Are your protecting your WordPress website from attacks?
With the popularity of WordPress, and the support it gets from the development team, it’s easy to think that your installation of WordPress is secure. Since you didn’t code it from scratch, you might assume that it is hardened and you don’t have to do any further tinkering with security. Well, you may just want to put some effort into locking down your WordPress installation.
There are several methods that are generally used in an attack on a website. First you have mis-configurations. This can mean everything from leaving the ‘wp-config’ file readable to the world to allowing any kind of file to be uploaded in a form to weak password security. The second type of access can usually be gained through bad coding techniques. If you add a Plugin or write your own code to add to the WordPress installation, this can possible allow and attacker to take advantage of bad code to break into your site. And lastly you have can lump other attacks into infrastructure attacks. Maybe you don’t have a firewall running, or intrusion prevention service running to stop attacks. Or you are hosting you website on a shared service like Godaddy or Hostgator and someone else’s website is vulnerable, leading to a compromise of the whole hosted server.
For now, lets address some easy things you can do to reduce configuration weaknesses that could lead to a hacked website.
1) Password – no matter how many times you say it, people still use weak passwords that can be guessed or broken with brute force attacks. There are several free and paid login protection plugins you can use. Here is “Simple Login Lockdown” which can block access attempts after several failed attempts.
2) File Permissions – this is a bit trickier if you do not know how file permissions works. You can get an easy primer from the WordPress help file, http://codex.wordpress.org/Hardening_WordPress Its also provide a lots of details for the more technically savvy. Key directories that need to be locked down include:
/
/wp-admin/
/wp-includes/
/wp-content/
/wp-content/themes/
/wp-content/plugins/
Here is an example of a more robust tool that can do multiple things, including monitoring access and monitoring file changes, “Bulletproof” http://www.ait-pro.com/
3) Monitoring – you should know what is going one with access attempts or changes in your files and configurations of your WordPress site. There are a number of tools you can search for monitoring and logging activity. Here is a tool that can help you with the file permissions, “Better Wp Security” from Bit51.com
4) Security Testing – even if you have installed security plugins and have configured your website correctly, you should still periodically test the security for vulnerabilities. You can pay third party companies to do penetration testing or you can try some of the plugins on your own. Here is an example of a plugin that you might use, we do not validate how well these perform, but show you the options. This example is “Cloudsafe365” http://www.cloudsafe365.com/
There are lots of different tools you can use to secure your site. The first step is to know that it will not stay secure without you actively implementing security measures.
Gary Bahadur
“Securing the Clicks: Network Security in the Age of Social Media”