Wordpress Security lecture for the WordCamp 2016 Israel Resources: WordPress Codex – http://codex.wordpress.org/Hardening_WordPress WordFence Blog – http://wordfence.com/blog Sucuri Blog – https://blog.sucuri.net/category/wordpress-security/ WPScan – http://wpscan.org/ LMD Scanner – https://www.rfxn.com/projects/linux-malware-detect/ Security Plugins – http://researchasahobby.com/?p=1915 Hack Target – https://hackertarget.com/wordpress-security-scan

1. Intro to WordPress Security
Security for smart people
or
Vitaly Karasik
DevOps Consultant
www.vitalykarasik.com
WordCamp 2016
27.03.2016 12135

3. Hacks Cost You More Than Money
• SEO rating
• Blacklisting
• Reputation - “It can take years to build, and minutes to lose.”
• Customer’s data leak

4. Attack Types
Exploit
Vulnerabilities Brute Force DoS

6. How to prevent – Concepts
• Security is a process, not a task
• Limiting Access
• Containment
• Preparation and Knowledge
• Trusted Sources

7. How to prevent – Methods
• Updates, Updates, Updates
• WordPress Plugins – only trusted, delete unused
• Credentials – usernames, passwords, dual-factor
• Limiting Access to WP Admin
• Server Hardening
• Database User Privileges
• FileSystem permissions

8. Tools and Services
• WP Plugins – WordFence, Sucuri
• DoS Protection, WAF – CloudFlare, Incapsula
• Security Scanners – LMD Scanner, WPScan
• WP Managed Hosting – WPEngine

9. WordFence Firewall and Brute Force Protection

10. WordFence Real-time Monitoring

11. WordFence Reports

12. Backups and Deployment
• Offsite Backup – UpdraftPlus
• Revision Control – Github, Bitbucket
• Automatic Deployment – Beanstalk

13. Monitoring – be the first to know!
• Server Monitoring – Anturis, CloudWatch
• Website Monitoring – Anturis, Pingdom
• Logs Monitoring – Logz.io, Loggly

14. Monitoring – Anturis Screenshot

15. Resources
• WordPress Codex – http://codex.wordpress.org/Hardening_WordPress
• WordFence Blog – http://wordfence.com/blog
• Sucuri Blog – https://blog.sucuri.net/category/wordpress-security/
• WPScan – http://wpscan.org/
• LMD Scanner – https://www.rfxn.com/projects/linux-malware-detect/
• Security Plugins – http://researchasahobby.com/?p=1915
• Hack Target – https://hackertarget.com/wordpress-security-scan

16. Thanks for listening!
Any Questions?
Vitaly Karasik
DevOps Consultant
www.vitalykarasik.com
WordCamp 2016
Scan this code to
view presentation
and links: