Basics for Securing WordPress

REBECCA BOLLWITT @Miss604 Miss604.com/contact

Basics forSecuring WordPress

Bloggers Intermediate UsersSo you’ve decided to run a WordPress blog....

Bloggers Intermediate UsersMost common WordPress Hacks: 1. Sending specially-crafted HTTP requests to your server with speciﬁc exploit payloads for speciﬁc vulnerabilities. These include old/outdated plugins and software. 2. Attempting to gain access to your blog by using "brute- force" password guessing.

Bloggers Intermediate UsersSecurity starts with usernames & passwords

Bloggers Intermediate UsersWhatever you do, do not use “Admin” as your administrative account username (default was “ﬁxed” in WP 3.0)

Bloggers Intermediate UsersDo not use a password that you use foranything else. Make it complicated with letters, numbers, and symbols %Thi$isMyS3curEPa$sw0rD%

Bloggers Intermediate Users Do not approve spam comments, no matter how lovely they soundUse Akismet (packaged with WordPress) for catching spam

Bloggers Intermediate UsersPlugins you can install and use...

Bloggers Intermediate UsersPluginWordPress BackupUsageAutomatic backupsWhere to get ithttp://wordpress.org/extend/plugins/wordpress-backup/

Bloggers Intermediate UsersPluginWordPress Security ScanUsageScans for vulnerabilitiesWhere to get ithttp://wordpress.org/extend/plugins/wp-security-scan/

Bloggers Intermediate UsersPluginSecure WordPressUsageBehind the scenesWhere to get ithttp://wordpress.org/extend/plugins/secure-wordpress/

Bloggers Intermediate UsersPluginStealth LoginUsageSecret Login URLWhere to get ithttp://wordpress.org/extend/plugins/stealth-login/

Bloggers Intermediate Users Others: Login Logger Exploit Scanner WordPress Firewall

Bloggers Intermediate UsersSpeaking of plugins, make sure yours are all up to date

Bloggers Intermediate UsersAnd, only installplugins from themain WordPress directory

Bloggers Intermediate UsersThe same goes for themes

Bloggers Intermediate Users Now how can youtell if you’ve been hacked?

Bloggers Intermediate UsersCommon symptoms:Slow performance

Bloggers Intermediate UsersCommon symptoms:Slow performanceTrouble logging in

Bloggers Intermediate UsersCommon symptoms:Slow performanceTrouble logging inYour theme looks “off ”

Bloggers Intermediate UsersCommon symptoms:Slow performanceTrouble logging inYour theme looks “off ”Unusually high amounts of spam

Bloggers Intermediate UsersCommon symptoms:Slow performanceTrouble logging inYour theme looks “off ”Unusually high amounts of spamUnusually slow trafﬁc

Bloggers Intermediate UsersCommon symptoms:Funny-looking Google results

Bloggers Intermediate UsersCommon symptoms:Funny-looking Google resultsGoogle yourself every day

Bloggers Intermediate Users

Bloggers Intermediate UsersFor users with FTP access

Bloggers Intermediate Users Know and love the WordPress Codexhttp://codex.wordpress.org/Hardening_WordPress

Bloggers Intermediate UsersBasics, from the Codex:

Bloggers Intermediate UsersBasics, from the Codex: Your computer could have security issues

Bloggers Intermediate UsersBasics, from the Codex: Your computer could have security issues Make sure you are running the latest WP

Bloggers Intermediate UsersBasics, from the Codex: Your computer could have security issues Make sure you are running the latest WP Your host could have security issues

Bloggers Intermediate UsersBasics, from the Codex: Your computer could have security issues Make sure you are running the latest WP Your host could have security issues Lock down your directories

Bloggers Intermediate UsersBasics, from the Codex: Your computer could have security issues Make sure you are running the latest WP Your host could have security issues Lock down your directories Default: Directories should be 755 Files should be 644

Bloggers Intermediate UsersSecure your wp-conﬁg.php ﬁle by moving it to the directory above (just one level above WordPress directory)

Bloggers Intermediate UsersGive wp-conﬁg.php 400 or 440 permissions

Bloggers Intermediate UsersAlternative to using a plugin to hide version; edit your header.php <?php remove_action(wp_head, wp_generator); ?>

Bloggers Intermediate UsersMonitor your ﬁles for changes

Bloggers Intermediate UsersResources: Your host’s status blog, Twitter, or page Your computer’s anti-virus & security The WordPress Codex: Hardening WordPress

Bloggers Intermediate UsersResources: Your host’s status blog, Twitter, or page Your computer’s anti-virus & security The WordPress Codex: Hardening WordPress If all else fails, ask the “community” either on WordPress forums, WordPress Meetup Groups, or Twitter

Bloggers Intermediate UsersAdditional comments, questions?

Bloggers Intermediate UsersRecap: Usernames & passwords

Bloggers Intermediate UsersRecap: Usernames & passwords Get trusted plugins & theme

Bloggers Intermediate UsersRecap: Usernames & passwords Get trusted plugins & theme Use security plugins

Bloggers Intermediate UsersRecap: Usernames & passwords Get trusted plugins & theme Use security plugins Monitor -- Google yourself

Bloggers Intermediate UsersRecap: Usernames & passwords Get trusted plugins & theme Use security plugins Monitor -- Google yourself Know and love the Codex

Bloggers Intermediate UsersRecap: Usernames & passwords Get trusted plugins & theme Use security plugins Monitor -- Google yourself Know and love the Codex Security on all levels -- computer, host, & WP

Bloggers Intermediate UsersRecap: Usernames & passwords Get trusted plugins & theme Use security plugins Monitor -- Google yourself Know and love the Codex Security on all levels -- computer, host, & WP Hide version and login page

Bloggers Intermediate UsersRecap: Usernames & passwords Get trusted plugins & theme Use security plugins Monitor -- Google yourself Know and love the Codex Security on all levels -- computer, host, & WP Hide version and login page Lock down ﬁle permissions

Bloggers Intermediate UsersRecap: Usernames & passwords Get trusted plugins & theme Use security plugins Monitor -- Google yourself Know and love the Codex Security on all levels -- computer, host, & WP Hide version and login page Lock down ﬁle permissions Monitor -- again

REBECCA BOLLWITT @Miss604 @sixty4mediaMiss604.com/contact sixty4media.com/contact

http://sixty4media.com	468
http://feeds.feedburner.com	4
http://paper.li	2
http://us-w1.rockmelt.com	1
http://www.theloophole.co.uk	1

Basics for Securing WordPress

by miss604 on Jan 22, 2011

Accessibility

Categories

Tags

Upload Details

Usage Rights

5 Embeds 476

Statistics

Basics for Securing WordPress — Presentation Transcript