Browsing WordPress Uploads

Are you sharing your WordPress uploads with the world?

Transcript

1. You might be guilty of this and not even know it... Enzo12 LLC | @lorenzocaum Friday, May 30, 14
2. That is me! Lorenzo Orlando Caum Founder, Enzo12 LLC I leverage the internet to solve problems for awesome people across the world You should connect with me on LinkedIn right now  hello@enzo12.com Follow me on Twitter: @lorenzocaum Friday, May 30, 14
3. Love WordPress? Friday, May 30, 14
4. Happy with your web host? Friday, May 30, 14
5. Excited to have an online store? Friday, May 30, 14
6. Try this 1. Open your favorite web browser 2. Go to your website 3. Add /wp-content/uploads/ to the end of your website’s URL http://example.com  http://example.com/wp-content/uploads/ Friday, May 30, 14
7. What do you see? Friday, May 30, 14
8. If you’re lucky you’ll see an error message similar to these Friday, May 30, 14
9. What did you see on your website? Friday, May 30, 14
10. Stuff like this??? Friday, May 30, 14
11. Are you sad? Friday, May 30, 14
12. You are not alone 178,000,000 search results. Wouldn’t be lovely if you could automagically turn that into cash? Friday, May 30, 14
13. So what's the problem? Friday, May 30, 14
14. So what's the problem? Why should you care? Friday, May 30, 14
15. It’s a security risk! Friday, May 30, 14
16. … Friday, May 30, 14
17. Anyone can browse your files as they wish Friday, May 30, 14
18. What ELSE can people do with the freedom? Friday, May 30, 14
19. View your plugins Friday, May 30, 14
20. View your pictures and anything else that you have uploaded… Friday, May 30, 14
21. Download your product files for FREE (if you are using File System Storage for Shopp) Friday, May 30, 14
22. + Friday, May 30, 14
23. The information could be used in an unethical manner aka (hacked website)  Friday, May 30, 14
24. Are you panicking? Friday, May 30, 14
25. Take a deep breath because… Friday, May 30, 14
26. Take a deep breath because… The fix is easy and takes less than one minute! Friday, May 30, 14
27. Are YOU ready? Friday, May 30, 14
28. Let’s GO! Friday, May 30, 14
29. The upcoming steps are easy to follow. Even a new WordPress user will be done in a few minutes. I want to stress that you read over the directions a couple times as making the wrong changes could take your website offline. Friday, May 30, 14
30. Log in to your web server via SFTP or FTP with your SFTP/FTP client (FileZilla and Cyberduck are free options). If you aren’t sure how to do this, ask your web host for guidance. 1 Friday, May 30, 14
31. Look for a file called .htaccess 2 Create a backup of the file (easiest method is to download a local copy to your computer) Friday, May 30, 14
32. What if I don’t have one? First be sure that it is not hidden (an option in your SFTP/FTP client) If you are sure you don’t have one, then create a file called .htaccess 2b Friday, May 30, 14
33. Enter the following code on a new line: Options -Indexes 3 Friday, May 30, 14
34. Now save the file. Your SFTP/FTP client may ask you if you want to send changes to the remote server. You’ll need to accept these changes. 4 Friday, May 30, 14
35. Time to test your new code Friday, May 30, 14
36. Try this again… 1. Open your favorite web browser 2. Go to your website 3. Add /wp-content/uploads/ to the end of your website’s URL http://example.com  http://example.com/wp-content/uploads/ Friday, May 30, 14
37. What do you see this time? Friday, May 30, 14
38. Hopefully, you see something similar to this Friday, May 30, 14
39. If something has gone wrong and your website won’t load, don’t freak out – it takes a few seconds to get back on track. First, restore the backup of your .htaccess file. Then try the instructions again. Friday, May 30, 14
40. Here are some other cases where it won’t work: • Your webhost running Apache doesn’t allow .htaccess files. If this is true, then please leave this webhost today. • If you are using another server platform: Windows, NGINX, etc then contact me right now: hello@enzo12.com Friday, May 30, 14
41. The End Friday, May 30, 14
42. As you learned earlier in this presentation, Directory Browsing is a common option across many web hosts. It isn’t the fault of WordPress, Shopp, your Web Designer / Programmer or anyone else who made your online store a reality. From a business standpoint, it’s in the interests of web hosts to be compatible with as many web technologies as possible. Directory Browsing is simply an effect of this. Afterthoughts Friday, May 30, 14
43. If you found this presentation to be helpful, then please tell someone about it today! LinkedIn  linkedin.com/in/lorenzocaum Twitter  twitter.com/lorenzocaum Facebook  facebook.com/lorenzocaum Lorenzo Orlando Caum, Enzo12 LLC | hello@enzo12.com Friday, May 30, 14