Web Hosting Talk : Web Hosting Main Forums : Hosting Security and Technology : How Secure are your WordPress Installations?

[solidhostingph]

There have been several hacking incidents lately and the targets are WordPress. Share your experience in securing WP installations.

[MikeDVB]

Originally Posted by solidhostingph

There have been several hacking incidents lately and the targets are WordPress. Share your experience in securing WP installations.

This is nothing new, one of the most important things you can do is keeping WordPress itself and all plugins updated and to physically remove any plugins you're not actually using (and not just "disabling" them).

[CI-Andrew]

Originally Posted by MikeDVB

This is nothing new, one of the most important things you can do is keeping WordPress itself and all plugins updated and to physically remove any plugins you're not actually using (and not just "disabling" them).

Completely agree, just keep your WP installations up to date and have secure passwords.

[uzair21]

I have WP-Firewall Installed. I don't know how much protection it really gives but I have never been hacked.

[JulesR]

For personal installations, I always IP restrict the wp-admin folder to myself only via a .htaccess file. This provides a huge amount of protection.

The rest is pretty much common sense; keep Wordpress up to date, keep plugins up to date. Keep plugin usage down to a minimum, as the more you have the greater the likelihood that one of them is exploitable.

[craig joe]

i just updated to latest wp, and now try to update cpanel etc...

don't forget to harden the password

[servermanaged]

@uzair21 wp-firewall works with wp 3?

[Ankheg]

Add .htaccess rules to block all POST requests with an empty referrer. This will stop a lot of comment/pingback spam, and also at least some of the exploit tools out there.

[srider]

Originally Posted by Ankheg

Add .htaccess rules to block all POST requests with an empty referrer. This will stop a lot of comment/pingback spam, and also at least some of the exploit tools out there.

Hey, that's brilliant! Unfortunately mod_rewrite has a tendency to make my head asplode, but I'll ask around about syntax for this.

[Ankheg]

This is the pertinent bit of the .htaccess file we give customers:

SetEnvIf User-Agent ^$ zeroref=yes
SetEnvIf Referer "^$" zeroref=yes
SetEnvIf Referer "-$" zeroref=yes

<Limit POST>
Order allow,deny
allow from all
deny from env=zeroref
</Limit>

There are undoubtedly more elegant solutions, but this has worked well for us since the days of Wordpress 1.whatever.

[TexasCrane]

Change the default database prefix. Move wp-config.php up one directory. Don't have an "admin" account and make sure that your log-in username doesn't match the display name on your posts. If you access your site over unsecured wifi, then make sure you have https enabled for admin or connect through a vpn.

[srider]

Originally Posted by Ankheg

This is the pertinent bit of the .htaccess file we give customers:

SetEnvIf User-Agent ^$ zeroref=yes
SetEnvIf Referer "^$" zeroref=yes
SetEnvIf Referer "-$" zeroref=yes

<Limit POST>
Order allow,deny
allow from all
deny from env=zeroref
</Limit>

I've just installed this snippet on over a dozen blogs on my servers. I also use a similar rule set that denies GET or POST based on a list of bad bot user agent strings. I found that inserting your code below that other code does not break anything for human users who have not tweaked their browsers so they send no UA information.

Sure, there are lots of silly posts here on WHT sometimes, and some amazingly bold would be fraudsters, so messages like yours that help the community help offset the loser posts.

Thank you very much.

[speckl]

I am not a fan of WP at all because of this very reason. Sure WP works great, but too many WP sites are just online and not updated ever. Since WP is one of the top website platforms, it is targeted heavily. If you don't know how to secure a WP installation properly, your website will be targeted and potentially destroyed.

Last month I had to fetch 3 backups due to hack attempts that succeeded. (Not my sites, but for clients I provide backup service for).

[solidhostingph]

@speckl: that's why we have this thread. we want others to share their experience in securing WP installations for the benefit of all.