[GUIDE] Make your Wordpress blog Hackproof - A complete guide

As I said before, it is a pain in ass when you have a dynamic IP (like I do) / want to access the admin from your mobile or from your office .. It's a great trick if you have a static IP though
N1ckG2 said:
Create .htaccess file in wp-admin directory with the following content:

Order Deny,Allow
Allow from YOUR IP
Deny from all


Valid IP Addresses

IP addresses are in the form xxx.xxx.xxx.xxx and each of these four numbers is from 0-255.
You can enter partial addresses to restrict larger blocks of addresses:
1.2.3.4Blocks one specific IP address
1.2.3.Blocks IP address in the range 1.2.3.0 to 1.2.3.255 (ie.. 1.2.3.xxx)
1.2.Blocks IP address in the range 1.2.xxx.xxx
1.2Blocks IP address in the range 1.2xx.xxx.xxx
Click to expand...
 
Advertise on BHW
If i were you, then would access my sites via proxy - static private ip address. Yes it cost money, but restful sleep comes with a price.
 
I will have to have a look for the plugin; 'Login LockDown'. It looks good, I will install it, thanks for sharing!
 
This is exactly what I have been looking for. Thanks a lot for posting this guide! I've done the steps so hopefully my website will be secured!
 
Glad I could help :)
aspe_heat said:
This is exactly what I have been looking for. Thanks a lot for posting this guide! I've done the steps so hopefully my website will be secured!
Click to expand...
 
I've been using login lockdown since last year and it must've blocked more than a dozen of bruteforce attempts so far.
The .htpasswd trick is golden though, never tought about this!
 
TimThumb vulnerability issue (in themes) is rising again :|
Install the TimThumb vulnerability scanner plugin and set it's 'update frequency' to 24 hours.


P.S
You must spread some Reputation around before giving it to g0g0l again. :(
 
try using the plugin "Better WP Security". It covers almost all security aspects inside a wp install.
 
This is because they did not fix the vulnerability properly. Now a days, you could do RFI from a subdomain having the vulnerable domain name. As for example, if you have
vulnerable.com as you domain, a hacker could upload a file from vulnerable.hackingdomain.com.


My suggestion is to not use the timthumb script atall. There's a custom WP function called "vt_resize" function that can resize images dynamically. Use that one instead of timthumb. Google it for more..

AnotherOne said:
TimThumb vulnerability issue (in themes) is rising again :|
Install the TimThumb vulnerability scanner plugin and set it's 'update frequency' to 24 hours.


P.S
You must spread some Reputation around before giving it to g0g0l again. :(
Click to expand...
 
hackerzonline said:
try using the plugin "Better WP Security". It covers almost all security aspects inside a wp install.
Click to expand...

I also found this plugin very useful but I recommend to make a full backup before modifying all WP settings it suggests.
 
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top