-in is, it sometimes even blocks our action. Thiscan really get annoying and I do not really recommendthis plug-in unless you have SUPER Hackers and botsscrewing up your blog. Stick with the .htaccess hackssince they do the job pretty well and your blog shouldbe just fine.