Successfully reported this slideshow.
Activate your 14 day free trial to unlock unlimited reading.
Intro to Security (Beginner's Edition) WordCamp St. Louis 2015
EVERY DAY HACKERSTRYTO
FIND WAYSTO GETYOUR
WHY DO HACKERS HACK?
• Make bank
• Build a zombie site army
• Share their nasty malware with the world
• Get your information
• They are bored
• They want to see if they can do it
WHY ARETHESE PEOPLE
Anymore, it is not people but bots attacking your site. Hackers have programs that do the work for them.
Rarely is it people doing the hacking unless it is targeted. Strong opinion sites are a good example.
HOW DOTHEY GET IN?
• Guess your login. If you know it so can someone else. (Brute
force attack or man in the middle)
• Denial of Service attack (DDoS) ﬂood your site with more
trafﬁc than it can handle
• Through a theme, ﬁle or plugin
• Through your FTP or CPanel. (Files set to read, write,execute.
Brute force, anonymous login, shared hosting infection)
AND NOW FORTHE ONLY
THING SCARYTHAT I AM
NEVER EVER EVER USE ADMIN AS
USER NAME OR PASSWORD AS
ALWAYS CHANGEYOUR PREFIX NAME
FROM WP_ LET IT BE ANYTHING
FDHSFJKHS_ IS ALWAYS GOOD
I typically do not even look at what I am typing anymore
when I make the WP preﬁx.The random the better.
WHAT TO DO WHEN
ALWAYS USE SFTP
Regular FTP is not secure. Do not use it unless the
server is only set up for FTP.
Only give them access to what they NEED not what
Just because they want to be an admin does not
automatically make them one.
Guest bloggers should not be anymore than a contributor.
If it is only a temporary login, delete their login when
they have completed their job.
If they have posts on your site, you can knock them down to
subscribers so they can not change anything on your site.
If they are only doing work, delete them when their job is done.
Set up a ﬁle change detection
notiﬁcation to know what they are
changing in your site.
iThemes Security and other security plugins
give you the option to see what all users are
doing when logged into the dashboard.
Update core, update plugins, update themes, update
content, update everything and update often!
The biggest source of nearly all hacks as once
something is patched, it is trivial to get into the old
IFYOU USETHEMES OR PLUGINS AT ANY OFTHE
ENVATO (THEMEFOREST, CODE CANYON)
ALWAYS CHECKTHE BOXTO BE NOTIFIED OF
UPDATES.THEY WILL NOTTELLYOU OTHERWISE
This is why the RevSlider SoakSoak infection was so widespread.
Many didn't know the plugin was built within the theme.
HAVE A MINIMALIST APPROACH
TO PLUGINS ANDTHEMES.
• Only have the plugins you are using at that time
on your site.You can always upload them again
• Only have your theme you are using on your site.
• If something is not active, delete it.
BACK UPYOUR SITE!
SOMEWHERE,ANYWHERE, JUST HAVE A
BackupBuddy from iThemes is a great choice.
iThemes Security will do a database backup for you.
ALWAYS BACK UPTO SOMEPLACE OTHERTHANYOUR
SERVER. IFTHE SERVER GETS HACKED, SO DOESYOUR
EVEN BACKING A COPYTO DROPBOX ORYOUR
COMPUTER IS A BETTER OPTION.
DON’T LETYOUR SITE GET
Lonely sites can turn into zombie sites and nobody
wants a zombie
IFYOUR WEBSITE GET HACKED IT IS
NOTTHE END OFTHE WORLD.
IT CAN AND WILL BE FIXED.
WHO CLEANS HACKED
Well I do over at WP Security Lock ~Smile~
I apologize… had to do one shameful plug.
WHAT ARE OTHER WAYS I
CAN BE MORE SECURE?
ALWAYS USE COMPLEX
“PASSWORD” IS NEVER A
NEVER EMAIL PASSWORDSTO
USE A DIFFERENT PASSWORD
FOR EACH AND EVERYTHING
YOU LOG INTO.
USE SOMETHING LIKE
LASTPASS OR ONE
SHARE PASSWORDS WITH
IFTHE LOGIN HAS A
Yes I even have an anti-virus on my Mac!
AVG and Avast have free versions as well as paid.
Kaspersky is great with Windows and Macs.
USE AVPN WHEN CONNECTING
OUT INTHE WILD.
BACK UP EVERYTHING AND
BACK IT UP OFTEN.
IFYOU FEARYOU MIGHT LOSE
INFORMATION, SAVE IT IN MORETHAN
ONE SPOT. BITCASA, CARBONITE,AND
EXTERNAL HARD DRIVES ARE GREAT
OPTIONS OF BACKING UP DATA.