Keep your site safe

A few important WordPress security principles

http://jeremy.hu/wpbudapest-security/

Transcript

1. KEEP YOUR SITE SAFE A few important WordPress security principles
2. WHO? • Jeremy Herve • jeremy.hu • @jeherve • Jetpack Mechanic at Automattic
3. WHAT IS SECURITY?
5. SECU-WHAT? • Scary • Seems complicated • Yet super important Take the time to learn and understand.
6. SECU-WHAT? • Link injections • Defacement of your whole site • Information gathering Take the time to learn and understand.
7. HACKERS’ GOALS Why do people want to get into my site?
9. WHY? • Money • Hack other sites through your site • Information gathering • Hacktivism • For the lulz What makes hackers tick
10. ATTACKS How do hackers try to get in?
12. HOW? • Targeted • Automated Different types of attacks MOST ATTACKS ARE NOT PERSONAL
13. MISCONCEPTIONS
14. WRONG! • “I’m not a target” • “I’m safe, I use X security plugin” • “I’m safe, I hide my WP version / log in page” • “WordPress is not secure” Common WP security misconceptions
15. GOOD PRACTICES
17. GOOD PRACTICES • PHP version • Specialized in WordPress • Update policy • Brute Force prevention measures • SSH access Pick a good host
18. GOOD PRACTICES • Lock down registrations • List of admins • List of plugins & themes • Update policy • Edit code from your dashboard • Pingbacks • Lock down some options • Lock down dashboard access • XML-RPC access Audit of your WordPress use
19. GOOD PRACTICES // Can't enable user registrations function jeherve_option_users_can_register( $value ) { return '0'; } add_filter( 'pre_option_users_can_register', 'jeherve_option_users_can_register' ); // Default role to subscriber function jeherve_option_default_role( $value ) { return 'subscriber'; } add_filter( 'pre_option_default_role', 'jeherve_option_default_role' ); Lock down registrations
20. GOOD PRACTICES • Lock down registrations • List of admins • List of plugins & themes • Update policy • Edit code from your dashboard • Pingbacks • Lock down some options • Lock down dashboard access • XML-RPC access Audit of your WordPress use
21. GOOD PRACTICES • Don’t keep deactivated plugins • Is the plugin maintained? • Who’s the maintainer? • How popular is it? Pick the right plugin / theme
22. INSTALL FROM TRUSTED SOURCES ONLY
23. GOOD PRACTICES • Lock down registrations • List of admins • List of plugins & themes • Update policy • Edit code from your dashboard • Pingbacks • Lock down some options • Lock down dashboard access • XML-RPC access Audit of your WordPress use
24. GOOD PRACTICES // Don’t use the dashboard to edit code. Really. define('DISALLOW_FILE_EDIT', true); Don’t edit code via wp-admin
25. GOOD PRACTICES • Lock down registrations • List of admins • List of plugins & themes • Update policy • Edit code from your dashboard • Pingbacks • Lock down some options • Lock down dashboard access • XML-RPC access Audit of your WordPress use
26. GOOD PRACTICES // Force deactivate pingbacks function jeherve_deactivate_pings( $methods ) { unset( $methods['pingback.ping'] ); return $methods; } add_filter( 'xmlrpc_methods', 'jeherve_deactivate_pings' ); Disable ping backs
27. GOOD PRACTICES • Lock down registrations • List of admins • List of plugins & themes • Update policy • Edit code from your dashboard • Pingbacks • Lock down some options • Lock down dashboard access • XML-RPC access Audit of your WordPress use
28. GOOD PRACTICES // No one should be able to change the admin email address function jeherve_option_admin_email( $value ) { return 'jeremy@jeremy.hu’; } add_filter( 'option_admin_email', 'jeherve_option_admin_email' ); Lock down some options
29. GOOD PRACTICES • Lock down registrations • List of admins • List of plugins & themes • Update policy • Edit code from your dashboard • Pingbacks • Lock down some options • Lock down dashboard access • XML-RPC access Audit of your WordPress use
30. GOOD PRACTICES // save as .htaccess and upload to the wp-admin/ folder # Block access to wp-admin. order deny,allow allow from x.x.x.x deny from all # Allow access to wp-admin/admin-ajax.php <Files admin-ajax.php> Order allow,deny Allow from all Satisfy any </Files> Lock down dashboard access
31. GOOD PRACTICES • Lock down registrations • List of admins • List of plugins & themes • Update policy • Edit code from your dashboard • Pingbacks • Lock down some options • Lock down dashboard access • XML-RPC access Audit of your WordPress use
32. GOOD PRACTICES // In a plugin add_filter( ‘xmlrpc_enabled', ‘__return_false' ); // In .htaccess <Files xmlrpc.php> order deny,allow deny from all </Files> Disable XML-RPC
33. BLOCK XML-RPC — IF YOU DON’T USE IT!
34. LET’S TALK P@$$WORDS
35. P@$$WORDS • Use a password manager • 1Password • Keepass A strong, unique password IF YOU CAN REMEMBER IT, IT’S NOT STRONG ENOUGH
36. P@$$WORDS • SFTP instead of FTP • SSH Key pair instead of password • cPanel, PHPMyadmin • Domain registrar Make it hard everywhere
37. P@$$WORDS • Use 2FA everywhere • In your WordPress dashboard • Authy • Google Authenticator • Clef • Jetpack Use 2 factor authentication
38. P@$$WORDS • Free SSL with CloudFlare • letsencrypt.org Use HTTPS in the admin
39. FIREWALLS Knock them down before they can get you
41. FIREWALLS • WAF (Web Application Firewall) • Sucuri, CloudFlare, Incapsula, SiteLock • fail2ban, ModSecurity • Jetpack Protect • Your host, again Detect hackers before they get to your site
42. PLUGINS Plenty of choice, your pick
44. PLUGINS • iThemes Security • All In One WP Security • WordFence • Sucuri Security • Bulletproof Security Many good security plugins in the repo
45. ALL SET! But don’t forget…
46. MONITORING • Educate your clients: updating is important • Change passwords often • Monitor activity on the site • Use a backup service • Use a security scanning service Because you’re never done
47. KEEP IN MIND
48. 3 TIPS TO HELP YOU DODGE SOME BULLETS
49. YOU ARE A TARGET
50. AUDIT AND MONITOR
51. UPDATE
52. Questions? Jeremy Herve | jeremy.hu | @jeherve jeremy.hu/wpbudapest-security/