Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Hardening WordPress is An Art

E0ebe52a4d912582108eb93c10831141?s=47 Chathu Vishwajith
September 23, 2017
Technology
0
68

Hardening WordPress is An Art

My presentation for First-ever WordCamp Colombo 2017, Sri Lanka

#wccmb

E0ebe52a4d912582108eb93c10831141?s=128

Chathu Vishwajith

September 23, 2017
Tweet

More Decks by Chathu Vishwajith

See All by Chathu Vishwajith
E0ebe52a4d912582108eb93c10831141?s=48 iamchathu
0
25
E0ebe52a4d912582108eb93c10831141?s=48 iamchathu
0
77
E0ebe52a4d912582108eb93c10831141?s=48 iamchathu
0
26
E0ebe52a4d912582108eb93c10831141?s=48 iamchathu
0
94
E0ebe52a4d912582108eb93c10831141?s=48 iamchathu
0
56

Other Decks in Technology

See All in Technology
525442fc70ca92f82ae503f826956137?s=48 finengine
0
290
53850955f15249a1a9dc49df6113e400?s=48 line_developers
PRO
2
170
B16717ef4b7aab0b253d933c3934f280?s=48 mixi_engineers
0
360
525442fc70ca92f82ae503f826956137?s=48 finengine
0
370
D8e79ab09f15e69d600c00131bf7d2a9?s=48 yfutamura
0
780
5b47136bedcba2799edf4fcd27ea66d7?s=48 yaegashi
0
160
396bc484aa53948c58c8fa847ad91372?s=48 riki_hiraoka
0
240
D0f5daa7cc3a26140c06ea29e5e235cc?s=48 noriyukitakei
17
9.4k
Bf7fe621f4fe1615c228ef8a79b87282?s=48 shirayanagiryuji
0
320
9b2600a82821673d9d0f03cc6f7bc56e?s=48 kloudleinc
0
270
9a38c60104a629648564527582d071c6?s=48 ta28masa
0
270
7975b9fd58c8945ae1c6b38747de7f28?s=48 line_developers_tw2
0
590

Featured

See All Featured
2f5463832ccb768ccb4a1ca3607c27ef?s=48 jacobian
257
20k
8081b26e05bb4354f7d65ffc34cbbd67?s=48 chriscoyier
146
20k
D8fc2580cfaca035f666d9e4ee79a7f7?s=48 mongodb
23
3.9k
465724d73fe3a92c0879fdfb43a3a6f3?s=48 philhawksworth
192
17k
E14f55d3f939977cecbf51b64ff6f861?s=48 keithpitt
402
20k
Eb8975af8e49e19e3dd6b6b84a542e26?s=48 qrush
285
19k
96270e4c3e5e9806cf7245475c00b275?s=48 addyosmani
495
110k
170b760e0147792d0140e59ec78e9893?s=48 eitanlees
116
10k
1b8ad785acdd1ce1c99914b1c2a4e10e?s=48 sugarenia
233
900k
E4f5d494ebdc9e7cce1aecf3ce3e8bc1?s=48 shpigford
166
19k
Aff5641764408271f7bc398f2097edd0?s=48 denniskardys
219
120k
B3d6434763caa0ef5dc4b792662c49f7?s=48 smashingmag
283
47k

Transcript

  1. Hardening WordPress is an Art

  2. Who am I Chathu Vishwajith Auth0 Ambassador Co-Founder of a

    startup

  3. Alex Proimos from Sydney, Australia

  4. Is WordPress is secure? → 52% are from WordPress plugins

    → 37% are from core WordPress → 11% are from WordPress themes

  5. Recent incidents

  6. Recent Incidents → Display Widgets → WooCommerce Product Vendors →

    WordPress Security Update 4.8.2 – Update Immediately!

  7. Types of vulnerabilities → SQL Injection (SQLI) → Cross-site Scripting

    (XSS) → Cross-Site Request Forgery (CSRF) → Brute Force → Denial of Service (DoS) → Distributed Denial of Service (DDoS) → Full Path Disclosure (FPD) → User Enumeration → Remote Code Execution (RCE) → Remote File Inclusion (RFI) → Directory Traversal

  8. So what is the Art

  9. Continuous improvements

  10. Find a secured hosting

  11. Don’t forget to update!

  12. Don’t forget to update! → Keep your WordPress up-to-date →

    Update your plugins and themes → Change passwords periodically → Keep yourself updated

  13. Use your own, not defaults!

  14. Use your own, not defaults! → Do not use ‘admin’

    as your username → Change WP_CONFIG’s keys and salt values to randomly generated values → Change table prefix

  15. Stop directory indexing

  16. Prevent User emumaration

  17. Disable XML-RPC if not using

  18. Limit login failed attempts

  19. Backup regularly

  20. Remove unused plugins/themes

  21. Turn on Comments approval

  22. Use HTTPS! Atleast wp-admin area and wp-login.php

  23. Make sure Debugging is off!

  24. Apache, PHP, NGINX, SSL Vulnerabilities

  25. WordPress Vulnerability Database https://wpvulndb.com

  26. WordPress Vulnerability Scanner https://github.com/RamadhanAmizudin/ Wordpress-scanner

  27. None

  28. Summery → Don’t forget to update. → Use your own

    rather defaults. → Stop directory traversal. → Disable XML-RPC if you are not using it. → Limit login attempts. → Backup regularly → Remove unused plugins/themes → Keep yourself updated

  29. From Sri Lanka !

  30. Thank you !