Securing WordPress

Transcript

1. Securing WordPress by @bastilian
2. What needs to be secure? • Server (Operating System) • Dependencies (PHP, ImageMagick, etc.) • Web-Server • Database-Server
3. Keep everything up to date! Always!
4. Typical WordPress setup Operating System Web-Server PHP (WordPress) Database
5. Operating System - First line of defense
6. Firewall • First rule: Drop everything • Minimum required open ports: ◦ HTTP ◦ HTTPs ◦ SSH
7. Permissions • Don’t be rude… ähm… root! • The right permissions for the right files/dirs ◦ Hardening WordPress • Golden Pass: 777 ◦ You only get it once! NEVER AGAIN! • Run everything with the right (dedicated) user!
8. Web-Server • Log everything (separated)! • Only give access what needs to be accessed ◦ Block everything else
9. Database • Again: don’t be root! • Separate databases • Only accessible locally
10. PHP • No root for you!
11. WordPress
12. Plugins • Only install trustworthy Plugins • Read through it’s code ◦ Any http-requests? ◦ Any file-operations? ◦ Any DB-operations?
13. Enable SSL (for wp-admin) • HTTPs will become standard (SPDY) • SSL certs for free at StartSSL™ • Gives you a green lock icon.
14. Fail2Ban • Logs failed Authentications • Bans IPs on OS-level
15. DDoS - You bit** • U rich? throw money at it. • If you can reroute internally. • Cross your fingers and hope it’s over soon.
16. Spam Comments? • Akismet
17. There is more. Thanks.