My session from #WPCampus on leveling up your WordPress Security. A 3-pronged approach (Site, Server, External)

1. LEVEL UP YOUR WORDPRESS
SECURITY
By Mitch Canter – Vanderbilt University Web Communications
(@thatmitchcanter)

2. Who am I?

3. Mitch Canter
Senior Web Developer, Vanderbilt University Web Communications

4. SECURITY QUEST
PRESS START TO BEGIN

5. 30,000

6. 30,000
Number of Websites Hacked PER DAY

7. 78%

8. 78%
Built on a WordPress CMS

9. There is no secret sauce.

10. Goal: Reduce Risk

11. Proactive, Not Reactive

12. 3 PRONGED APPROACH

13. 1. SERVER
2. SITE
3. EXTERNAL

14. 1. SERVER
CON Modifier, Hearts, Health

15. SSH Keys
Cryptographic Keys that Give Access to a Server.

16. Isolated Execution
Environments
Application Specific Servers (File/Database/Etc)

17. Single Server – Single Point
of Attack

18. Application Specific
Isolated Servers

19. Firewalls
What Services are exposed?

20. Firewall Example

21. IPTABLES
UFW FIREWALL

22. Inclusive Vs. Exclusive

23. File Permissions

24. Restrict, Then Relax

25. 644 FILES
755 FOLDERS

26. 2. SITE
Armor, Equipment, Shields

27. KEEP WORDPRESS UPDATED

28. No, really… KEEP
WORDPRESS UPDATED

29. 56%
Percent of Out-Of-Date Hacked Websites

30. TimThumb
RevSlider
Gravity Forms
PS: The Panama Papers blamed on RevSlider exploit.

31. Plugin Audits
Do I REALLY need this plugin?

32. Two Factor Authentication
Multi-layer Authentication via Knowledge, Possession, or Inherance

33. XML-RPC Limitations
Code to disable via filter

34. User Audits
Do I REALLY need this user?

35. 1. PASSWORDS
2. ACCESS

36. “Concept of Least Privileged”
Only give access to those that need it, when they need it, and only for
the time they need it.

37. 3. External
“Magic” Shields, Blessings

38. SSL Certificates
Cryptographically Signed “Trust” of a Website

39. Let’s Encrypt
FREE SSL Certificates for Everyone!

40. Sucuri
Resources, Knowledge, and a Scanner Plugin

41. Vulnerable Plugins List
WPCampus Website, by Paul Gilzow

42. Offsite Backups
…just in case.

43. Questions?

44. Thanks!
@thatmitchcanter