Wordpress security

currently, im using Better WP Security (link provided)

WordPress › Better WP Security « WordPress Plugins

very thorough in my opinion and its free. havent had any problems with it yet. its easy to use and the dashboard is pretty straightforward.

Limit Login Attempts is a MUST-HAVE:
WordPress › Limit Login Attempts « WordPress Plugins

Before installing this plugin, my sites were hacked. After installation? Not once!

Well, I've been searching in Google and I found many options...reading the answers I think I could clarify this better about a simple and effective way as possible

Use BulletProof Security,It can protect your site against XSS, Code Injection and SQL Injection hacking attempts,RFI, CRLF, CSRF, Base64.

You can get manual from wordpress.org.

Check out this presentation is a good starting point:

slideshare.net/wpbeginner/how-to-protect-wordpress

Check these Free Plugins for complete security of your WP website.

WordPress › Secure WordPress « WordPress Plugins
Secure WordPress is extremely essential for every website, and you can obtain this plugin free of cost, without the need of any initial configuration. Some of the essential features of Secure WordPress include the following benefits:

WordPress › Exploit Scanner « WordPress Plugins
This plugin looks for any suspicious information by scanning through your website, and in the posts and comment tables of your database. However, this plugin can raise several false positives.
WordPress › WordPress Firewall 2 « WordPress Plugins
The use of the WordPress Firewall 2 is to automatically block the most common hacker attempts.

AskApache Password Protection, For WordPress
AskApache Password Protect is designed to fend off brute force attempts to access your admin page. Bots are programmed to make repeated attempts in rapid succession to guess the password. AskApache Password Protect plug-in adds a second layer to the password process so these attempts never actually get rolling. It also provides protection to all of your database folders, not just the wp-admin folder.

WordPress › WordPress File Monitor « WordPress Plugins
The main use of this plugin is to notify you through email about any changes that have been made in the files on your WordPress site. It will also help you to identify and erase the infected code on your website.

I've just read an article out there and found a recommended plugin that seems to cover many security issues, the name is Better WP Security, I'd think just with this would be enough...but I'm not sure...I'll continue researching

Protect? Hmmmm. Well, the most basic and even simplest way to protect your site is not to tell anybody what is your username and password.

I receive an enormous amount of spam on my wordpress site, thats my main issue. I just have to delete and avoid following any comments.

There is a powerful plugin on the forum for sale at the moment called WP Optimix and its being called the best plugin for security around by some very well respected warriors...

I use it on all my sites at the moment for so much more then just security...

-Matt

KillerJVs, thanks for the comment, although I don't know how good would be the plugin you mention, I'll take a look at it to evaluate it

Don't forget to also look into backing up your site. It's nice to know that your site is protected, but it's even better to take a step further and use a back up plugin in case you need to restore it.

There are quite a few solutions out there, I personally use BackupBuddy and am quite pleased with it.

Mike

^^^ Better WP Security backs up your site automatically (on a schedule). its a good all around security plug in...that takes care of most security issues.

The easiest way to protect yourself is two-fold:

1) Keep regular backups of your database and your files (uploads folder)
2) Understand how to do open heart surgery on Wordpress so you are comfortable dealing with a hack.

These are both very easy to do, and especially #2 is important so you feel that you know what you're doing.

My I recommend this podcast:
http://blog.outsourcefactor.com/podc...urity-podcast/

(See the notes pertaining to the podcast also. Some very important stuff there)

You can also have a look at the WordPress Security Checklist I have written... you can get it for free at The WordPress Security Checklist

I'd like to add that even installing all of these plugins is not going to "secure Wordpress" completely.

Blindly installing a bunch of junk is not going to help. There are plenty of ways around EACH of these plugins listed. If you want real security, consult with a security professional.


Here's my best advice, from a web host who deals with WP security issues on a daily basis:

STOP INSTALLING PLUGINS
Use only what you "need". Don't install plugins for simple tasks like adding Google Analytics code.

Use long, non-dictionary passwords with uppercase, lowercase, numbers & special chars.

Use an additional password method for your wp-admin directory

Move the config file

Some will tell you to change the prefix in the database....which is a waste of time.

Make sure your web hosts actually secures their servers "correctly".

Stop blasting your website to shady directories,blogs forums etc.

The list goes on...

Kingfish85, I was thinking in using only Better WP Security, but now I'm thinking maybe I use only a plugin that block more than 3 login attemps or so, and make some other things manually like buck ups and some others tricks, que do you think?

I really don't like the idea of installing lots of plugins, and I've read out there that turn slower the site

And of course that tips of the passwords you mentioned

Why do you think changing the prefix is a waste of time? I'm curious