First, fuck those who hack our blogs.
Second of all. Here's my guide to protect your WP. I hope i forgot nothing.
plugins:
|
V
---------------------------------------------------------
.htaccess(if using Apache of course) that goes into wp-admin directory
|
V
--------------------------------------------------------
!!addition!! to .htaccess in root directory that secures the wp-includes (append in end of .htaccess file)
|
V
---------------------------------------------------------
next:
goto Dashboard->Users->Profile.
Setup a nickname(don't use the default "admin"!!!)
change the "Display name publicly as" to the nickname you set up
---------------------------------------------------------
Go through all the new plugins, see what they have to say, change table prefix(wp security plugin does that). Don't let the username to be default "admin"!
(p.s. if the wp is installed in folder and not in domain root-you need to change the "/" in the .htaccess files to your folder path)
(p.p.s. drop an empty index.html in wp-content/plugins/)
(google for solution to "secure wp-admin with password")
-----------------------------------------------------------------------------------------------------
And the recent 0day shit. Btw, whoever is using Gazette theme, or those WooThemes, are AFFECTED!
|
V
Seatch for the files named thumb.php or timthumb.php. If you find- look inside for "allowedsites", remove all the domains from the array, including the couple of lines below, remove all inside the "( )", so it looks like $allowedSites = array();
Second of all. Here's my guide to protect your WP. I hope i forgot nothing.
plugins:
|
V
Code:
Block Bad Queries (BBQ)
Login LockDown
Wordpress Firewall 2
WP Security Scan
WP Updates Notifier
TAC (Theme Authenticity Checker)
WordPress File Monitor.htaccess(if using Apache of course) that goes into wp-admin directory
|
V
Code:
# BEGIN WordPress
RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]#
END WordPress!!addition!! to .htaccess in root directory that secures the wp-includes (append in end of .htaccess file)
|
V
Code:
# Block the include-only files.
RewriteEngine On
RewriteBase /
RewriteRule ^wp-admin/includes/ - [F,L]
RewriteRule !^wp-includes/ - [S=3]
RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
RewriteRule ^wp-includes/theme-compat/ - [F,L]
# END BLOCKnext:
goto Dashboard->Users->Profile.
Setup a nickname(don't use the default "admin"!!!)
change the "Display name publicly as" to the nickname you set up
---------------------------------------------------------
Go through all the new plugins, see what they have to say, change table prefix(wp security plugin does that). Don't let the username to be default "admin"!
(p.s. if the wp is installed in folder and not in domain root-you need to change the "/" in the .htaccess files to your folder path)
(p.p.s. drop an empty index.html in wp-content/plugins/)
(google for solution to "secure wp-admin with password")
-----------------------------------------------------------------------------------------------------
And the recent 0day shit. Btw, whoever is using Gazette theme, or those WooThemes, are AFFECTED!
|
V
Seatch for the files named thumb.php or timthumb.php. If you find- look inside for "allowedsites", remove all the domains from the array, including the couple of lines below, remove all inside the "( )", so it looks like $allowedSites = array();
Last edited:
And the .htaccess in wp-admin would not even exist by default i guess.
