[GUIDE] Make your Wordpress blog Hackproof - A complete guide

@OP
I have never heard of that "Point 6". I'll test that on a development site.
Thank you!


Go through these three easy steps and secure your WordPress installation even more:
1. If you have TimThumb.php file in your theme use TimThumb vulnerability scanner plugin.
2. Use Wordfence plugin and set the login limit to "2 attempts over 5 minutes" also enable "Immediately lock out invalid usernames" and "Don't let WordPress reveal valid users in login errors." in Wordfence options.
3. Secure your WordPress login by adding this in your .htaccess
#PROTECT WP-CONFIG.PHP
<Files wp-login.php>
Order deny,allow
Deny from All
Allow from xxx.xxx.xxx.xxx
</Files>
Click to expand...
 
Advertise on BHW
This will not protect your worpress, maybe only from.people who follow a tuto on youtube. First you need to put the right permission for ever kind of file, static file only read for all, php script only read for root (if you use php cgi or fast cgi).
After you have to stop ever shared hosting vulnerabilty, if you use a shared hosting server, otherwise with one website compromise the hacker can symlink all other website config.php
After there is a lot of php security option to enable like safemode ect...
After with the rewrite mod you can stop almost every sql injection
The best solution is to make an audit of the code you use, otherwise there is very simple script who make a checksum of all all script and warn you if there is change.

If its your own server put an waf like modsecurity with owasp rule
Dont forget to backup and to check you log when you have time

The way the get inside is file injection, sql injection, password too simple
Change the default admin user, put an username not guessable and make worpress to not show your username but an other name instead.

Always update lol and be very carefull with the email you receive.because ever wordpress even the updated one is vulnerable to csrf that mine if you are logged in and if you receive an malicious email, tha hacker can do manage your wordpress with your token

Heheh
 
I forgot

Dont use your same password on mysql ftp email et wordpress admin
If its your own server erase bash history(linux)
Static file permission 004
Php file permisson 400
This is the most secure file permission BUT it will not work with every hosting provider


Folder permission 001
For people who dont have time take a look
Crawlprotect
 
Finally I was able to get rid of 'authentication required' popup on every page (after following tip#6).
Thank you.
 
AnotherOne said:
Finally I was able to get rid of 'authentication required' popup on every page (after following tip#6).
Thank you.
Click to expand...
I am glad I could help :-)
 
I would only add that you can move your wp-config.php file up one level above public_html folder as Wordpress will look for it there as well and it is more secure. Also, add recaptcha to posts as well as admin login.
 
stratocentric said:
I would only add that you can move your wp-config.php file up one level above public_html folder as Wordpress will look for it there as well and it is more secure. Also, add recaptcha to posts as well as admin login.
Click to expand...

I will try the wp-config suggestion out. Thanks :)
 
Thanks.

Also be weary of downloading cracked themes/plugins, as some have been found to include backdoors/links to unsavory sites.

Stay safe y'all!
 
Been using # 1, 3, 4, 6. Gonna try the other ones:cool: Thanks for putting it all together, great pieces of advice!
 
A lot of thanks for such useful information. I'm going to make a WP blog so I'll use all these advices with great pleasure.
 
Thanks everyone for the overwhelming response :)
I will definitely put up something on Wordpress in the upcoming weekend. Cheers :)
 
Thank you so much for this guide. I had over 40 wordpress websites hosted on GoDaddy, all of them had code injected into the header. That was a very aggravating thing to deal with, and it could have been prevented. When I looked it up it seemed to be a common problem for self-hosted WP sites on GoDaddy web hosting. I don't know, but it's definitely smart to secure your wordpress website because you never know what can happen.
 
Create .htaccess file in wp-admin directory with the following content:

Order Deny,Allow
Allow from YOUR IP
Deny from all


[h=2]Valid IP Addresses[/h] IP addresses are in the form xxx.xxx.xxx.xxx and each of these four numbers is from 0-255.
You can enter partial addresses to restrict larger blocks of addresses:
1.2.3.4Blocks one specific IP address
1.2.3.Blocks IP address in the range 1.2.3.0 to 1.2.3.255 (ie.. 1.2.3.xxx)
1.2.Blocks IP address in the range 1.2.xxx.xxx
1.2Blocks IP address in the range 1.2xx.xxx.xxx
 
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top