This document discusses WordPress security best practices. It notes that securing WordPress involves understanding the full technology stack, including the Linux operating system, web server (Apache), database (MySQL), and programming language (PHP). It also emphasizes the importance of securing access to the WordPress admin interface and files. Some key recommendations include using strong passwords and two-factor authentication for admin logins, installing a web application firewall for WordPress and the server, and ensuring WordPress plugins and themes are up-to-date to prevent exploits. The document stresses that most WordPress hacks occur due to gaining unauthorized access.

1. WORDPRESS SECURITY
The “No-BS” Version

2. SUCURI@WORDCAMP# WHOIS PEREZBOX
• Name: Tony Perez
• Street name: The Hulk
• Handle: Perezbox
• Company: Sucuri
• Occupation: Executive / Owner
• Likes: Guns, InfoSec, Harley‟s, MMA
• Personality: Rational / Objective = Turd
• Location: Menifee, California
@PEREZBOX @SUCURI_SECURITY @TONYONSECURITY
#WCCHX
10/15/2012 2

3. TODAY‟S CHALLENGES
• Administration
• Extensibility
• Credentials
• End-users
• Education
@PEREZBOX @SUCURI_SECURITY @TONYONSECURITY
#WCCHX
10/15/2012 3

4. “The user’s going to pick dancing pigs over security every time.”
- Bruce Schneier
Check yourself before you wreck yourself
KNOWLEDGE
@PEREZBOX @SUCURI_SECURITY @TONYONSECURITY
#WCCHX
10/15/2012 4

5. KNOW THE ENVIRONMENT
• This is what it takes to
LINUX
LAMP STACK
run WordPress
Apache • Each contains its own
laundry list of known
MySQL vulnerabilities
• Bare-bones
PHP
@PEREZBOX @SUCURI_SECURITY @TONYONSECURITY
#WCCHX
10/15/2012 5

6. KNOW THE APPLICATION
Core
WordPress
Themes
• Today‟s Problem
Plugins
End-User
@PEREZBOX @SUCURI_SECURITY @TONYONSECURITY
#WCCHX
10/15/2012 6

7. REALISTIC ENVIRONMENT
Linux Operating System
Apache MySQL PHP
WordPress CPANEL Plesk myLittleAdmin PHPMyAdmin Etc.. Modules
@PEREZBOX @SUCURI_SECURITY @TONYONSECURITY
#WCCHX
10/15/2012 7

8. YOUR HOST
IF YOU DON”T KNOW WHAT
• Who is your host?
YOU”RE DOING GO WITH A
MANAGED SOLUTION
• How do you connect to the server?
• FTP, SFTP, SSH
• What security does your host use? Do they use any web security?
• What will your host do if you get hacked?
• Will they shut your site down?
• Will they kick you off their server?
• Will they fix it for you?
@PEREZBOX @SUCURI_SECURITY @TONYONSECURITY
#WCCHX
10/15/2012 8

9. CONNECTING
• If you don‟t need it, disable it
• SFTP / SSH is preferred
• FTP works fine – disable if you‟re not using, don‟t talk to me if you are
• FTP/SFTP != WP-ADMIN
• Least Privileged
• You don‟t have to log in FTP / SFTP with full root access
• Everyone doesn‟t need to be an admin
• You don‟t need to log in as admin
• The focus is on the role, not the name of the user
• Accountability – kill generic accounts – who is doing what?
@PEREZBOX @SUCURI_SECURITY @TONYONSECURITY
#WCCHX
10/15/2012 9

10. ATTACK TYPE
Opportunistic Targeted
• Trolling the web looking for • Big enterprises with large
known vulnerabilities followings:
• Ability for mass exposure • WordPress.com
• Think “TimThumb” • WooThemes
• Worth Investing time and energy
to compromise, bigger return
@PEREZBOX @SUCURI_SECURITY @TONYONSECURITY
#WCCHX
10/15/2012 10

11. AUTOMATION IS KEY
• Targeted /
Scan Opportunistic
• Vulnerability Scans
• Brute Force / Data
PWN Automation Detect Dictionary Attacks
• DDOS / DOS
• XSS / CSRF
Exploit
• SQLi
@PEREZBOX @SUCURI_SECURITY @TONYONSECURITY
#WCCHX
10/15/2012 11

12. BLACKLISTING
• Take a chill pill.. Not the end of the world
• Detect, Remove, Submit
@PEREZBOX @SUCURI_SECURITY @TONYONSECURITY
#WCCHX
10/15/2012 12

13. THE MISTAKE
• But why me?!?!?!
• Forget the why, look at the how!!
@PEREZBOX @SUCURI_SECURITY @TONYONSECURITY
#WCCHX
10/15/2012 13

14. “Own one Own them All”
Nothing fancy here.. The facts
THE HOW
@PEREZBOX @SUCURI_SECURITY @TONYONSECURITY
#WCCHX
10/15/2012 14

15. TODAY‟S EXPLOITS
You
Application Control Environment
• Injections • Privilege Escalation
• Remote File Inclusion • Brute Force / Data Dictionary
• Remote File Execution • Remote File Include
• Brute Force / Data Dictionary • Remote File Execution
@PEREZBOX @SUCURI_SECURITY @TONYONSECURITY
#WCCHX
10/15/2012 15

16. TOP 5 WORDPRESS INFECTIONS
• Backdoors
• Difficult to Detect via HTTP
• Injections
• Easy to Detect via HTTP
• Pharma Hack
• Best person to detect is the owner, difficult to detect via HTTP
• Malicious Redirects
• Easy to Detect via HTTP
• Defacements
• Pretty obvious – you‟re now supporting the Syrian fight or preaching to your Turkish
brothers
@PEREZBOX @SUCURI_SECURITY @TONYONSECURITY
#WCCHX
10/15/2012 16

17. BACKDOOR
• Complete access via shell… kiss all hardening good bye
• Sad day.. .. Good time to cry…
@PEREZBOX @SUCURI_SECURITY @TONYONSECURITY
#WCCHX
10/15/2012 17

18. LINK INJECTION
• Drive-by-Download attempt – think Fake AV / Adobe
• Pharma Links – Erectile Dysfunction (Viagra)
@PEREZBOX @SUCURI_SECURITY @TONYONSECURITY
#WCCHX
10/15/2012 18

19. PHARMA
• Affiliate Model
• Multi-million dollar industry
• Generate ~3.5k new clients daily
@PEREZBOX @SUCURI_SECURITY @TONYONSECURITY
#WCCHX
10/15/2012 19

20. DEFACEMENT
• Hacktivism at its finest
• Awareness to cause
@PEREZBOX @SUCURI_SECURITY @TONYONSECURITY
#WCCHX
10/15/2012 20

21. COMMON VECTORS
“38% of us Would Rather Clean a
• Vulnerable Software Toilet Than Think of New
• Often associated with Out-of-date software Password”
- Mashable
• WordPress Themes / Plugins, more so than Core
• Cross Site Contamination
• Soup Kitchen Servers
• Compromised Credentials
• Password123, Password1, 111111a = not cool
• Remote File Inclusion
• Leads to Remote Execution
• Think TimThumb, Uploadify, etc…
@PEREZBOX @SUCURI_SECURITY @TONYONSECURITY
#WCCHX
10/15/2012 21

22. “The question isn't who is going to let me; it's
who is going to stop me.”
Simple is so much sweeter…
MAKE IT STOP
@PEREZBOX @SUCURI_SECURITY @TONYONSECURITY
#WCCHX
10/15/2012 22

23. THE KEY IS ACCESS
• In almost all instances the key is access, whether via:
• WP-ADMIN
• SSH / SFTP (Port 22)
• FTP (Port 21) = > You are dead to me!!! : )
• Remote File Inclusion – Vulnerabilities in TimThumb / Uploadify – can‟t avoid Zero day events, but
you can stay proactive when identified
• Doesn‟t include environmental issues
• Myth: Remove Admin
• Fact: to crack a 10 character password = 1,700 years via brute-force. Today, dictionary attacks are
the preferred method. Either way, requires multiple scan attempts.
• The “administrator” role matters more than the “administrator” or “admin” user name.
@PEREZBOX @SUCURI_SECURITY @TONYONSECURITY
#WCCHX
10/15/2012 23

24. THIS IS WHAT MATTERS - KISS
From an access stand point:
Strong /
Application Two Factor Secure
Server WAF Unique
WAF Authentication Environment
Password
From a vulnerability stand point:
Avoid Soup Separate
Use Trusted Secure
Stay Current Kitchen Staging from
Sources Environment
Servers Production
@PEREZBOX @SUCURI_SECURITY @TONYONSECURITY
#WCCHX
10/15/2012 24

25. MY ADVISE
To the Average Joe: To the Paranoid / Lucky:
1. Kill PHP Execution 1. Don‟t let WordPress write to itself
2. Disable Theme / Plugin Editing via Admin
2. Filter by IP
3. Connect Securely – SFTP / SSH
4. Use Authentication Keys in wp-config
• SSH Access
5. Use Trusted Sources • WP-ADMIN Access
6. Use a local Antivirus – Yes, MAC‟s need one • Database Access
7. Verify your permissions - D 755 | F 644
3. Use a dedicated server / VPS
8. Least Privileged
9. Kill generic accounts - Accountability
4. Employ a WAF / Logging Solution
10. Backup your site – yes, Database too 5. Enable SSL
@PEREZBOX @SUCURI_SECURITY @TONYONSECURITY
#WCCHX
10/15/2012 25

26. KILL PHP EXECUTION
• The idea is not to let them execute any PHP files. You do so by adding this in an
.htaccess file in the directory of choice. Recommendation:
• WP-INCLUDES
• UPLOADS
#PROTECT [Directory Name]
<Files *.php>
Deny from all
</Files>
@PEREZBOX @SUCURI_SECURITY @TONYONSECURITY
#WCCHX
10/15/2012 26

27. DISABLE PLUGIN/THEME EDITOR
• Add to wp-config – if a user is compromised they won‟t be able to add anything to the
core theme or plugin files.
# Disable Plugin / Theme Editor
Define(„DISALLOW_FILE_EDIT‟,true);
@PEREZBOX @SUCURI_SECURITY @TONYONSECURITY
#WCCHX
10/15/2012 27

28. RECOMMENDED PLUGINS
Clients Non-Clients
• Sucuri Security Premium • Duo Two-Factor Authentication
• Duo Two-Factor Authentication • Limit Login Attempts
• Theme-Check • Theme-Check
• BackupBuddy • BackupBuddy
• Akismet • Akismet
@PEREZBOX @SUCURI_SECURITY @TONYONSECURITY
#WCCHX
10/15/2012 28

29. KNOW WHERE TO GO, IF… IT HAPPENS
Support Forums Online Resources
• Hacked – • Sucuri Blog: http://blog.sucuri.net
http://wordpress.org/tags/hacked
• SiteCheck Scanner: http://sitecheck.sucuri.net
• Malware – • Unmask Parasites:
http://wordpress.org/tags/malware http://unmaskparasites.com
• Perishable Press:
• BadwareBusters – http://perishablepress.com/category/web-
design/security/
https://badwarebusters.org
• Secunia Security Advisories:
http://secunia.com/community/advisories/searc
h/?search=wordpress
@PEREZBOX @SUCURI_SECURITY @TONYONSECURITY
#WCCHX
10/15/2012 29

30. BLACKLIST ENTITIES
• Google
• Chrome, FireFox
• Search Engine Results Page (SERP)
• http://www.google.com/webmaster/tools
• http://www.google.com/safebrowsing/diagnostic?site=[your site]
• Bing
• Internet Explorer
• Yahoo
• http://www.bing.com/toolbox/webmaster/
• Norton
• SafeWeb Browsing
• Facebook
• http://safeweb.norton.com/
• AVG
• Opera
• http://www.avgthreatlabs.com/sitereports/
@PEREZBOX @SUCURI_SECURITY @TONYONSECURITY
#WCCHX
10/15/2012 30

31. Sucuri
Tony Perez
http://sucuri.net
http://blog.sucuri.net
http://perezbox.com & http://tonyonsecurity.com
@perezbox and @tonyonsecurity
@PEREZBOX @SUCURI_SECURITY @TONYONSECURITY
#WCCHX
10/15/2012 31

32. @PEREZBOX @SUCURI_SECURITY @TONYONSECURITY
#WCCHX
10/15/2012 32