Securing Wordpress blog

Talk presented at Day 1 of Wordcamp baroda.

Transcript

1. View Slide

2. Android & WP7 Developer @Digicorp
   Wordpress blogger
   Head, Google Developers Group Ahmedabad
   @pareshmayani
   www.TechnoTalkative.com
   Who am I?
   

   View Slide

3. Oops….Congratulations??
   

   View Slide

4. Oops….Congratulations??
   

   View Slide

5. Common sense
   • Secure password
   • Keep Wordpress & plugins up-to-date
   • Delete unused files
   • Use a reputable web host
   • Clean your site/blog like you clean your house
   

   View Slide

6. Update, update & updates !!
   

   View Slide

7. Delete unused files
   • Delete unused themes
   • Delete unused plugins
   

   View Slide

8. Some security Steps
   1. Regular backups are best friend
   2. Change table prefix
   3. Proper file & folder permissions
   4. Use secret keys
   5. Protect your wp-config.php file
   6. Protect your .htaccess file
   7. Remove the admin account
   8. Do not advertise your WordPress version to the world
   9. Limit the number of login attempts
   10. Prevent users from browsing your Wordpress directories
   11. Use security plugins
   

   View Slide

9. 1. Regular backups are best friend
   • Take backups
   • plug-ins available
   – BackUpWordPress
   http://wordpress.org/extend/plugins/b
   ackupwordpres/
   – BackWPup
   http://wordpress.org/extend/plugins/b
   ackwpup/
   

   View Slide

10. 2. Change Table Prefix
    • Default table prefix is wp_
    • Change the table prefix (wp_) to some random value.
    

    View Slide

11. 2. Change Table Prefix
    Steps:
    1. Open wp-config.php and change
    $table_prefix = 'wp_wordcamp';
    2. Change all database table name with this prefix (through
    phpmyadmin)
    

    View Slide

12. 3. Proper Files & Folder permissions
    • Give users a minimal required access
    • Set file permissions at 644 & folders at 755
    4 read
    2 write
    1 execute
    For example:
    • 755 (rwxr-xr-x)
    • 644 (rw-r–r–)
    

    View Slide

13. 4. Use secure keys
    • To increase the security of passwords stored in your
    WordPress database, you should ensure that your wp-
    config.php file has unique values.
    • Step: Generate unique keys through
    https://api.wordpress.org/secret-key/1.1/
    https://api.wordpress.org/secret-key/1.1/salt/
    

    View Slide

14. 5. Protect your wp-config.php file
    Steps:
    1. Open .htaccess file
    2. Include below code:
    
    order allow,deny
    deny from all
    
    

    View Slide

15. 6. Protect your .htaccess file
    Steps:
    1. Open .htaccess file
    2. Include below code:
    
    order allow,deny
    deny from all
    
    

    View Slide

16. 7. Remove the admin account
    • The default account created for you in wordpress is admin
    • Steps:
    1. Create a new user with Administrator permissions
    2. Log out and then log back into wordpress with the new
    user you created
    3. Delete the admin user account
    4. When it asks you want to do with posts attributed to
    admin, select the user you created
    

    View Slide

17. 8. Delete Wordpress version
    • WordPress sites always publish the version number thus
    making it easier for people to determine if you are running
    an outdated non-patched version of WordPress.
    Step:
    Include this line into functions.php:
    remove_action('wp_head', 'wp_generator');
    

    View Slide

18. 9. Limit the number of login attempts
    • Limit Login Attempts
    – http://wordpress.org/extend/plugins/li
    mit-login-attempts/
    • Login LockDown
    – http://wordpress.org/extend/plugins/lo
    gin-lockdown/
    

    View Slide

19. 10. Prevent users from browsing
    Steps:
    1. Open .htaccess file
    2. Include Options -Indexes
    

    View Slide

20. 11. Use Security plug-ins
    • Better WP Security
    – http://wordpress.org/extend/plugins/better-wp-security/
    • BulletProof Security
    – http://wordpress.org/extend/plugins/bulletproof-security/
    

    View Slide

21. Get in Touch
    twitter.com/pareshmayani
    fb.com/GDGAhmedabad
    http://gplus.to/GDGAhmedabad
    www.TechnoTalkative.com
    gplus.to/paresh.mayani
    

    View Slide