Without a doubt, for a self-hosted blog, WordPress is the best blog CMS that you can get. However, being a popular and open source software, it also means that hackers have full access to the code which they can scrutinize to find any exploits they can use to hack into any WordPress-enabled site.
On the good side, one of the best things about WordPress is its plugin system that allows anyone to install any plugins or create your own plugins to extend its functionality, including improving security.
Here, I have listed some wordpress security plugins (and a couple of tricks) that you can use to secure WordPress blog.
All the plugins and tricks listed below are meant for WP 2.7 and above. If you are still using an older version of WordPress, it’s time to upgrade your blog.
Protecting Your Login
This plugin uses the
CHAP protocol to encrypt your password. The password is first salted with a random number (nonce) generated by the session, followed by the md5 transformation algorithm. This result is then sent to the server where it is decrpyted and authenticated. This is a zero-configuration plugin, which means you can use it immediately after activating it.
Stealth Login obfuscates your login page by allowing you to define a custom login page rather than the default wp-login.php. In the event that your password is leaked, the hacker will also have a hard time finding the correct login URL. A good use of this is to prevent any malicious bots from accessing your wp-login.php file and attempting to break in.
Login Lockdown is useful in preventing a brute force attack. What Login LockDown does is to record the IP address and timestamp of every failed login attempt. If more than a certain number of attempts are detected within a short period of time from the same IP range, it will lockdown the login function and prevent any people from that IP range to log in.
This plugin adds an additional HTTP authentication to provide a second layer of defense for your blog. You can set up password protection for your blog using HTTP Basic Authentication, or you can choose to use the more secure HTTP Digest Authentication.
Note that this plugin might/might not work depending on your server capability. If your site does not pass the AskApache configuration tests (the tests run by the plugin to detect your server capabilities), contact your web host and see if they can make changes on the server side.
This plugin provides a “semisecure” login environment by encrypting your password with the
RSA cryptography
Protecting Your Database
Perhaps for some of you, backing up a database could mean a troublesome technical chore. With WP-DB-Backup, you just need to configure it once and get it to run automatically at regular intervals.
What this plugin does is to automate the backing up of your database and have it sent to your email inbox. Other than the default table created by WordPress, you can also backup custom tables created by plugins. In the event that your account crashes, you can easily import and restore the database with the backup.
Wp-DBManager is just like a phpmyadmin within your dashboard. You can easily manage your database directly within your dashboard. There are useful features such as optimizing/repairing/backing up/restoring your database and if you are technical enough, you can even run your own SQL query from the option page.
On the bad side, if any hackers manage to login to your site, this plugin is going to be a gateway for them to create havoc in your database.
8. Change database table prefix
The default prefix used by WordPress is “wp”. You can easily change the prefix to other terms that are difficult to guess using the
WP-Security-Scan. More detail on this plugin below.
9. Protect your wp-config.php file
Your wp-config.php file contains all your database login credentials and it should be hidden from public view in all circumstances. In your htaccess file, put in this line:<Files wp-config.php> order allow,deny deny from all </Files>
to prevent anyone from viewing the wp-config.php file.
Protecting Your Admin Page
This plugin forces SSL on all pages where passwords can be entered so that all information transmitted are encrypted.
One thing though, you have to own a SSL certificate before you can do it. If you are not willing to shell out the extra money to buy a private SSL certificate, you can ask your Web host about Shared SSL. Most web hosts provide Shared SSL for all their clients and it is easy to configure.
11. Change login username
Using “admin” as your login username is the last thing you want to do. When you first installed WordPress, you should immediately create another administrator account with your own username and password and delete the “admin” account.
Prevent Others From Viewing Your Internal File Structure
12. Hiding the WP version
In most WordPress themes under the <head> section, there is always a line of code showing the WordPress version that you are using. Giving away your WordPress version number means telling the hacker what exploit to use to hack into your site.
Since WP2.6.5, WordPress has made it even harder to remove the wp version as it embeds that information within the wp_header tag. A plugin that you can use to remove that information is
WP-Security-Scan.
13. Hiding the WP-content
The WP-content folder is where you stored all your plugins and theme files. This is the place where you want to prevent other people from looking into. You can either upload a blank index.html file to the wp-content folder, or create a .htaccess file in the wp-content folder and add this line:Options All -Indexes
14. Block wp-folder from indexing by search engines
While you want the search engines to index your blog and bring in lots of traffic, the last thing that you want to see is to let the search engines expose your internal file structure to the public. What you can do is to block all your wp-folder from indexing by search engine by adding the following entries to the robot.txt:
Disallow: /wp-*
Maintenance
I have mentioned this plugin several times, so it is time for me to explain what it does. WP-Security-Scan checks your WordPress for security vulnerabilities and suggests/provides corrective actions. The corrective actions include changing your database prefix, hiding the WordPress version number from the header and allows you to test out the strength of your password.
Once in a while, it is a good idea to run the inbuilt security scanner and check your blog for any security invulnerabilities.
16. Change password regularly
17. Update WordPress and all plugins to the latest version
Needless to say, upgrading to the latest version of WordPress and plugins is the best way to protect yourself.
Protecting Your Connection
18. SFTP
Transferring files to your online account is a common thing to do. However, instead of using the unsecured FTP, you should use
SFTP (Secure FTP). This will create a SSH connection and sent all your files encrypted to the server. If you need help creating a SFTP connection, here’s the
guide.
The above information should be sufficient for you to create a secure WordPress blog. If you have not implemented any of these, I would urge you to do so now.
What other methods do you use to secure your WordPress blog?
Give Suggestions and Comments
Thank You.!
A sitemap plugin to make it easier for your site to show all your pages, posts, archives, categories and tags in an easy to read format.
