Most of the information in this article is general and I recommend heading to blogsecurity.net for up to date information on WordPress security.
Blogging is supposed to be fun but it isn’t always like that. If you are hosting your own blog there is a great chance that one day a hacker may decide to target your site.
Upgrade
As good as it is, WordPress still has security issues. Upgrading to the latest version is a must if you want to lower the risk of getting your site hacked.
Upgrading today is really easy, thanks to excellent plugins like Instant upgrade. You have no excuse not to upgrade.
Folder access
Create empty index.html file (no content in it). Upload this file to your wp-content/plugins and wp-content/themes.
This will prevent anyone from looking over at what plugins and themes you have.
Secret Key
Edit your wp-config.php and change or create the SECRET_KEY definition. It should look something like this (alter the key value to your likening):
define('SECRET_KEY', '1234567890');
Active Plugins
If you have access to your database, check the table wp_options and look for the record 'active_plugins'. It will list all really active plugins on your blog. Hacker may upload a file to your upload folder and activate it as a plugin so you want to make sure there are no alien plugins listed there.
.htaccess
Check your .htaccess file located in blog's root directory. Normally it should contain only references to index.php file for suspicious activity.
File change notifications
You can install file change notifications for your blog, sending you an email whenever one of your WordPress files on the server changes.
Exploit scanner
Install WordPress Exploit Scanner plugin. It scans through all files in your WordPress installation and searches for malicious looking code. You want to check if any of the warnings contain links to sites you are not familiar with.
User registration
If you are the only registered user of you WordPress blog, turning off “Anyone can register” option in your General settings of the Admin panel is a nice precaution as this was the source of biggest troubles in the past.
Backups
Should the trouble still happen, be sure you have at least weekly backups of your blog. WordPress Database Backup plugin will automate this work for you, so no reason not to use it.
20 Comments
Thank you Vladimir!
I read the article and applied to my adspedia.ro but I guess I am already beyond salvation?
All users who enter my blog report one of these two issues:
- either redirection to some random site
- antivirus going crazy (firewall scanner specifically)
What can be done?
Thanks a lot Mr. Vladimir, now my website work normal after somebody hack
Nice tutorial, you make me aware about security issue.. Thanks for the share.. :).
I installed mainly 3 wp plugins on my website (http://www.indianscholars.net) for the security. 1. Bad Behavior: which uses the project honey-pot key and is quite effective. It can even ban the spammers from visiting your site. 2. WP-ban: if you know the ip address of the spammer, the specific ip could be banned from visiting your site by using this plugin. 3. Akismet: everyone know about it.
One more thing: I use web-stat based tracking and it works like charm. Here I could know the ip address of spammers/hackers and of course genuine visitors.
Dr. S. K. Verma (Admin; http://www.indianscholars.net)
Nice tutorial, there are many plugin for wordpress that can handle this, but i would love to do it manually.. Thanks for the share.. :).
Any chance there's an update to this! I feel my WP is not secure enough with all the new WP updates happening, 2.8.5 and now 2.8.6!
@Davies Lim... I'd second that.
If you do have time Vladimir, we would all be most appreciative.
Or perhaps your list is comprehensive enough?
I'll try to write an updated version, it's hard work keeping track of all security issues arising.
Keep reading bad things about WordPress security... frightens medeath.
Wordpress stress that using the latest version is the best form of security since all known security holes are fixed on each release.
Your list looks good and there are a few easy things that even I should be able to do such as "User registration".
I might struggle a bit with some of the others.
Vladamir... what plugin do you use for the "Notify me of followup comments via e-mail" comment check box at the end of your commernts section?
http://www.prelovac.com/vladimir/plugins-used
Thanks Vladimir
That's a big list of plugins!
Thanks for posting these pointers. As my sites grow the threat from hackers is becoming more of a concern to me.
Folder access
i think it would be simpler and safer by disabling the folder indexing in the server side setting.
Most hosting comes with some short of web interface login to your domain to control your website security features.
At the moment Exploit scanner plugin works with wordpress 2.6 and no newer versions. But still it pointed out that some malicious script is somwhere on my site and I digged out the bad scripts. Thank you for this wonderful article. However it needs to be updated.
Thank you for the suggestion about the blank index file in the plugin and themes folders. I've done my best to harden the site against attackers, but that one slipped right by me.
I have cPanel on my server (a VPS) and I have full root access. I'm curious if you know if whether settings things up in "folder permissions" of cPanel to deny access to folders without index pages (users get the "forbidden" message) would, in some way, hose WordPress?? I was tempted to do it like I do for one of my other static sites, but I wasn't sure if doing so would somehow mess up WordPress or the .htaccess file it needs.
Great information Vladimir!
I had a few problems with my blog, and I realized
that I had forgotten to back it up since I installed
it on my domain, but I am not having any more problems,
and I went and backed up my blog. Thanx for the info
and thank you for reminding me to back up my blog!
When checking your .htaccess file make sure that you scroll all the way to the bottom - sometimes they put many blank lines in before their spammy re-direct code.
Great post regarding the shortcomings over WP security.
Instead of making a blank index.php, I decided to force them to backtrack. The javascript code is "history *dot* go(-1)".
This should stop people from accessing folders you don't want seen. But the best way would be to somehow change folder permissions. I'm still working on that.
I love the idea of the Exploit scanner. Thanks for the info! :)
Nice tutorial Vladimir. Thanks. I noted that the link you provided is for a .htaccess file for a 2.1 site. He has quite a bit of extra stuff in there. Would you recommend using the same code for WP 2.6?