We all agree that having a secure wordpress weblog should be our first priorities when keeping a successful blog. In this post we'd like you to share your knowledge and help us create the WordPress Security guide to keep the bad guys out.
1) Nobody should be allowed to search your entire server.
A large number of WordPress themes have the WordPress Meta Tag that show the version of WordPress that is running on your blog which is an easy way to get your blog prone to hackers if you didn't upgrade to the security-enhanced file permissions on both which is pointed out by Matt Cutts. Another solution involves a plugin that sets up a secondary new version.
This tag is in the header.php file that displays your current version of wordpress.
Attackers can use bots for a brute force style of attack that simply guesses the admin password until they come up with the correct one and login. There are a couple of solutions out there, we will highlight each below.
Limit access to wp-admin folder by IP address– This solution is to restrict which IP's can access the wp-admin folder via .htaccess. This has one drawback is you may have to update your .htaccess folder if your internet provider assigns you a dynamic IP address, you move to another location or you have authors at other locations.
AskApache Password Protect– The plugin is simple, it adds a 2nd layer of security to your blog by requiring a username and password to access anything in the /wp-admin/ folder. All you have to do is choose a username and password and you are done. It writes the .htaccess file, without messing it up. It also encrypts your password and creates the .htpasswd file, as well as setting the correct security-enhanced file permissions on both.
Login Lockdown plugin– records the IP address and timestamp of every failed WordPress login attempt. If more than a certain number of attempts are detected within a short period of time from the same IP range, then the login function is disabled for all requests from that range. This helps to prevent brute force password discovery.
You need to keep your on your plugin/widget, theme, and WordPress versions updated. Also, subscribing to the plugin/widget/theme Author's RSS feeds makes keeping up with them much easier.
Probably the first thing you should do! Install the Instant Upgrade Plugin or the WordPress Automatic Upgrade Plugin. Make sure you back everything up before performing the upgrades.
Creating a strong password that is also memorable is one of the easiest defenses against being hacked. There are a lot of online password strength checker that you could check.
Also you might check lorelle's article on blogherald called Protect Your Blog With a Solid Password, offering tips and tricks to help create a strong password that is also memorable, and how to deal with all the myriad passwords we seem to accumulate online.
Thank you so much for this WordPress security tip. Really helpful to increase the security of my WordPress installation. You see, yesterday I installed WordPress on my server and put up a 'Coming soon' page. When I visited the site today, it has been hacked! I forgot to change the file permissions and default logins!