How to secure a Wordpress website

by chriz

Posted: 11 years ago 31 replies

PROGRAMMING

Hello all ,

I was wondering what the best way to secure a Wordpress website. I setup different ones with security plugins of which 3 out of 4 sites got hacked, so that got me thinking of finding a solution to this problem.

I am setting up Wordpress sites for a client righ now and with Wordpress websites being hacked, I was wondering if there are good free options to secure Wordpress and if not which paid plugins or solutions would work best.

And can Wordpress be totally secured against attacks to start with ?

Thanks

Chris

#secure #website #wordpress

MikeOranguu 11 years ago
Howdy,

First thing to understand is that security can never be 100%. No matter how hard we try, we are always playing a game of cat of mouse between developers/webmasters and hackers/hacktivists/douchebags.

You also need to remeber that WordPress and most of it's plugins are 100% open source which means anybody can view all of the source code, and if inclined deciper security holes.

The best you can do is to harden the utter crap out of your installs. There are many, many tips all over the internet but some of the most basic tips are the most effective.
- Always, always keep your plugins and WordPress installs upto date. The reason updates are pushed are not just to add features, but patch security holes and issues.
- Strong passwords are a must for at least admin level accounts. A good password is around 15 characters long and contains lowercase, uppercase, numbers and punctuation.
- Change the default username, so instead of the inital user being admin, make it anythign you want. The idea behind this is because it's a default, it's takes some of the work out of cracking the admin/master account as the username is already known.
- In your wp-config file you will want to change the salt keys to something new and it's also wise to change the database table prefix as well. Why let hackers have it easy with defaults, when you can make them work for it.
- Be cautious of installing plugins not found on the WordPress repository, or reputable sources like CodeCanyon. It is beyond easy as a developer to leave a backdoor into a website via a plugin they make.
- Also be cautious about those that you grant admin rights too. Hackers are not just your biggest threat a pissed off member of staff, or worse, an angry developer can trash a site in mere seconds.
- If possible find a plugin that limits the amount of attempted logins per IP. This will prevent brute forcing attacks, or at the very least considerably hamper them.
- If your coding anything that has access to the database, then it is of utter importance to always sanitize user input. It can never be fully trusted, ever!
Last of all, spend some time reading security guides for wordpress online and implement their advice. Also use reputable plugins to help make things harder for hackers such as the one i mentioned above.

Just remember nothing is a 100% security fix, one plugin, hell ten plugins won't make your sites impenetrable, but it will make it one hell of a pain in the ass for any casusal hacker attempting to mess with your site; more than likely they will just move on to the next target.

Hope that helps!
- Thanks
{{ DiscussionBoard.errors[8327403].message }}
innozemec 11 years ago

i always htaccess protect the wp-admin folder with access only to my IP
- Thanks
- 1 reply
Signature
INDEXIFICATION.COM - Get 1.5 Million Links a month Crawled & Indexed!

SERPEXPLORER.COM - 100% Accurate Search Engine & Youtube Rank Tracker!
{{ DiscussionBoard.errors[8327925].message }}
- chriz 11 years ago
  
  Thanks for the advice guys !
  
  Can you advice some good free security plugins everyone using Wordpress should use ?
  
  Htaccess protect the wp-admin folder sounds good, I found a plugin that hides the wp-admin folder all together would that be a good security thing to do ?
  
  Thanks
  
  1 reply
  
  {{ DiscussionBoard.errors[8328224].message }}
  
  MikeOranguu 11 years ago
  
  I very much imagine that the plugin you're using does exactly what innozemec mentioned and alters the .htaccess file.
  
  Recommendations:
  
  WordPress › Better WP Security « WordPress Plugins
  WordPress › Limit Login Attempts « WordPress Plugins
  
  The first one is an all around solution and covers a whole bunch of different security facetss. The second one is a plugin which limits login attempts.
  
  Thanks
  
  1 reply
  
  {{ DiscussionBoard.errors[8328257].message }}
  
  chriz 11 years ago
  
  Thank you MikeOranguu,
  
  I really appreciate everything that can help protect my clients sites.
  
  I also heard you could redirect your website to free CDN networ, don't know that is easy to do and if it works ?
  
  Thanks
  
  {{ DiscussionBoard.errors[8330791].message }}
kenzo22 11 years ago

Also make all your passwords strong. By strong i mean completely random charaters, lower and upper case, special characters etc. Also make sure you have plugin which stops multiple login attempts.
- Thanks
- 1 reply
Signature

Backup and maintenance plugin for WordPress
www.wpguards.com
{{ DiscussionBoard.errors[8331379].message }}
- chriz 11 years ago
  
  Thanks Kenzo,
  
  How long should a Wordpress admin password be preferably ?
  
  Thanks
  
  {{ DiscussionBoard.errors[8331498].message }}
youroutsourcer 11 years ago

ust hiding parts of your site is helpful but won't stop everything. After we hide sensitive areas of the sites we'll protect it by blocking users that shouldn't be there and increasing the security of passwords and other vital information.

Scan your site to instantly tell where vulnerabilities are and fix them in seconds
Ban troublesome bots and other hosts
Ban troublesome user agents
Prevent brute force attacks by banning hosts and users with too many invalid login attempts
Strengthen server security
Enforce strong passwords for all accounts of a configurable minimum role
Force SSL for admin pages (on supporting servers)
Force SSL for any page or post (on supporting servers)
Turn off file editing from within WordPress admin area
Detect and block numerous attacks to your filesystem and database
- Thanks
- 1 reply
Signature
article writing service for seo
{{ DiscussionBoard.errors[8332006].message }}
- chriz 11 years ago
  
  Thanks Youroutsourcer
  
  Which tool is best to scan your Wordpress installation / site with ?
  
  Thanks
  
  1 reply
  
  {{ DiscussionBoard.errors[8333880].message }}
  
  MikeOranguu 11 years ago
  
  Howdy,
  
  Another tool I normally use is the below site for generating strong passwords. Used on it's default setting creates a good strong password.
  
  Strong Password Generator
  
  Thanks
  
  1 reply
  
  {{ DiscussionBoard.errors[8334100].message }}
  
  RobinInTexas 11 years ago
  
  I use Wordfence to block access attempts and to scan my sites for potential problems.
  
  I also secure my wp-admin directory by denying all except my ip, it doesn't change
  Htaccess:
  
  Code:
  
  order deny,allow deny from all #nnn.nn.n.nnn on the next line is my ip allow from nnn.nn.n.nnn # You need to whitelist the ajax handler --many plugins make a call to it <Files admin-ajax.php> Order allow,deny Allow from all Satisfy any </Files>
  
  If your's changes, you can password protect the directory
  
  htaccess
  
  Code:
  
  AuthUserFile /path/to/your/htpasswd AuthType basic AuthName "Restricted" require valid-user # You need to whitelist the ajax handler-- many plugins make a call to it <Files admin-ajax.php> Order allow,deny Allow from all Satisfy any </Files>
  
  For a password you need to use 13-15 characters, including at least one of each:
  Upper Case Character
  Lower Case Character
  Number
  Symbol
  You can make one by using an easy to remember word and making 3 simple substitutions and adding a repeating character at the beginning or end to get to 13-15
  For example
  1++++++++++++Dog
  
  Would be impossible for a brute force attack to crack online.
  (see https://www.grc.com/haystack.htm for an explanation of why the easy for you password solution works)
  
  Originally Posted by MikeOranguu
  
  Mike's info above is excellent.
  
  [ 1 ] Thanks
  
  Signature
  
  Robin
  
  ...Even if you're on the right track, you'll get run over if you just set there.
  
  {{ DiscussionBoard.errors[8334909].message }}
  
  tangosdad 11 years ago
  
  [DELETED]
  
  {{ DiscussionBoard.errors[8367852].message }}
  
  RobinInTexas 11 years ago
  
  Originally Posted by tangosdad
  
  This part I'm going to need some help with. I have no idea how to implement this. Where can I find a detailed explanation of this part? Thanks!
  
  The best description I have seen for htaccess and wordpress is here .htaccess : Perishable Press
  
  You would need to check out several of the posts on that site if you are not familiar with htaccess.
  
  Keep in mind BeechHill's comment, or you might use the Better WP Security or
  BulletProof Security plugins to do some modifications to your htaccess in order to harden wordpress (don't use both of them, as they use different approaches some of which might conflict with one another)
  
  [ 1 ] Thanks
  
  Signature
  
  Robin
  
  ...Even if you're on the right track, you'll get run over if you just set there.
  
  {{ DiscussionBoard.errors[8369336].message }}
otfromtot 11 years ago

WordPress › Security Ninja Lite « WordPress Plugins can help you secure your site and tell you common vulnerabilities. I like bulletproof and better wp security, but haven't tried using them together because they affect the same areas
- Thanks
- 1 reply
{{ DiscussionBoard.errors[8338963].message }}
- chriz 11 years ago
  
  Thanks guys, great tips ! Helps a lot, now installing and securing the Wordpress sites. If you have more security tips pls share.
  
  Maybe we can make this a topic for everyone to use , how to secure Wordpress with tips by people working with Wordpress for longer periods of time
  
  Thanks
  
  {{ DiscussionBoard.errors[8342498].message }}
alir500 11 years ago

It is recommended to use the WordPress Firewall plugin:
WordPress › WordPress Firewall 2 « WordPress Plugins
- Thanks
- 2 replies
{{ DiscussionBoard.errors[8347751].message }}
- chriz 11 years ago
  
  Thanks for the great info guys, I am learning every day !
  
  When you have more tips then pls share them, this post can become a good resource for every Warrior who has knowledge of or wants to secure his / her Wordpress sites to the max, as far as that is possible
  
  Thanks
  
  {{ DiscussionBoard.errors[8350791].message }}
- RobinInTexas 11 years ago
  
  Originally Posted by alir500
  
  It is recommended to use the WordPress Firewall plugin:
  WordPress › WordPress Firewall 2 « WordPress Plugins
  
  Why are you recommending an out of date plugin??
  
  Trying to get your post count up or just spamming the thread with your footer link?
  
  Wordpress.org:
  
  This plugin hasn't been updated in over 2 years. It may no longer be maintained or supported and may have compatibility issues when used with more recent versions of WordPress.
  
  Thanks
  
  1 reply
  
  Signature
  
  Robin
  
  ...Even if you're on the right track, you'll get run over if you just set there.
  
  {{ DiscussionBoard.errors[8351137].message }}
  
  crescendo 11 years ago
  
  Check out the link, it will definitely help you:
  10 simple ways to secure your Wordpress site | Feature | .net magazine
  
  Thanks
  
  1 reply
  
  {{ DiscussionBoard.errors[8352753].message }}
  
  chriz 11 years ago
  
  Thanks guys, really usefull tips to secure Wordpress website, but nothing is completely safe. Today the website of our nationwide police department in the Netherlands / Amsterdam was hacked or rather brought down !
  
  Thanks
  
  {{ DiscussionBoard.errors[8353567].message }}
grace2 11 years ago

Here I am giving you a link to get your wordpress website secure. I hope this will help you in the better way.

WordPress › How to Keep WordPress Secure
- Thanks
- 1 reply
{{ DiscussionBoard.errors[8353617].message }}
- RobinInTexas 11 years ago
  
  Originally Posted by grace2
  
  Here I am giving you a link to get your wordpress website secure. I hope this will help you in the better way.
  
  WordPress › How to Keep WordPress Secure
  
  Another link to ancient, out of date information, that link is to a post that is a month short of 4 years old.
  
  Thanks
  
  1 reply
  
  Signature
  
  Robin
  
  ...Even if you're on the right track, you'll get run over if you just set there.
  
  {{ DiscussionBoard.errors[8354728].message }}
  
  chriz 11 years ago
  
  RobinTexas,
  
  Do you yourself have any other recent tips ?
  
  Thanks
  
  2 replies
  
  {{ DiscussionBoard.errors[8357222].message }}
  
  Mohsin Rasool 11 years ago
  
  Originally Posted by chriz
  
  RobinTexas,
  
  Do you yourself have any other recent tips ?
  
  Here is the latest take by the Matt, founder of WordPress on WP security:
  Passwords and Brute Force | Matt Mullenweg
  
  http://www.warriorforum.com/main-int...mple-step.html
  
  Thanks
  
  Signature
  Warriors4Hire: WordPress & GENESIS Experts | Custom WP Theme | WordPress Troubleshooting | Customizations | WP Security | Responsive Themes
  
  My Business site: WarMarks - Web Development | My Personal Blog: Mohsin Rasool
  
  {{ DiscussionBoard.errors[8357364].message }}
  
  RobinInTexas 11 years ago
  
  Originally Posted by chriz
  
  RobinTexas,
  
  Do you yourself have any other recent tips ?
  
  There's my post above and anyone running WordPress should read the WordPress Codex for official advice.
  
  Not doing those things is asking to be hacked.
  
  Doing more, or listening to the hype in sales pitches for paid plugins is in my opinion a waste of time and money.
  
  Thanks
  
  Signature
  
  Robin
  
  ...Even if you're on the right track, you'll get run over if you just set there.
  
  {{ DiscussionBoard.errors[8358070].message }}
yestyle Banned 11 years ago

Always update latest version and config files on your server to increase secure for your website.
- Thanks
{{ DiscussionBoard.errors[8357432].message }}
BeechHill 11 years ago

You have to be careful about mucking around with your .htaccess file, depending on other plugins you use. There are many less intrusive security plugins that will get you 95% there. I agree with Wordfence as a good one to use. It'll send you emails of any problems, such as out of date plugins and scans for any changes to your WP core files.

Your best defense is to stay up to date with WordPress releases. Also, use as few well made and supported plugins as you can.
- [ 1 ] Thanks
{{ DiscussionBoard.errors[8367946].message }}
EzeadMedia 11 years ago

The thing I do not see mentioned here is make sure to set your auto backups to your database nightly and you should have your current scripts in a minimum of 3 locations on the server. If you have mysql workbench or access to it do manual backups at least once a day. Also ftp a copy of your scripts to your workstation every time you make a change to the script and if you want to be really sure - burn a copy of all to a CD weekly.

That way if you get hacked you can be back up and running in minutes not days.
- Thanks
- 1 reply
{{ DiscussionBoard.errors[8378286].message }}
- Karen Blundell 11 years ago
  
  I strongly recommend that you learn to manually add items to your .htaccess file rather than using yet another WordPress plugin, because when you are under attack, your site can become inaccessible if too many requests are sent to a plugin to do it's job.
  
  you can get a great lesson on .htaccess and all the things you can do with it here:
  Apache HTTP Server Tutorial: .htaccess files - Apache HTTP Server
  
  [ 1 ] Thanks
  
  1 reply
  
  Signature
  ---------------
  
  {{ DiscussionBoard.errors[8380913].message }}
  
  Mark Ford 11 years ago
  
  Yes - Karen is right on the money there.
  
  I would never rely on a plugin to do this job for you - plugins are usually created to help people who don't know or care to know how to do the things which you can manually do to wordpress or your server to harden.
  
  As mentioned earlier in this thread - check out the Wordpress Codex Hardening Guide
  
  A nice tip in there which I haven't seen mentioned here yet - is moving your config file out of your public web space.
  
  Thanks
  
  {{ DiscussionBoard.errors[8381270].message }}
Mel McDoogle 11 years ago

Is it a good idea to use htaccess protect the wp-admin folder and with access only to my IP?
- Thanks
{{ DiscussionBoard.errors[8456763].message }}
canniffch 11 years ago

Making sure your WordPress installation has the latest updates,Minimizing the number of plugins you use , Choosing passwords that are difficult to crack are few points to remember which are basics for wordpress security.
- Thanks
{{ DiscussionBoard.errors[8478237].message }}

How to secure a Wordpress website

Trending Topics

Any thoughts on golf's latest phenom...Scottie Scheffler??

The Twilight Zone

Should i Index Author pages?

best high quality crypto traffic.

What's the Best IM-Related Skill to Learn Today That Can Help in the Future?