WordPress Security

WordPress Security

Transcript

1. WordPress Security Joshua Alexander @jalexanderphd
2. Is WordPress Secure? • Source http://w3techs.com/technologies/details/cm-wordpress/all/all
3. Hardening WordPress • Prevention – Access Control – Setting up backups – Setting up basic security • Reaction – What you shouldn't do – What you should do
4. Access Control • Access Control of all things • Do you save your passwords for auto login? • Does your computer shutdown when not in use? • Who has access to the site? • Who has access to the server? • If someone was to break in would they be able to access your files.
5. Access Issues/Solutions • Give client and employees lowest level of access that they need. This reduces unnecessary access and mess ups in the site. • Server Access are you using FTP if so WHY!!! SFTP is more secure however this doesn't always work but when available use it. • Does your office have screensavers that force you to login when you return to prevent unauthorized users.
6. Passwords • If you can remember your password its likely not long enough. (Consider http://strongpasswordgenerator.com for random passwords) • If your not suer if its weak go here https://howsecureismypassword.net/ • So PLEASE STOP WITH THE ADMIN DEFAULTED PASSWORDS Change them ASAP!
7. Backups • Famous last words of fustrated clients I installed a backup plugin lets try that. • YOU DO NOT HAVE A BACKUP IF IT'S ON SAME CPANEL THAT GOT HACKED • Always backup off the server to another location you can only have backups if they are in multiple locations. (Whether its S2, Dropbox, another sftp etc.)
8. Hosting • Price isn't what it appears sometimes • Ensure your not just getting hosting but backups that are on multiple locations. • Ensure how long they keep their backups. • Do you or do they test those backups to see if they can properly restore.
9. Reaction Don'ts • Don't attempt to play with it unless you understand it. • Do not reset the database or change the files unless you know it will work. • Call a company that can unhack your site likely it will be much cheaper than rebuilding and will be.
10. Reaction • SCAN YOUR COMPUTER FIRST. (You don't want to bring viruses from your desktop or laptop over to your site) • Check site through scanner such as https://sitecheck.sucuri.net// or for malware try http://virustotal.com • Do you see something wrong on those scans? • If not check these items scanners can't catch everything.
11. Things you need to fix • File permissions of certain files • Change User 1 • Change the login from wp-admin to anything but that one this is the one bots use to brute force attack you
12. ADMIN USER • This is how I feel when I unhack a site when I see an user name called admin
13. Double Authentication • To the rescue when it doubt require two things to gain access. Such as password and pin code from phone or phone swipe through programs like clef.
14. Another Problem • Not updating sites • Let the client know either you or them need to be maintaining these.
15. Number 1 worst problem I see • Host companies not mentioning names since most say it. • They tell the client its ok to have more than one website per cpanel
16. Example of htaccess redirect hack
17. Examples of PHP Injection
18. Pharma Hack
19. Mobile Porn Hacks • No screen shots due to family friendly event • Redirects to porn on mobile but leaves desktop and laptop versions completely normal. • Clean up usually involves cleaning up mysql injections and htaccess files sometimes a ghost plugin
20. WordPress Plugins • iThemes Security • Sucuri Security • All in One Security (good but wouldn't recommend for beginners because you could lock yourself out.)
21. Resoures for Cyber Security • http://exploit-db.com Known exploits • https://www.us-cert.gov/ Signup for all the government notifications here FBI, DOD, US- CERT, DHS, FEMA, etc. • http://sucuri.net/blog More WordPress Focused • http://wordfence.com WordPress hacking map • http://map.norsecorp.com/ Hacking map • http://www.digitalattackmap.com/ DDOS Map
22. Any Questions • I'll also be in the happiness bar after I grab something for lunch.