That Danny! News, Reviews, Social Media and Net Moods

Wordpress blog security top tips – Some things you MUST do!

WordPress is an excellent blogging platform, but as it is so popular it's also a constant target for those wanting to find and exploit its vulnerabilities. You should note that as with other web platforms, keeping WordPress secure is a constant job of updating and keeping up with the latest news and exploits.

Below are some key security tips, if you are installing a WordPress blog, or you want to make your existing blog more secure. This is a live article, and I will be adding more as I go along, or those suggested to me that make sense.

Make sure you back everything up before you start, and please read this article through to ensure you feel comfortable with the technical level required. Like any sever and installation changes, it will require some problem-solving and technical common-sense along the way, as no two systems are alike (and no two geeks are alike either). Any changes you make are at your own risk.

Top WordPress security tips:

1. When you install WordPress, it might be a good idea not to use the default directory that WordPress installs in (root/wordpress/), and instead either use the root directory or a directory with a different name. This means that automated scripts looking for the WP directory will not identify it on your site. There are, of course, other ways to identify a WP installation, but anything that makes your installation different to the standard steps a bot will follow to crack it is a good start.
Instructions on how to move the WP installation directory can be found here.
Note: there is also another (non security) reason to install WP in a root directory - it is more likely to rate higher on search engines if it is in the root. Depending on the popularity of your site this might be crucial.
Another note: if you are already running WP, you can simply move your directory, using the same instructions in the link above.

2. Make sure your WordPress installation is the latest version, and upgrade whenever a new version is released. These releases often fix security bugs and issues, and the longer you are behind the latest upgrade, the more likely you are to be exposed to attacks based on old vulnerabilities that you haven't patched yet.

3. Install the WordPress Security Scan plug-in. This is an excellent way to track some of the more common security risks on your installation. Conversely, if your server does have some robust access settings, the plug-in will not have access to do things like changing database table names, so I've detailed some of the manual steps below. Make sure you use the plug-in's scanner function to ensure your folders have the correct security permissions.

4. Change the database table prefix of your WP installation from "WP_" (the default) to something else that's hard to guess (e.g. something like this: "gh786Hg_"). If an attacker knows the database structure and table names, it makes attacking it easier. Instructions on how to make this change can be found here. You may also be able to achieve this through the WP Security scanner (see 3. above) but some environments will not allow it, and you'll have to make the changes manually. If you aren’t familiar with SQL, be careful and make sure you bac-up your database and know how to restore it if it all goes wrong.

5. Make sure you remove the user "admin" and replace it with a name that is less easy to guess. Leaving it there, opens you up to a dictionary attack whereby the hacker tries to crack your password using a script that tries lots of different passwords. If successful, they will gain full control of your blog.

6. Install the "Login-Lockdown" plug-in. This will also stop dictionary attacks in general, by limiting the number of failed logins allowed into your blog.

7. Hide your WordPress version. Again, revealing as little as possible to the potential attacker. This can be achieved through the Secure WordPress plug-in.

8. Hide your plug-in directory to stop hackers from accessing it and seeing its content. To be honest, if your server is set up well, this should not be a problem, but just in case: Create an empty file called index.htm, and place it in the wp-content/plugins directory. Or, if you can access your .htaccess file in your root directory, then even better: add the following lines to it:

# Prevents directory listing
Options -Indexes

9. Make sure you have an .htaccess file in your wp-admin directory. This protects your key WP admin files. The file should contain the following:

RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]

10. Now we need to have a word about Plug-ins - you have to be aware that plugins are inherently a security risk; even some of the more popular ones. They are created by (usually) great coders, but some coders are less great, and miss the obvious flaws in their plug-in. In a recent WordPress installation, I discovered two popular plugins that were wide open to hijack through SQL injections. There is no easy way to avert this, but take the following precautions:

• Ensure you follow good security precautions on everything else. Ensure your servers, databases and PHP installations are set to be as secure as possible.

If you have the knowledge, give your plugins a once-over or scan them for injection risk using scanning software.

• If you don't know how to do the above, and are running a corporate site with much credibility at stake, get professionals to do it for you.
• Update plugins regularly to the newest version - to ensure any flaws the owner discovered and fixed are also fixed on your installation.

11. I mentioned the need for the environment (servers, databases, PHP etc.) to be as secure as you can make it. If you don't control these variables (for example because your hosting company does), check their security credentials and find out if they have a good record for security. There's no point in having a great secure WordPress installation running, if the server it is hosted on is vulnerable. And while we're on the subject, if you have access to your PHP settings, and you're not a PHP guru, you might want to run your PHP installation on "safe mode" and also set "register globals" to "off", and expose_php to "Off".

12. And finally, trivial but true: make sure your admin password is a good one. I know it sounds silly, but use a long un-guessable, non-dictionary password, that combines upper/lower case letters, numbers and symbols. No really.

Happy (and safe) blogging!

Technorati Tags: blogging, security, wordpress