LEVEL UP YOUR WORDPRESS
SECURITY
By Mitch Canter – Vanderbilt University Web Communications
(@thatmitchcanter)

Who am I?

Mitch Canter
Senior Web Developer, Vanderbilt University Web Communications

SECURITY QUEST
PRESS START TO BEGIN

30,000

30,000
Number of Websites Hacked PER DAY

78%

78%
Built on a WordPress CMS

There is no secret sauce.

Goal: Reduce Risk

Proactive, Not Reactive

3 PRONGED APPROACH

1. SERVER
2. SITE
3. EXTERNAL

1. SERVER
CON Modifier, Hearts, Health

SSH Keys
Cryptographic Keys that Give Access to a Server.

Isolated Execution
Environments
Application Specific Servers (File/Database/Etc)

Single Server – Single Point
of Attack

Application Specific
Isolated Servers

Firewalls
What Services are exposed?

Firewall Example

IPTABLES
UFW FIREWALL

Inclusive Vs. Exclusive

File Permissions

Restrict, Then Relax

644 FILES
755 FOLDERS

2. SITE
Armor, Equipment, Shields

KEEP WORDPRESS UPDATED

No, really… KEEP
WORDPRESS UPDATED

56%
Percent of Out-Of-Date Hacked Websites

TimThumb
RevSlider
Gravity Forms
PS: The Panama Papers blamed on RevSlider exploit.

Plugin Audits
Do I REALLY need this plugin?

Two Factor Authentication
Multi-layer Authentication via Knowledge, Possession, or Inherance

XML-RPC Limitations
Code to disable via filter

User Audits
Do I REALLY need this user?

1. PASSWORDS
2. ACCESS

“Concept of Least Privileged”
Only give access to those that need it, when they need it, and only for
the time they need it.

3. External
“Magic” Shields, Blessings

SSL Certificates
Cryptographically Signed “Trust” of a Website

Let’s Encrypt
FREE SSL Certificates for Everyone!

Sucuri
Resources, Knowledge, and a Scanner Plugin

Vulnerable Plugins List
WPCampus Website, by Paul Gilzow

Offsite Backups
…just in case.

Questions?

Thanks!
@thatmitchcanter