An introduction to WordPress Security

1. blogVAULT
http://blogvault.net

2. WordPress Security
Akshat Choudhary
Founder, blogVault
blogVAULT

3. Why?
Sites get Hacked!
blogVAULT

4. Why will some one hack
a Site?
Fun and Profit
blogVAULT

5. Fun: Because they can
blogVAULT

6. Profit: To make money
SEO
Affiliate Scam
Redirect to a different site
Political defacement
Use host for hacks
blogVAULT

7. How?
Vulnerabilities!
blogVAULT

8. Where?
Wordpress Core
Plugins
Themes
blogVAULT

9. How do I know if I have
been hacked?
blogVAULT

10. Browser warning
blogVAULT

11. Google Search Warning
blogVAULT

12. Sucuri SiteCheck - Free Tool
blogVAULT

13. Inspect Files
htaccess
Javascript Files
Unknown PHP files
Existing PHP files
blogVAULT

14. What to do when my site
gets hacked?
blogVAULT

15. Recover from Backup
Most reliable method
blogVAULT

16. Use Sucuri
Not foolproof, costs money
blogVAULT

17. Talk to an expert
Difficult Job. Don't take lightly.
blogVAULT

18. Change Password
blogVAULT

19. Change Authentication
keys
Removes existing sessions.
blogVAULT

20. Prevention is better than
Cure
blogVAULT

21. Update Wordpress /
Plugins / Themes
blogVAULT

22. Change Database Prefix
Prevent SQL Injection attacks
blogVAULT

23. Disable File Editor
define('DISALLOW_FILE_EDIT', true);
blogVAULT

24. Make Folders / Files
Readonly
blogVAULT

25. Prevent File Execution
AddHandler cgi-script .php .pl .py .jsp .asp
.htm .shtml .sh .cgi
blogVAULT

26. Use SSL / Google
Authenticator
blogVAULT

27. Set Authentication Keys
define('AUTH_KEY', 'put your unique phrase here');
define('SECURE_AUTH_KEY', 'put your unique phrase here');
define('LOGGED_IN_KEY', 'put your unique phrase here');
define('NONCE_KEY', 'put your unique phrase here');
define('AUTH_SALT', 'put your unique phrase here');
define('SECURE_AUTH_SALT', 'put your unique phrase here');
define('LOGGED_IN_SALT', 'put your unique phrase here');
define('NONCE_SALT', 'put your unique phrase here');
blogVAULT

28. Security by Obscurity
remove admin user / hide wordpress
version / ...
blogVAULT

29. Automatic Backups
e.g. use blogVAULT
blogVAULT

30. What makes a good backup solution?
Complete - Database + Files
Offsite - Local backup is as good as none
Regular Backup
History of backup
Test the Restore
Secure Backup
blogVAULT

31. Thank you
blogVAULT
http://blogvault.net
We are Hiring!