How to STOP HACKERS in Wordpress...

Well keep a strong username and have a password that only you know. Very strong password and also have the google autorization code plugin.
 
Advertise on BHW
Don't forget to disable xml-rpc. If you leave it enabled and your wordpress web site gets scanned, your website may be a part a malicious layer 7 ddos attack launched on some poor website.
 
It has limited uses, but the most effective way to secure Wordpress from bad login attempts is to block access to your wp-login file to everybody except the IP addresses that you use.

This is the code I added to .htaccess on one of my sites for it.

<Files wp-login.php>
order deny,allow
Deny from all
#whitelist work IP
allow from x.x.x.x
#whitelist home IP
allow from x.x.x.x

</files>

This way your weaklink in your sites security is no longer on wordpress, which every basic hacker tries to find open logins for. Now someone would have to find your hosting provider and hack into your hosting account / ftp account in order to gain access to your wordpress site.

Obviously this doesn't work if you want to run a membership wordpress site or if your IP changes so much it would become a pain to keep changing the IP in the .htaccess file.
 
Last edited:
I really needed this one. Need to be extra careful with those hackers. I really appreciate the other suggestions.
 
use proper validation of all table's field to avoid hacking from sql-injection.
 
Use this as one of the better measures against the common/routine (aka: newbie :)) hackers:
Code: 
https://wordpress.org/plugins/wp-denyhosts/
 
IM Tycoon said:
use proper validation of all table's field to avoid hacking from sql-injection.
Click to expand...

Are you talking about plugin development or by the end user? How does an end user / webmaster validate table fields?
 
bartosimpsonio said:
Are you talking about plugin development or by the end user? How does an end user / webmaster validate table fields?
Click to expand...
You have to do it in development. And most languages have a prepstatement function these days which is handy for building the SQL query.
 
Last edited:
Just some question

What about If I block my own country ip, do I need to change my ip in order to access to the admin.
 
Limiting access to the wordpress login page to specific ip addresses seems much better option to me than blocking hackers from specific country...it can be done easily with a few .htaccess changes


here is the code needed access by static ip addresses:


ErrorDocument 401 /path-to-your-site/index.php?error=404
ErrorDocument 403 /path-to-your-site/index.php?error=404


<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{REQUEST_URI} ^(.*)?wp-login\.php(.*)$ [OR]
RewriteCond %{REQUEST_URI} ^(.*)?wp-admin$
RewriteCond %{REMOTE_ADDR} !^Your IP$
RewriteRule ^(.*)$ - [R=403,L]
</IfModule>


/backup your entire site before proceeding/
 
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top