Successfully reported this slideshow.
Activate your 14 day free trial to unlock unlimited reading.
▸ SQL injections
▸ Poor server security
▸ Lack of understanding of WordPress
▸ Recent versions of PHP and MySQL
▸ Malware scanning and other security tools present
▸ Account isolation
▸ WordPress experience
▸ Bad habits
▸ Minimal default password requirements
▸ The “admin” username
▸ The crummy passwords (12345)
▸ User access levels
User Role Editor
Integrating a CAPTCHA with the WordPress Login Form
Brute Force Login Protection
Top usernames being attacked:
admin, Admin, administrator, test, root
Top passwords being tried:
password, 12345678, 123admin, 123abc,
▸ Pick a solid hosting company
▸ Evaluate your themes and plugins carefully
▸ Go with those that have been vetted by WordPress
▸ Choose only those that are actively developed and/or supported
▸ Only install what you NEED
▸ Be thoughtful about who/how many should get admin- level access
▸ Backup all the things
▸ Your site (or sites with multisite)
▸ Your settings (what themes and plugins you’re using)
▸ Your ﬁles
▸ Your database
▸ Aim to save at least 6 months back
▸ WordPress can be set to do updates automatically
▸ Added after version 3.7
▸ Can be set for core, theme, plugin, and translation updates
▸ Conﬁgure auto updates with wp-conﬁg (More)
▸ Routine review of environments every 6-12 months:
▸ Themes and plugins not in use
▸ Anything that hasn’t been updated in the last 18-24 months (or
▸ Sites (in a multisite environment) that are no longer active
▸ Checking your backups
▸ Reviewing the conﬁguration of security plugins
▸ Malware scanners
▸ htaccess limitations
▸ File permissions
▸ Security Plugins: iThemes Security, Sucuri ($), Wordfence
▸ Scanning tools: AntiVirus, WP Antivirus Site Protection
▸ Logging and tracking tools: CodeGuard ($), wp_debug_log in wp-
▸ Theme and plugin evaluators: Theme-Check, Plugin- Check
▸ Not updating
▸ Not cleaning out old themes and plugins
▸ Using popular plugins because they’re popular
▸ Using “admin” accounts
▸ Weak passwords
▸ Bad hosting
AVOID COMMON MISTAKES
1. Stay calm.
2. Get your site back.
3. Clean up the hack.
4. Identify the source of the hack.
AFTER THE HACK…
Get your site back.
▸ try a password reset or database edit
▸ Take a backup of what’s there - ﬁles, database, uploads - for later
▸ Remove unknown users and reset all passwords
▸ Change your keys and salts in wp-conﬁg
▸ Restore to a known good version of the site (if you have one)
Clean up the hack.
▸ Review your ﬁles and database for suspicious elements
▸ When in doubt, reinstall.
▸ New directory, WP install, reinstall all themes and plugins
▸ User accounts with new passwords
▸ Import the content from a clean backup
▸ Check your hosting for other potential damage
▸ Use version control to compare ﬁle changes
▸ Get help from your hosting
▸ Check logs
▸ Scan your hosting environment for malware
▸ Scan your personal machine(s) for viruses and malware
▸ Change your password again. including hosting account passwords.
▸ Start over and review all elements for potential security weaknesses
▸ Scan the new site