WordPress Security How To


Most of the information in this article is general and I recommend heading to blogsecurity.net for up to date information on WordPress security.

Blogging is supposed to be fun but it isn’t always like that. If you are hosting your own blog there is a great chance that one day a hacker may decide to target your site.

Upgrade

As good as it is, WordPress still has security issues. Upgrading to the latest version is a must if you want to lower the risk of getting your site hacked.

Upgrading today is really easy, thanks to excellent plugins like Instant upgrade. You have no excuse not to upgrade.

Folder access

Create empty index.html file (no content in it). Upload this file to your wp-content/plugins and wp-content/themes.

This will prevent anyone from looking over at what plugins and themes you have.

Secret Key

Edit your wp-config.php and change or create the SECRET_KEY definition. It should look something like this (alter the key value to your likening):

define('SECRET_KEY', '1234567890');

Active Plugins

If you have access to your database, check the table wp_options and look for the record 'active_plugins'. It will list all really active plugins on your blog. Hacker may upload a file to your upload folder and activate it as a plugin so you want to make sure there are no alien plugins listed there.

.htaccess

Check your .htaccess file located in blog's root directory. Normally it should contain only references to index.php file for suspicious activity.

File change notifications

You can install file change notifications for your blog, sending you an email whenever one of your WordPress files on the server changes.

Exploit scanner

Install WordPress Exploit Scanner plugin. It scans through all files in your WordPress installation and searches for malicious looking code. You want to check if any of the warnings contain links to  sites you are not familiar with.

User registration

If you are the only registered user of you WordPress blog, turning off “Anyone can register” option in your General settings of the Admin panel is a nice precaution as this was the source of biggest troubles in the past.

Backups

Should the trouble still happen, be sure you have at least weekly backups of your blog. WordPress Database Backup plugin will automate this work for you, so no reason not to use it.

Comments:

20 Comments

  1. Sep 27th, 2012

    Thank you Vladimir!
    I read the article and applied to my adspedia.ro but I guess I am already beyond salvation?

    All users who enter my blog report one of these two issues:

    - either redirection to some random site
    - antivirus going crazy (firewall scanner specifically)

    What can be done?

  2. Apr 2nd, 2012

    Thanks a lot Mr. Vladimir, now my website work normal after somebody hack

  3. Jun 1st, 2011

    Nice tutorial, you make me aware about security issue.. Thanks for the share.. :).

  4. Jun 20th, 2010

    I installed mainly 3 wp plugins on my website (http://www.indianscholars.net) for the security. 1. Bad Behavior: which uses the project honey-pot key and is quite effective. It can even ban the spammers from visiting your site. 2. WP-ban: if you know the ip address of the spammer, the specific ip could be banned from visiting your site by using this plugin. 3. Akismet: everyone know about it.

    One more thing: I use web-stat based tracking and it works like charm. Here I could know the ip address of spammers/hackers and of course genuine visitors.
    Dr. S. K. Verma (Admin; http://www.indianscholars.net)

  5. Dec 6th, 2009

    Nice tutorial, there are many plugin for wordpress that can handle this, but i would love to do it manually.. Thanks for the share.. :).

  6. Nov 13th, 2009

    Any chance there's an update to this! I feel my WP is not secure enough with all the new WP updates happening, 2.8.5 and now 2.8.6!

    • Nov 13th, 2009

      @Davies Lim... I'd second that.
      If you do have time Vladimir, we would all be most appreciative.
      Or perhaps your list is comprehensive enough?

      • Nov 16th, 2009

        I'll try to write an updated version, it's hard work keeping track of all security issues arising.

  7. Oct 17th, 2009

    Keep reading bad things about WordPress security... frightens medeath.
    Wordpress stress that using the latest version is the best form of security since all known security holes are fixed on each release.
    Your list looks good and there are a few easy things that even I should be able to do such as "User registration".
    I might struggle a bit with some of the others.

    Vladamir... what plugin do you use for the "Notify me of followup comments via e-mail" comment check box at the end of your commernts section?

  8. Aug 26th, 2009

    Thanks for posting these pointers. As my sites grow the threat from hackers is becoming more of a concern to me.

  9. Mar 28th, 2009

    Folder access

    i think it would be simpler and safer by disabling the folder indexing in the server side setting.

    Most hosting comes with some short of web interface login to your domain to control your website security features.

  10. Noumaan
    Feb 14th, 2009

    At the moment Exploit scanner plugin works with wordpress 2.6 and no newer versions. But still it pointed out that some malicious script is somwhere on my site and I digged out the bad scripts. Thank you for this wonderful article. However it needs to be updated.

  11. Jan 17th, 2009

    Thank you for the suggestion about the blank index file in the plugin and themes folders. I've done my best to harden the site against attackers, but that one slipped right by me.

    I have cPanel on my server (a VPS) and I have full root access. I'm curious if you know if whether settings things up in "folder permissions" of cPanel to deny access to folders without index pages (users get the "forbidden" message) would, in some way, hose WordPress?? I was tempted to do it like I do for one of my other static sites, but I wasn't sure if doing so would somehow mess up WordPress or the .htaccess file it needs.

  12. Dec 29th, 2008

    Great information Vladimir!
    I had a few problems with my blog, and I realized
    that I had forgotten to back it up since I installed
    it on my domain, but I am not having any more problems,
    and I went and backed up my blog. Thanx for the info
    and thank you for reminding me to back up my blog!

  13. Hauke
    Oct 21st, 2008

    When checking your .htaccess file make sure that you scroll all the way to the bottom - sometimes they put many blank lines in before their spammy re-direct code.

  14. Oct 12th, 2008

    Great post regarding the shortcomings over WP security.

    Instead of making a blank index.php, I decided to force them to backtrack. The javascript code is "history *dot* go(-1)".

    This should stop people from accessing folders you don't want seen. But the best way would be to somehow change folder permissions. I'm still working on that.

  15. Jul 19th, 2008

    I love the idea of the Exploit scanner. Thanks for the info! :)

  16. Jul 18th, 2008

    Nice tutorial Vladimir. Thanks. I noted that the link you provided is for a .htaccess file for a 2.1 site. He has quite a bit of extra stuff in there. Would you recommend using the same code for WP 2.6?

Have your say

Your email is never published nor shared. Required fields are marked *

*
*

Subscribe without commenting

About

vladimir prelovac Vladimir Prelovac is CEO of Prelovac Media, a computer engineer by profession and an adventurer by state of mind. more +


"I would love to change the world, I just don't have the source code yet."

Services

Manage multiple WordPress sites

Built for WordPress enthusiasts, ManageWP helps you manage all your WordPress sites from one central location.

Books

WordPress Plugin Devleopment Book Read my book WordPress Plugin Development: Beginner's Guide

Published by Packt Publishing, available online through Amazon.