This article outlines 9 different ways you can secure your WordPress blog/site. Security is often an overlooked aspect of blogging, but a few minutes making sure things are secure can save you hours and hours of ‘fixing’ if someone decides to mess with your site.
- Download and install the wp-scanner plugin. It performs he following security checks:
- WordPress Version Check (currently supports 7 version checks). Future releases will include a file existence version check, for those blogs that have removed their version details.
- Tests the WordPress theme template for basic XSS vulnerabilities
- Enumerates WordPress Plugins. Future releases will perform additional tests in this area.
- Another plugin to install is Login LockDown. It records the IP address and timestamp of every failed WordPress login attempt. If more than a certain number of attempts are detected within a short period of time from the same IP range, then the login function is disabled for all requests from that range. This helps to prevent brute force password discovery. It’s very straight forward and easy to use – I give it a big thumbs up.
- Arguably my favorite WordPress security plugin is AskApache Password Protect. It adds a 2nd layer of security to your blog by requiring a username and password to access anything in the /wp-admin/ folder. And it does that by automatically creating and picking all the right settings for the .htpasswd and .htaccess files (including the save locations), but you can easily change those settings to anything you want, right from your WordPress Admin Panel.
- From Matt Cutts presentation – remove the tag in your header.php that displays the current version of WordPress. It’s:
<meta name=”generator” content=”WordPress <?php bloginfo(’version’); ?>” />
Or, you can just modify it so that the version number isn’t displayed, to something like
<meta name=”generator” content=”Powered by WordPress” />
- Again, from Matt Cutts – put a blank index.html file in your /wp-content/plugins/ directory. By default, you can actually view the contents of this folder, so everyone in the world knows which plugins you have installed.
- I won’t bother with the “always use the latest version of WordPress” tip, because that’s just too obvious. However, I will mention that the Automatic Upgrade Plugin can keep your version of WordPress current, and you don’t have to do anything other than install it. I happen to prefer to upgrade WP manually, so I don’t use this one, but I’ve heard nothing but good things about it.
- If you have a ‘contact me’ page, make sure it’s a secure one. No one likes spam. Secure Form Mailer is great.
- Keep your web server updated. Though this isn’t WordPress specific, no matter how secure WordPress is, if there’s a vulnerability in your actual web server, it won’t matter. So keep an eye out for updates to your web server (ie. litespeed, Apache etc).
- Consider bookmarking http://blogsecurity.net (or subscribing to their RSS feed) – they have some great posts and provide info on insecure plugins etc as soon as they find out about them.
Cool… I just tried most of the above – the wp-scanner found something up with my search form. Fixed!
wow, thanks so much for these. I hadn’t heard of any of those plugins and I work with WP a lot. I really like the AskApache plugin. thanks again!
呵呵，帮顶！来听听鬼故事……
呵呵，帮你PP顶！也请来返利看看……
Well, some points are a little out of date now, with 2.7+.
I’ve added a security video tutorial which hopefully makes a nice accompanyment to this piece, Ross.
Must admit, I did include the one about updating to the latest version though! Plus some about my favorite security plugins…
Video How-to: 10 Tips To Make WordPress Hack-Proof
http://guvnr.com/web/blogging/10-tips-to-make-wordpress-hack-proof/
Of course, what a great site and informative posts, I will add backlink – bookmark this site? Regards, Reader.
Nowhere did I see FTP as a concern. I think it should be as the security is pretty basic and not as good as SSH.
Thanks for the tips. I will definitely use these in my blogs. I am new to the blogging world and this information in invaluable.
Since the time I have been blogging on WP, I have looked forward to the Plug-ins. They add value to the blogging experience.
The additional AskApache Password Protect plug-in does ensure for a secure work experience within WP. I think it is a must while operating on WP.
In these times, security has been the issue that dominates smooth operation on the net. And these plug-ins are to that extent extremely relevant.
Considering the risk that security on the net entails, AskApache plugin should be the compulsory plugin with WP.