GoFuckYourself.com - Adult Webmaster Forum - wordpress tip: secure your wordpress blogs

- Fucking Around & Business Discussion (https://gfy.com/forumdisplay.php?f=26)

- - wordpress tip: secure your wordpress blogs (https://gfy.com/showthread.php?t=880971)

wordpress tip: secure your wordpress blogs

Hackers are people too.

Unfortunately, they're the wrong type of people; the ones who'll look for
ways to break a site and suck all your hard work into oblivion, all
because their imaginary girlfriend dumped them for a PlayStation 3 while
they were busy zapping goblins with their level 32 Warlock.

If you're using the latest version of WordPress, you're already more
secure than many, but there are still ways to be safer.

Use these 5 tips to keep your self-hosted WordPress site safe. Note: most
of these tips apply to general web development too.

1. Protect your plugin directory

Showing which plugins you have installed can expose an exploit in an
outdated plugin, and is an easy target for hackers to gain access to your
site or even worse your server.

Solution:

Create an index.html file and upload it to your /wp-content/plugins/
directory.

2. Don't expose your wordpress version

Its best to remove your wordpress version string from your theme.

If you let people know what version you are running, you can be an easy
target if you are running an older version of wordpress.

Solution:

Look for and remove this line from your themes header.php file.

Code:

<meta name="generator" content="WordPress <?php bloginfo('version'); ?>" />

3. Protect your wordpress files from search engines.

Its best if you don't have any of your core wordpress files indexed by
search engines.

Solution: add the following to your robots.txt

Code:

Disallow: /wp-*

4. Protect your wordpress admin folder.

Limiting you wordpress admin by ip address will give anyone but you or
any staff members access to your admin.

If any unauthorized people try and access your admin will be sent a
forbidden 403 error.

solution: add a .htaccess to your /wp-admin directory (not your root)

Code:

order deny,allow

deny from all

allow from 216.17.172.11 (by ip address)

allow from .fris.sprint.ca (by domain)

5. Permissions, Permissions, Permissions.

Using the correct permissions on your wordpress install is a must,
especially if you are on a shared server.

All your folder permissions should be set to 755, and files should be set
to 644.

Alternatively if you want to edit your theme in the wordpress editor, use
666.

Never use 777 for wordpress permissions, if you do, you're letting all
users on the server do what they want with the site.

On a shared or badly configured server this can mean chaos.

---

On another note I found this password manager that is free and I use it
daily. It has been mentioned on NBC, and PC Magazine.

They have a desktop version and a web version

http://www.passpack.com/en/home/

Sorry if it was long, but its important.

:thumbsup

Great post! :thumbsup

Very nice post. Thanks. I bookmark this.

Good stuff as always Fris

Thanks Fris, good info

Quote:

Originally Posted by fris (Post 15315616)

Code:

<meta name="generator" content="WordPress <?php bloginfo('version'); ?>" />

3. Protect your wordpress files from search engines.

Its best if you don't have any of your core wordpress files indexed by
search engines.

Solution: add the following to your robots.txt

Code:

Disallow: /wp-*

Code:

order deny,allow

deny from all

allow from 216.17.172.11 (by ip address)

allow from .fris.sprint.ca (by domain)

fris!,

Since afew days i was thinkin to contact You for something,

May i get Your icq?
:thumbsup

Great advice. I wish I could set this to auto-subscribe to all threads you start :)

u deserve rep for this ...lol ... good post m8 :)

a nice one once again :)

Great post :thumbsup

hey frissy, stop plagiarizing and start posting reference links to the places you're scraping content from

http://wordprezzie.com/wordpress-security-tips/

thank you wordpress ninja!

good tips and will use...

thanks

Quote:

Originally Posted by kmanrox (Post 15316602)

hey frissy, stop plagiarizing and start posting reference links to the places you're scraping content from

http://wordprezzie.com/wordpress-security-tips/

I never said i wrote it, im just gathering informaiton for people to use.

but thanks for pointing out that I should have linked that article.

:thumbsup

thanks man.

didn't have the dissallow wp- part

now i do.

good lookin out.

Great tips to implement!

:thumbsup:thumbsup I know im changeing things up on my blogs thans for the great tips

I'd go with RoboForm in lieu of PassPack. With Roboform you keep the passwords on your local machine. I think people are way too trusting of these web apps.

finally a useful post!

This is an awesome post.

That is useful! Thank you!

bump as i found out i fucked up on a certain part....

Good post for those whom do not know. :thumbsup

Important yet so simple. Thank you for excellent tips!

Where you reading my source code again?

Just a warning!!!

If you use .htaccess to restrict access to the WordPress directory and you are running Super Cache or one of the other cache plugins your site will be messed up. So you may want to skip that step.