I have just spent the last 36 hours (yes, NO SLEEP) fixing a site that was hacked by a malicious code / virus or something. It took over complete control of my clients site. When I created the site, I implemented all the recommended security settings at the time and have kept up on updates and such. But over the last 36 hours I have learned quite a bit about wordpress security.
First and most importantly, upon ANY NEW installation (or even current installations) here are a list of the plugins that are recommended if you want to start adding these protections to your wordpress sites (after what I’ve been through, these will be my first plugins after a theme install); NOTE: Do not activate Antivirus or WordPress firewall till last (firewall being the very last plugin to activate).
- Askimet – comes standard with WordPress, api keys are available for FREE and low cost, but is a great way to combat spam comments
- Antispam Bee
- Antivirus – NOTE: activate this plugin after ALL others
- Bad Behavior – uses a code from Project Honey Pot
- Block Bad Queries
- Chap Secure Login
- Exploit Scanner
- Secure WP
- WordPress Firewall – NOTE: You MUST deactivate this plugin to install additional plugins, as such this should be one of the LAST plugins you activate
- WordPress Table Rename – 2nd plugin, follow the directions to rename your database, do an additional BACKUP after this plugin has been installed.
- WP Ultimate Security – actually CHECKS your blog and installation of wordpress for security weaknesses and grades you. By fixing the error messages you can actually improve your Security Grade
- WP DBManager – This should be the 1st plugin you install and don’t forget to BACKUP before doing ANY of these recommended changes*
Another thing to consider is blocking countries that seem to overspam; contact your hosting provider to block any countries that you want to hide from, some of the top countries include;
- Russia
- Korea
- India
- China
- New Zealand
Other protections include: (just do a google search for directions on anything listed below)
- redefining your wordpress msql table where wp_ should be renamed to a funky string like O0hM2Db97T_ – this is harder to guess and access. – this can be done with the wp_table_rename plugin (NOTE: first install the WP DBManager and backup your database files)
- moving your config.php file to a different directory so it’s not on the same level as your other wordpress files (can only move ONE LEVEL UP)
- removing the wp version from the head and footer – can be done using Secure WP Plugin
- CHMOD your permissions as recommended in the WordPress Codex
- turning off the ability to receive comments and trackbacks – if you don’t allow comments at all you can actually delete a few files (there are several depending on what you allow)
- deleting your install script (install.php) – must have FTP or File Manager access to do this.
- always make sure you update to the most current versions of WP, themes, plugins, etc.
These are just some of the basic wordpress security options available.
Site References:
http://maketecheasier.com/the-safe-way-to-change-your-wordpress-database-table-prefix/2009/11/07 – Database backup and renaming procedures
http://www.ultimateblogsecurity.com/ – Ultimate Security (PRO – paid plugin for enhanced security)
http://www.projecthoneypot.org/index.php - Project Honey Pot
http://www.seoegghead.com/ – SEOEgghead – top notch wordpress security and SEO for wordpress
http://tdot-blog.com/wordpress/6-simple-steps-to-change-your-table-prefix-in-wordpress – Great tutorial
http://wpengineer.com/small-security-tipps-for-your-wordpress-install/ - Security Tips for Secure WordPress Installs
http://www.noupe.com/how-tos/wordpress-security-tips-and-hacks.html
http://codex.wordpress.org/Hardening_WordPress – Hardening WordPress
http://www.problogdesign.com/wordpress/11-best-ways-to-improve-wordpress-security/ – 11 Ways to Secure WordPress
http://speckyboy.com/2009/09/22/20-powerful-wordpress-security-plugins-and-some-tips-and-tricks/ – 20+Powerful Plugins for Securing WordPress
http://www.bloggingpro.com/archives/2010/04/20/wordpress-security-a-comprehensive-guide/ – Comprehensive WordPress Security Guide
