1.
WordPress & security
Pieter Daalder
A few words on
dinsdag 25 oktober 16

2.
What can go wrong?
dinsdag 25 oktober 16

3.
Bruteforce attempt on wp-login.php
Bruteforce attempt using xmlrpc.php (system.multicall anyone?)
dinsdag 25 oktober 16

4.
dinsdag 25 oktober 16

5.
What can I do?
dinsdag 25 oktober 16

6.
securing xmlrpc.php
secure your login page
monitor changes on the filesystem
run updates
get a secure hostingprovider
other considerations
dinsdag 25 oktober 16

7.
why are we doing this?
DDoS via XML-RPC pingbacks
brute force attacks via XML-RPC
dinsdag 25 oktober 16

8.
blocking requests
<Files "xmlrpc.php">
Order Allow,Deny
deny from all
</Files>
<security>
<requestFiltering>
<denyUrlSequences>
<add sequence="xmlrpc.php" />
</denyUrlSequences>
</requestFiltering>
</security>
dinsdag 25 oktober 16

9.
blocking requests
Web Application Firewall
dinsdag 25 oktober 16

10.
securing xmlrpc.php
secure your login page
monitor changes on the filesystem
run updates
get a secure hostingprovider
other considerations
dinsdag 25 oktober 16

11.
2 factor authentication (2FA)
prevent bruteforce attempts
disable default errors
disable author pages
dinsdag 25 oktober 16

12.
securing xmlrpc.php
secure your login page
monitor changes on the filesystem
run updates
get a secure hostingprovider
other considerations
dinsdag 25 oktober 16

13.
Use inotify to monitor your filesystem
access
modify
attrib
open
create
delete
watch for files being accessed
watch if files are being written to
watch if metadata is altered
watch if a file is opened
watch if a file is created
watch if a file is deleted
dinsdag 25 oktober 16

14.
securing xmlrpc.php
secure your login page
monitor changes on the filesystem
run updates
get a secure hostingprovider
other considerations
dinsdag 25 oktober 16

15.
securing xmlrpc.php
secure your login page
monitor changes on the filesystem
run updates
get a secure hostingprovider
other considerations
dinsdag 25 oktober 16

16.
support recent versions of PHP
offer SSL
good customer service
regular and tested backups
DDOS prevention & intrusion detection
dinsdag 25 oktober 16

17.
securing xmlrpc.php
secure your login page
monitor changes on the filesystem
run updates
get a secure hostingprovider
other considerations
dinsdag 25 oktober 16

18.
username and password
disable file editor
least privileged principles
know your code
delete unused plugins/themes
obscure the login page
dinsdag 25 oktober 16

19.
Thank you for your time
Pieter Daalder
@w1zz
Vevida
WordPress expert
cooking (esp. bbq)
gardening
videogames
dinsdag 25 oktober 16

20.
Questions?
dinsdag 25 oktober 16