Website Security [Wordpress Users Must Read]

Slapshot

10 years ago

Thanks for the heads up!

[ 1 ] Thanks
1 reply

{{ DiscussionBoard.errors[9098990].message }}

MeiGal 10 years ago

Thanks, excellent Info!
- Thanks
{{ DiscussionBoard.errors[9099014].message }}

Cyberkntsean

10 years ago

Originally Posted by Isaiah Jackson

the famous "inbox zero"

it's a myth .. never going to happen..

[ 1 ] Thanks

{{ DiscussionBoard.errors[9099051].message }}

Mr Bill

10 years ago

LOVE LOVE LOVE Wordfence! I agree, download it now.

[ 1 ] Thanks
1 reply

{{ DiscussionBoard.errors[9099063].message }}

Isaiah Jackson 10 years ago

Originally Posted by Slapshot

Thanks for the heads up!

Your welcome

Originally Posted by MeiGal

Thanks, excellent Info!

Your welcome

Originally Posted by Cyberkntsean

it's a myth .. never going to happen..

Its happened a few times today, but I rarely get to keep it that way for too long lol

Originally Posted by Mr Bill

LOVE LOVE LOVE Wordfence! I agree, download it now.

YES! It works wonders doesn't it? Its like the first plugin I install on any Wordpress site now.
- Thanks
Signature
Send Emails, Get Paid - My business summarized in four words. For the how-to go here
{{ DiscussionBoard.errors[9099198].message }}

CSmitty

10 years ago

It tells you if someone tries to log into your website? If you see you had so many failed attempts, what do you do about it after you get that information?

Thanks
3 replies

{{ DiscussionBoard.errors[9099085].message }}

Cyberkntsean

10 years ago

Originally Posted by CSmitty

It tells you if someone tries to log into your website? If you see you had so many failed attempts, what do you do about it after you get that information?

You can put the offending IP Address into myip.ms and see what ISP
ownes the address block.

You then send a screenshot of the offending IP Address to their abuse@whateverISP and tell
them if they would kindly get their client to stop trying to hack you.

Don't worry about translating your message into whatever language the ISP happens
to be in, once they see your screenshot they will translate it.

I have successfully done this 5 times for different countries, three of the ISP's
sent me back a message stating that the problem was dealt with..
---
Why did I go this route.. well, when you see a gazillion attempts.. you get a little pissed..

[ 2 ] Thanks
1 reply

{{ DiscussionBoard.errors[9099172].message }}

Amelle

10 years ago

This is really useful information, thanks. I had someone from the same IP address once that was trying to hack into my site for about two weeks consistently, every single day. If I had known where to report it to, I would have done.

I have bookmarked that site and will do as you recommended next time I get a persistent hacker.

Thanks a lot.

Originally Posted by Cyberkntsean

You can put the offending IP Address into myip.ms and see what ISP
ownes the address block.

You then send a screenshot of the offending IP Address to their abuse@whateverISP and tell
them if they would kindly get their client to stop trying to hack you.

Don't worry about translating your message into whatever language the ISP happens
to be in, once they see your screenshot they will translate it.

I have successfully done this 5 times for different countries, three of the ISP's
sent me back a message stating that the problem was dealt with..
---
Why did I go this route.. well, when you see a gazillion attempts.. you get a little pissed..

Thanks

{{ DiscussionBoard.errors[9101479].message }}

Isaiah Jackson 10 years ago

Originally Posted by CSmitty

It tells you if someone tries to log into your website? If you see you had so many failed attempts, what do you do about it after you get that information?

It blocks the user who is trying to login actually.

So I really don't have to do anything
- Thanks
Signature
Send Emails, Get Paid - My business summarized in four words. For the how-to go here
{{ DiscussionBoard.errors[9099193].message }}
spearce000 10 years ago

Originally Posted by CSmitty

It tells you if someone tries to log into your website? If you see you had so many failed attempts, what do you do about it after you get that information?

Contact the ISP like @Cyberkntsean says, or you can blacklist them in Cpanel.

Restricting access wp-admin.php can also eliminate this problem.
- [ 1 ] Thanks
{{ DiscussionBoard.errors[9099860].message }}

Mr Bill

10 years ago

If they're failing to log in it's done it's job and just letting you know that it did it's job. You can set it to notify you not only of failed attempts but also if anyone logs in as admin or non-admin. I use this to check on techs to see when they logged into my site to do their work but I've also been notified of failed attempts. You can set how many failed attempts before they're logged out completely for as long as you want.

Thanks

{{ DiscussionBoard.errors[9099090].message }}

JasonLD

10 years ago

Originally Posted by Isaiah Jackson

Hey, Warriors it's Isaiah Jackson -

and I was just browsing my email, you know trying
to get to the famous "inbox zero"

What does the "inbox zero" refer to? I have a Wordpress site that I'm learning to use now. Not to farmiliar with it yet.

Thanks
1 reply

{{ DiscussionBoard.errors[9099213].message }}

Mr Bill 10 years ago

Originally Posted by JasonLD

What does the "inbox zero" refer to?

No unopened emails to read.
- [ 1 ] Thanks
{{ DiscussionBoard.errors[9099215].message }}

JackCronfield

10 years ago

You can also use the Limit Login Attempts plugin which is completely free and will allow you to block ips after certain umber of failed login attempts

Thanks

{{ DiscussionBoard.errors[9099246].message }}

Mr Bill

10 years ago

It also tells you when your plugins need updating which is handy. I then go to my MainWP plugin (which controls all my blogs - also free) and I update them all at once with on click. Those two free plugins have made a massive difference to my productivity and released many hours I previously spent upgrading every site manually.

Highly recommended!

Thanks

{{ DiscussionBoard.errors[9099251].message }}

ron200

10 years ago

My host had a message posted with some security steps. The easiest and best is probably this one:

1. Limit Access to wp-admin by IP

If you are the only person who needs to login to your Admin area and you have a fixed IP address, you can deny wp-admin access to everyone but yourself via an .htaccess file.

Create a file called .htaccess or simply edit the existing one (if any) in the /wp-admin folder and add:

# Block access to wp-admin.
order allow,deny
allow from x.x.x.x
deny from all

Where x.x.x.x is your IP address. You can add multiple IP addresses by adding the line: allow from x.x.x.x as many times as IPs you wish to whitelist.

Thanks

Signature

Affordable Vacation Packages - Hotel, Air, Car, Cruise, Sports and Concerts Best Prices Around

{{ DiscussionBoard.errors[9099254].message }}

Mr Bill

10 years ago

Good one!

I'm not a fixed IP with my ISP but they do offer one which might be handy. My IP resets every time I switch on my router but there's nothing stopping me from allowing no one and when I need access I can look up my current IP, edit the .htaccess file, do my work then remove my IP. A small price to pay for what seems like a very strong security measure.

Just to be clear, to add multiple IPs it would look like this?

# Block access to wp-admin.
order allow,deny
allow from x.x.x.x
allow from x.x.x.x
allow from x.x.x.x
allow from x.x.x.x
allow from x.x.x.x
deny from all

Thanks

{{ DiscussionBoard.errors[9099262].message }}

ron200

10 years ago

I just now added the above but looked at the mod security feature on my host and this IP
37.9.53.109
Tried to access 550 times in 8 minutes! Lucky he was auto blocked after the 1st 15 times.
This was 4 days ago.

I believe that is right Bill.

Thanks
1 reply

Signature

Affordable Vacation Packages - Hotel, Air, Car, Cruise, Sports and Concerts Best Prices Around

{{ DiscussionBoard.errors[9099286].message }}

Isaiah Jackson 10 years ago

Originally Posted by ron200

Tried to access 550 times in 8 minutes! Lucky he was auto blocked after the 1st 15 times.
This was 4 days ago.

WOW!

550 times in 8 minutes is just insane.

Good thing it was blocked though.
- Thanks
- 1 reply
Signature
Send Emails, Get Paid - My business summarized in four words. For the how-to go here
{{ DiscussionBoard.errors[9099352].message }}
- lookielookies 10 years ago
  
  Thanks for the tip!
  
  Thanks
  
  Signature
  FREE: Launch Your Own Plugin TODAY
  Start Earning BitcoinToday!
  
  {{ DiscussionBoard.errors[9099818].message }}

ron200

10 years ago

I just tested this out and I can't even get in. woops. lol
either I did something wrong or that doesn't work.

Thanks
1 reply

Signature

Affordable Vacation Packages - Hotel, Air, Car, Cruise, Sports and Concerts Best Prices Around

{{ DiscussionBoard.errors[9099304].message }}

Wayne 10 years ago

Originally Posted by ron200

I just tested this out and I can't even get in. woops. lol
either I did something wrong or that doesn't work.

Same thing happened to me. Then I changed the first line to
order deny,allow
instead of
order allow,deny
and it works.

# Block access to wp-admin.
order deny,allow
allow from xx.xxx.xx.xx
deny from all
- Thanks
{{ DiscussionBoard.errors[9100141].message }}

vikash_kumar

10 years ago

Thanks Isaiah for sharing your experience with WordPress Security and emphasizing that why it is important to make the job of a hacker harder than ever.

No online software or system in the world of internet is fully secure as many people who are living in negative world are continuously trying to disturb the normal flow of working.
Hence, It is very important to have all possible loop closed when it comes to access to WordPress Database as well as content.

Well done!

[ 1 ] Thanks

Signature

WordPress Expert Help - WordPress Fix, Migration, Customization, SEO & Many More Things

{{ DiscussionBoard.errors[9099848].message }}

Nick981

10 years ago

Thanks, must try! Now often started to crack sites.

Thanks

{{ DiscussionBoard.errors[9099908].message }}

Rus Sells

10 years ago

One of the BEST ways to keep a WP site from being hacked.

After installation create a new user, use a user name that's not common. You could even make it passwordy. Include numbers, symbols, capital letters.

Give the new user administrator rights and save your new user.

Then log out and log back in under the new user account and DELETE the user ADMIN.

There safe and very secure.

Why? Because hackers need two things. A user name and a password.

They look for common user names and the most common is ADMIN and so if you have admin you've done 50% of the work for them.

[ 1 ] Thanks

Signature

Review Sentry

Dotcomcodex

{{ DiscussionBoard.errors[9100014].message }}

cheehien

10 years ago

Really?? Good info. Thanks

Thanks

Signature

Affiliate templates are not allowed.

{{ DiscussionBoard.errors[9100150].message }}

Omar White

10 years ago

When it comes to Wordpress Security you need to Install the following :

All In One WP Security

iThemes Security

Wordfence Security

Install them and Watch Hackers Fail!

Enjoy...

- Oliver

[ 2 ] Thanks

Signature

Resource Blog for Beginner Entrepreneurs - OmarWhite.com

{{ DiscussionBoard.errors[9100187].message }}

noomkung

10 years ago

many thank

Thanks

{{ DiscussionBoard.errors[9101160].message }}

Brent Stangel

10 years ago

I had this happening every day. I installed a Captcha and it stopped completely. Also stopped all the bot signups.

Thanks

Signature

Get Off The Warrior Forum Now & Don't Come Back If You Want To Succeed!
All The Real Marketers Are Gone. There's Nothing Left But Weak, Sniveling Wanna-Bees!

{{ DiscussionBoard.errors[9101430].message }}

vishwa

10 years ago

Thanks! Man For this Info. Yeah Wordfence is best wordpress security plugin. I already used it for my blog.

Thanks

Signature

Techbizmasters.com- Blogging, Technology, and Digital Marketing

{{ DiscussionBoard.errors[9101591].message }}

allanjhn

10 years ago

Thanks nice

Thanks
1 reply

Signature

The Technology Master

{{ DiscussionBoard.errors[9101621].message }}

Simpilot938 10 years ago

How do you get round the SQL hacks? I had a batch of attacks about half a year ago where every user had their password changed and the home page changed to some hacker support message in Arabic!

The first time it happened it took a couple of hours to sort, though I got it down to 25 minutes after the 5th. TF for backups!

It was after that when I installed Wordfence and changed the Administrator username that things calmed down but it was a bad couple of weeks. I've also changed hosts since then and the SQL server is different to the web hosting server.

I'd still like to make the MySQL side a bit more secure though.
- Thanks
- 1 reply
Signature

Steven Lucas, Willing to teach. Always Learning.
Free Traffic System
{{ DiscussionBoard.errors[9101639].message }}
- dcushion 10 years ago
  
  Can you use Fantastico for installation and then use Wordfence to make it secure?
  
  Or would you still be better off to do a manual installation first?
  
  In other words, does Wordfence correct all the security issues that Fantastico has?
  
  Thanks.
  
  Thanks
  
  {{ DiscussionBoard.errors[9127512].message }}

Website Security [Wordpress Users Must Read]

Trending Topics

The Twilight Zone

Any thoughts on golf's latest phenom...Scottie Scheffler??

Should i Index Author pages?

best high quality crypto traffic.

What's the Best IM-Related Skill to Learn Today That Can Help in the Future?