Secure Wordpress - 2016[17May - Mashhad]
•
1 like•651 views
Weak user password Hosting vulnerability WordPress theme vulnerability WordPress plugin vulnerability
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Secure Wordpress - 2016[17May - Mashhad]
Similar to Secure Wordpress - 2016[17May - Mashhad] (20)
Secure Wordpress - 2016[17May - Mashhad]
- 1. Secure Wordpress…Tips and tricks
- 2. HaMiD Fadaei Digital Marketing Officer – SEM/SEO Specialist Telegram : HFadaei Linkedin : HaMiDFadaei Twitter : HaMiDFadaei Web : www.HFadaei.ir
- 3. Amazing news
- 4. 0.7.0 - 2003 CMS PHP – Linux Matt Mullenweg - 19 1382 Automattic 173 1200 - 120
- 8. ▸ Wordpress Themes (29%) ▸ WordPress Plugins (22%) ▸ WordPress Core CAUSES: ▸ WP Core, themes, plugins out-of-date ▸ Poorly-written (or maliciously-written) themes or plugins ▸ Popularity of theme or plugin WORDPRESS VULNERABILITIES 51% themecheck.org Virustotal.com Anti-malware … Antivirus Exploit Scanner
- 9. ▸ SQL injections ▸ Poor server security ▸ Lack of understanding of WordPress CHECK FOR: ▸ Recent versions of PHP and MySQL ▸ Malware scanning and other security tools present ▸ Account isolation ▸ WordPress experience HOSTING VULNERABILITIES 41% sitecheck.sucuri.net
- 10. ▸ Bad habits ▸ Minimal default password requirements COMMON PROBLEMS: ▸ The “admin” username ▸ The crummy passwords (12345) ▸ User access levels USER VULNERABILITIES 8% Passwordsgenerator.net User Role Editor
- 11. Username Changer Two-factor Authentication Integrating a CAPTCHA with the WordPress Login Form Brute Force Login Protection Automatic Update Top usernames being attacked: admin, Admin, administrator, test, root Top passwords being tried: password, 12345678, 123admin, 123abc, qwerty
- 12. ▸ Pick a solid hosting company ▸ Evaluate your themes and plugins carefully ▸ Go with those that have been vetted by WordPress ▸ Choose only those that are actively developed and/or supported ▸ Only install what you NEED ▸ Be thoughtful about who/how many should get admin- level access START SMART
- 13. ▸ Backup all the things ▸ Your site (or sites with multisite) ▸ Your settings (what themes and plugins you’re using) ▸ Your files ▸ Your database ▸ Aim to save at least 6 months back BACKUPS VaultPress BackupBuddy WP-DB-Backup
- 14. ▸ WordPress can be set to do updates automatically ▸ Added after version 3.7 ▸ Can be set for core, theme, plugin, and translation updates ▸ Configure auto updates with wp-config (More) UPDATES
- 15. ▸ Routine review of environments every 6-12 months: ▸ Themes and plugins not in use ▸ Anything that hasn’t been updated in the last 18-24 months (or more!) ▸ Sites (in a multisite environment) that are no longer active ▸ Checking your backups ▸ Reviewing the configuration of security plugins MAINTENANCE
- 16. ▸ Malware scanners ▸ htaccess limitations ▸ File permissions ▸ Security Plugins: iThemes Security, Sucuri ($), Wordfence ▸ Scanning tools: AntiVirus, WP Antivirus Site Protection ▸ Logging and tracking tools: CodeGuard ($), wp_debug_log in wp- config ▸ Theme and plugin evaluators: Theme-Check, Plugin- Check Other Actions
- 17. ▸ Not updating ▸ Not cleaning out old themes and plugins ▸ Using popular plugins because they’re popular ▸ Using “admin” accounts ▸ Weak passwords ▸ Bad hosting AVOID COMMON MISTAKES
- 19. 1. Stay calm. 2. Get your site back. 3. Clean up the hack. 4. Identify the source of the hack. AFTER THE HACK…
- 21. Get your site back. ▸ try a password reset or database edit ▸ Take a backup of what’s there - files, database, uploads - for later ▸ Remove unknown users and reset all passwords ▸ Change your keys and salts in wp-config ▸ Restore to a known good version of the site (if you have one)
- 22. Clean up the hack. ▸ Review your files and database for suspicious elements ▸ When in doubt, reinstall. ▸ New directory, WP install, reinstall all themes and plugins ▸ User accounts with new passwords ▸ Import the content from a clean backup ▸ Check your hosting for other potential damage
- 23. Other Actions ▸ Use version control to compare file changes ▸ Get help from your hosting ▸ Check logs ▸ Scan your hosting environment for malware ▸ Scan your personal machine(s) for viruses and malware ▸ Change your password again. including hosting account passwords. ▸ Start over and review all elements for potential security weaknesses ▸ Scan the new site
- 25. HaMiD Fadaei Telegram : HFadaei Linkedin : HaMiDFadaei Twitter : HaMiDFadaei Web : www.HFadaei.ir