WordPress is the leading Content Management System (CMS) for blogs in existence today, with more than 8.000.000 blogs using it. And this makes it a good target for any kinds of attack – more users mean more targets in the eyes of website attackers. However, a lot of websites and users mean also a lot of ways to defend your website – WordPress would have never gotten so popular if it was unsecure and unsafe to use. For those who miss to read the post about how to secure your Joomla website.
1. Upgrade to the latest version.
The first and most important rule with a CMS script is to always use the most current version available out there. A lot of times, a simple update will save you tons of trouble. With WordPress, you will be constantly reminded if a new version is out there via a notification on the top of the Admin section. If you see that a new version is available, the time for updates is now. And always remember to back up your data before an update – this means not only your web files, but also your database where all of your posts are kept.
2. Remove the basic reference
Sometimes, you might leave the wordpress link in the footer to let everyone know which blogging platform you use. Now it is a bullseye for hackers looking for new targets. Your users don't need to know you use wordpress, remove this reference for hackers. Wordpress adds the version info into the meta tag which can be found within head tag. So please do remove the following line from header.php. This is even more dangerous since it tells the hackers exactly which exploits will open your site wide open.
<meta name="generator" content="WordPress <?php bloginfo('version'); ?>" /> <!-– leave this for stats please -->
3. Secure your wp-admin folder
Secure your /wp-admin/ directory. Adding a simple .htaccess file will do the trick – you can restrict the access and allow only your personal computer to log in, or make the /wp-admin page password protected. Both steps take a total of 5 minutes and add an additional level of security.
Here's the sample code how you can lock down /wp-admin/ folder with .htaccess file so that only certain IP addresses can access that directory. You can place it directly at /wp-admin/.htaccess . This is what it looks like:
AuthUserFile /dev/null
AuthGroupFile /dev/null
AuthName “Access Control”
AuthType Basic
order deny,allow
deny from all
# whitelist office IP address
allow from 12.13.14.15
# whitelist home IP address
allow from 12.13.14.16
This file says that the IP address 12.13.14.15 and 12.13.14.16 are allowed to access /wp-admin/, but all other IP addresses are denied access.
4. Choose secure password
When starting your quest for securing your WordPress installation, the first task is to choose secure passwords – check how many users will have administrator rights for your WordPress installation and make sure that all of them are using secure passwords. For a password to be completely secure, it must be composed of not just words, no matter how complicated, but also of numbers, special characters and combinations of upper-case and lower-case letters.
Also, change your admin username – by default, the administrator account for each WordPress installation is simply named “admin” and most people never bother to change it.
5. Update your plugins
Another tip is to update your plugins – an old version of a plugin with known exploits can get you in a lot of trouble. Most of the plugins will notify you if a new version is available, so that you can act quickly. And always be careful with the plugins you use – double check user comments and reviews concerning problems before installing a given plugin.
6. Update your file permissions
Be sure that you are the only one allowed to both modify and execute them. All file permissions should be set to 644 and all folder permissions – to 755. You can do that via the File Manager tool we provide you with. However, some plugins require specific files to have 777 permissions set – read carefully the given plugin’s readme file before installing it.
If you got any additional tips, please feel free to share with us.
Author: Hosting Boost, Australia web hosting company, offers you the reliable hosting service for your both personal and business websites. Competitive hosting prices are available. If you got sales enquiry, please feel free to contact us at sales@hostingboost.com.au