Easy way to protect your WP site from hackers

Dragonfire Wealth

11 years ago

Brute forcers also use proxies though

Absolute best thing you can do is make an obscure login name

Thanks

{{ DiscussionBoard.errors[7667363].message }}

YasirYar

11 years ago

That's great to know and thanks for sharing the idea on how one can safeguard their blogs. It's alarming how many people are trying to get into other people's blogs not sure what they want to do. But whatever that may be, am sure it isn't anything good at all.

Thanks
1 reply

Signature

>>>Get your websites ACTUALLY ranked by checking these out: Quantum SEO Labs, Home Page Link Building & SERP Ability. Want to get rid of negative listings? Check out Reputation Enhancer.

{{ DiscussionBoard.errors[7667386].message }}

garyisonline

11 years ago

+1 for the plugin
+1 for changing "admin" to something convoluted <-- I see this oversight in ebooks and videos "teaching" the one-click install. Pfffffff. STILL!!

For the proxie geniuses, since the limit login plugin limits the number of tries before having to wait, it becomes a pita for impatient script-running lazy butts. It's similar to punks tryin' doorknobs in the neighborhood. It's easier to just go find one of them one-click install suckers who lock the door then throw the key under the mat.

On all of our sites - the plugin emails an alert that somebody was blocked for too many tries. We then gather a text file and add ALL of those offending ip's to ALL of the deny sections of ALL of the .htaccess files on ALL of our sites.

Also Hide My Ass and Scrapebox has a list of public proxies for any ole body to use. Add all of them to .htaccess deny too. For you see, anybody using those public proxies to wiggle login pages are up to no good and can kick rocks. No loss blocking all of them for us.

There are additional steps to take to tighten up Wordpress (just do a search on the big G), but the OP's ideas are very good-n-easy first steps.

[ 1 ] Thanks
1 reply

{{ DiscussionBoard.errors[7667455].message }}

sbucciarel

Banned 11 years ago

Originally Posted by garyisonline

For the proxie geniuses, since the limit login plugin limits the number of tries before having to wait, it becomes a pita for impatient script-running lazy butts. It's similar to punks tryin' doorknobs in the neighborhood. It's easier to just go find one of them one-click install suckers who lock the door then throw the key under the mat.

I use limit log in too and get an ungodly amount of people trying to log in as admin. Of course, my user name isn't admin and they'd never guess in a million years what it is. I also use Bad Behavior with the setting to disallow proxies, so people using proxies can't visit my site.

[ 3 ] Thanks
1 reply

{{ DiscussionBoard.errors[7668143].message }}

so11

11 years ago

Originally Posted by sbucciarel

I use limit log in too and get an ungodly amount of people trying to log in as admin. Of course, my user name isn't admin and they'd never guess in a million years what it is. I also use Bad Behavior with the setting to disallow proxies, so people using proxies can't visit my site.

Hello Suzanne,

blocking proxies might be effective, but you might be loosing a lion share of visitors. Many, many companies and corporate users use proxies. I'd probably have to say most of them...

so11

Thanks
1 reply

Signature

www.groupesoloviev.com
We help businesses manage cyber risk and compliance requirements.

{{ DiscussionBoard.errors[7668804].message }}

garyisonline

11 years ago

Originally Posted by so11

Hello Suzanne,

blocking proxies might be effective, but you might be loosing a lion share of visitors. Many, many companies and corporate users use proxies. I'd probably have to say most of them...

so11

No need to worry if you block public proxies...the ones published freely on every hack-a-long website. Most using those public proxies won't be bringing lollipops and happy thoughts to your website.

Most corporate folks are going to be using private proxies, gateways and VPNs. But, those bored office workers who are using public proxies to tunnel out of the cubicle to check personal stuff, learn pretty quickly (or should anyway) how "safe and secure" that practice is.

Thanks

{{ DiscussionBoard.errors[7669390].message }}

mikehuff

11 years ago

Damn Elmar, what's up with THAT sh*t??!

That kills me, glad you had something in place to stop them from getting in. On the BRIGHT side, I'm following the link in your sig. I gotta see this blog

Thanks

Signature

===>[FREE WSO] LISTBUILDING TOO COMPLICATED...? NO WAY!!<===

{{ DiscussionBoard.errors[7667397].message }}

techbul

11 years ago

[DELETED]

{{ DiscussionBoard.errors[7667688].message }}

JMSD 11 years ago

Install wordpress script from wordpress.org - don't use Fantastico Deluxe or Simple Scripts to create your WP site.

Follow advice re admin and database names.

There are security plugins like Lockdown and LockTight to protect your site from hackers.

Finally, after setting up your site and everytime you add significantly to your site, take a backup and save it somewhere safe (in addition to your host account, which could be hacked).

Your site will not be 100% safe from hackers all the time but the above measures will mimize the risk.

Jamie
- Thanks
Signature

Risk-Free IM Training For Newbies, Including Ready-To-Sell Digital Products

Want High Ticket Licensed DVD Products As Backend Offers
To Sell For Two, Three & Four-Figure Sums?
{{ DiscussionBoard.errors[7668013].message }}

bapparabi

11 years ago

Hi here is great wp plugin which i am using ..to Avert successful hacker attacks and enhance security
WordPress Firewall Plugin

Thanks

Signature

Earn $ 1000+ a Month Easily & Automatically - 100% Automated WordPress Hotel, Flight, Cruises, Rental Cars & Amazon Store Search Engine Script

{{ DiscussionBoard.errors[7668130].message }}

Mike Hersh

11 years ago

Always backup your site! realized that it's the best tool against hackers after you secure your site.

Thanks

Signature

=> I'll Give You $2,000 To Test Drive My Sales Funnel!<=

{{ DiscussionBoard.errors[7668212].message }}

100KAffiliateManager

11 years ago

There's a great kindle book about WordPress Security currently available for free on Amazon. I've just downloaded it and browsed through it, very informative, well worth a download -

WordPress Security: Protection from Hackers and...

Thanks

{{ DiscussionBoard.errors[7668289].message }}

troy23

11 years ago

Excellent post

Thanks

Thanks
1 reply

{{ DiscussionBoard.errors[7668430].message }}

so11 11 years ago

Hello Elmar,

good for you. It is always best to be proactive!!!

Although, brute force doesn't necessarily mean that they have tried only admin or Admin passwords. They've tried many simple combinations (usually dictionary words) that most people use.

Another important measure to take (if possible) is to rename your Admin account. Most of automated attacks take place against Admin (named) account.

good luck
- Thanks
Signature
www.groupesoloviev.com
We help businesses manage cyber risk and compliance requirements.
{{ DiscussionBoard.errors[7668773].message }}

globalwritersdirect

11 years ago

Thank you very much for the tips. I have been hacked several times. Will follow your tips.

Thanks

Signature

{{ DiscussionBoard.errors[7668794].message }}

Kingfish85

11 years ago

The plugin is good & works, but it "can" be exploited. The best solution would be to password protect the directory at the server level. This also gives you a 2nd layer a security with double authentication methods.

Thanks

Signature

|~| VeeroTech Hosting - sales @ veerotech.net
|~| High Performance CloudLinux & LiteSpeed Powered Web Hosting
|~| cPanel & WHM - Softaculous - Website Builder - R1Soft - SpamExperts
|~| Visit us @veerotech Facebook - Twitter - LinkedIn

{{ DiscussionBoard.errors[7668808].message }}

bhmseoservices

11 years ago

Other than changing the initial username and plugins (which are great tips by the way!) -- there are other things you should do to protect your assets further.

Create a task for yourself, every 15-30 days try to back up your files through your FTP and grab the latest database and put it somewhere safe.

At the end of the day though if a good hacker wants to hack your site. They will hack it. All you can do is make sure your files are secure offline and so is your database.

Thanks

Signature

webdesign company| seo services | Search engine optimization company

{{ DiscussionBoard.errors[7669436].message }}

JG Products Online

11 years ago

Great post. Nice blog as well...

Thanks

{{ DiscussionBoard.errors[7669481].message }}

rankingconsult

11 years ago

Good tip. I get daily emails of failed entries to my DS and these are invariably through the large community sites out there.

Therefore, not just wordpress users should be aware of this, but also those using Joomla, Vbulletin, PHPBB, drupal, etc.

Thanks

Signature

4Sale - IncomeScheme.com | eAdverts.com |
MediAdverts.com | Medicals.info
Got a video gaming site - Grab an Online Battle Script

{{ DiscussionBoard.errors[7669590].message }}

cooler1

11 years ago

Isn't it better to use the WordFence Security plugin instead of Limit Login Attempt as WFS also limits login attempts amongst other things.

Thanks

Signature

{{ DiscussionBoard.errors[7670204].message }}

Bruce NewMedia

11 years ago

I have also been using Bad Behavior set to disallow proxies, so people using proxies can't visit my sites. I think that has helped quite a bit. WP is great, but the security issues seem never-ending.
_____
Bruce

Thanks
1 reply

Signature

Get Offline Clients With NO Resistance!-CLICK HERE
POWER LETTERS Get Offline Appointments
These Email Templates Land You Great Clients!

{{ DiscussionBoard.errors[7670350].message }}

so11

11 years ago

Originally Posted by Bruce NewMedia

I have also been using Bad Behavior set to disallow proxies, so people using proxies can't visit my sites. I think that has helped quite a bit. WP is great, but the security issues seem never-ending.
_____
Bruce

Hello Bruce,

security is not static, it is a state that needs to be achieved and maintained.

The reason we have security issues is because we evolve and make constant changes... These changes create security vulnerabilities. That's why it is important to adopt good security practices, such as checkups, audits, quality assurance, etc.

So11

Thanks

Signature

www.groupesoloviev.com
We help businesses manage cyber risk and compliance requirements.

{{ DiscussionBoard.errors[7670585].message }}

Ti

11 years ago

The best way would be to add a .htaccess file which requires a pop-up username/password that is done from the web server itself.

See here: Protect your WordPress site with .htaccess | Tutorial | .net magazine

Thanks
1 reply

Signature

Affiliates Wanted --> http://Pwnboxer.com <-- Promote to your MMORPG/World of Warcraft Niche
Insanely Popular Software Lets You Play 5x WoW+ On 1 PC - 100% Legit Bliz Approves Multiboxing
Current Affiliate Stats: June 4th 2011: EPC = $3.50, Conversions = 10.2%, $23.50/sale

{{ DiscussionBoard.errors[7670601].message }}

Elmar

11 years ago

Originally Posted by Ti

The best way would be to add a .htaccess file which requires a pop-up username/password that is done from the web server itself.

See here: Protect your WordPress site with .htaccess | Tutorial | .net magazine

This would only apply to the wp-admin page ?

Thanks
2 replies

Signature

=> List Building Resources on my Blog <=

{{ DiscussionBoard.errors[7671745].message }}

bt 11 years ago

Good post elmar, I don't know about wordpress but on a few websites I have had In the past, I would chmod the admin file to 0400 or even 0000 when not In use as an extra layer of security, then when you want to login to admin panel just change the admin file or folder back to 644 or 755
- Thanks
Signature
You could get 1 Million Visitors to your website for free, you have got to see this
{{ DiscussionBoard.errors[7672193].message }}
Ti 11 years ago

Originally Posted by Elmar

This would only apply to the wp-admin page ?

This applies to any page that you want to secure. The wp-admin is a good start.
- Thanks
Signature

Affiliates Wanted --> http://Pwnboxer.com <-- Promote to your MMORPG/World of Warcraft Niche
Insanely Popular Software Lets You Play 5x WoW+ On 1 PC - 100% Legit Bliz Approves Multiboxing
Current Affiliate Stats: June 4th 2011: EPC = $3.50, Conversions = 10.2%, $23.50/sale
{{ DiscussionBoard.errors[7673661].message }}

TanYaV

11 years ago

Hi! I know of some quite basic tips like not use admin as username and don't post from admin account. Here's some more advice on securing WordPress.

Thanks

Signature

regards!

{{ DiscussionBoard.errors[7714386].message }}

Easy way to protect your WP site from hackers

Trending Topics

A healthy fascination for Hollywood...

How did you turn it all around?

Any thoughts on golf's latest phenom...Scottie Scheffler??

What's the Best IM-Related Skill to Learn Today That Can Help in the Future?

best high quality crypto traffic.