{"id":12804,"date":"2014-09-02T17:51:22","date_gmt":"2014-09-03T00:51:22","guid":{"rendered":"http:\/\/rosalindgardner.com\/blog\/?p=12804"},"modified":"2019-02-22T16:48:20","modified_gmt":"2019-02-23T00:48:20","slug":"12-wordpress-security-tips","status":"publish","type":"post","link":"https:\/\/rosalindgardner.com\/blog\/12-wordpress-security-tips\/","title":{"rendered":"12 WordPress Security Tips"},"content":{"rendered":"

A reader asked for tips on how to secure his WordPress blog against hackers. After thinking about and listing all the things I do to keep my blogs secure, I did some online research to see where my actions fell short.<\/p>\n

Turned out that my blogs were well-protected, but I did adopt some additional\u00c2\u00a0security measures that\u00c2\u00a0I learned from other\u00c2\u00a0Wordpress bloggers.<\/p>\n

Now I pass all those tips on to you…<\/p>\n

    \n
      \n
    1. \n

      Do NOT use ‘admin' as your username<\/h3>\n

      In April 2013, thousands of WordPress sites with ‘admin' as the administrator username were compromised via large-scale brute force attacks. The hosting service HostGator<\/a>, reported that they had “seen over 90,000 IP addresses involved in this attack”. In response, WordPress founder Matt Mullenweg urged all those with ‘admin' as their usernames to change them immediately.<\/p>\n

      Since then, WordPress no longer suggests \/ pre-populates the username form blank with ‘admin' as the default username for administrators.<\/p>\n

      However, if you started your blog prior to WordPress 3.0, and still have ‘admin' as your username… it is time to change it!<\/p>\n

      How to change your username<\/strong><\/p>\n

        \n
      1. Login to your administrative user account.<\/li>\n
      2. Navigate to Users > Add New and fill in all the details for a new user account. Choose a username and set the privileges to Administrator.<\/li>\n
      3. Now log out of your ‘admin' user account and log back in using your new user account.<\/li>\n
      4. Go to Users and delete the old \u00e2\u20ac\u0153admin\u00e2\u20ac\u009d account. WordPress will prompt you to reassign all the posts associated with ‘admin' to another account. Choose your new account from the drop down list… and you're set!<\/li>\n<\/ol>\n<\/li>\n
      5. \n

        Hide your username<\/h3>\n

        WordPress displays your username in the URL of your author archive page. So, once you've changed your username, make sure it can't be found by changing your nickname in your user profile.<\/p>\n

        \"wp-nickname\"<\/li>\n

      6. \n

        Use a strong password<\/h3>\n

        Did you know that the second most common password is ‘password'?<\/p>\n

        UGH!<\/p>\n

        WordPress comes with a built-in password strength indicator. Make sure your password indicates ‘STRONG' and that you follow the hint included alongside the password change area:<\/p>\n

        “Hint: The password should be at least seven characters long. To make it stronger, use upper and lower case letters, numbers, and symbols like ! ” ? $ % ^ & ).”<\/p>\n

        \"wp-password\"<\/li>\n

      7. \n

        Use the latest version of WordPress<\/h3>\n

        WordPress is frequently updated<\/a> to fix security issues such as unintentional information disclosure and brute attacks.<\/p>\n

        Many hosting service providers will update blogs on their servers to the latest version of WordPress automatically.<\/p>\n

        If yours does not, or you happen to notice that a new version is available, simply update to the latest version yourself.<\/li>\n

      8. \n

        Keep plugins up-to-date<\/h3>\n

        In mid-July 2014, Sucuri<\/a> reporting about a security hole in WPTouch stated “During a routine audit for our WAF, we discovered a very dangerous vulnerability that could potentially allow a user with no administrative privileges, who was logged in (like a subscriber or an author), to upload PHP files to the target server. Someone with bad intentions could upload PHP backdoors or other malicious malware and basically take over the site.”.<\/p>\n

        Just like the WordPress platform itself, plugins are regularly updated by their developers to improve functionality and to plug security holes. Take action whenever you see that a plugin update is available.<\/p>\n

        \"wp-update-plugins\"<\/li>\n

      9. \n

        Delete unused themes and plugins<\/h3>\n

        Security (see above) is the primary reason to delete unused plugins and themes.<\/p>\n

        In addition, removing unused plugins and themes reduces the size of your backups and may even slightly enhance your blog's performance.<\/p>\n

        \"wp-delete-plugins\"<\/li>\n

      10. \n

        Limit login attempts<\/h3>\n

        Hackers frequently use a malicious script to repeatedly guess passwords in an attempt to discover the correct one.<\/p>\n

        Apple has reported<\/a> that this was the reason many celebrities nude photos were stolen from their iCloud accounts and then leaked publicly…”After more than 40 hours of investigation, we have discovered that certain celebrity accounts were compromised by a very targeted attack on user names, passwords and security questions, a practice that has become all too common on the Internet.”<\/p>\n

        Nude photos or not, you don't want anyone to guess your password and hack into your administrative account on WordPress.<\/p>\n

        One way to thwart hackers is to limit the number of times users can try to login. After the limit is reached, the user is locked out for a specified period of time.<\/p>\n

        Moreover, you can block IP addresses of those who repeatedly try to login without success.<\/li>\n

      11. \n

        Limit registration of members<\/h3>\n

        Remember the dangers associated with subscribers mentioned in #5 above, i.e. “allow a user with no administrative privileges, who was logged in (like a subscriber or an author)?<\/p>\n

        Unless you are running a membership site<\/a> or a forum, you really don't need to allow member registration of any sort on your WordPress site. <\/p>\n

        I personally add users who are guest bloggers and give them the role of Contributor.<\/p>\n

        Otherwise, no one is allowed to register as a member on this blog.<\/li>\n

      12. \n

        Use a security plugin<\/h3>\n

        I use Wordfence<\/a> which is free.<\/p>\n

        Wordfence starts by checking if your site is already infected.<\/p>\n

        Here is a graphic of problems it found with my blog when I originally installed the plugin…<\/p>\n