Security is like a part of our life. We need to secure ourselves from others. In real life, we use keys to secure our house, car and many other things from unwanted visitors or unwanted persons, that maybe want to do something bad with our stuff. Same as your websites, in this case your blog. You also need to protect your blog from unwanted/bad visitors. You need to protect your information, data and any privacy you store on your website.
Follow these tips to secure your WordPress blog:
1. Use SSL Encryption to your website
With SSL encryption you can encrypt your data that is being sent. This will prevent someone from intercepting your data like account credentials by accessing the router. Your data will be very hard to read and hard to decrypt. To have SSL encryption you have to pay for it. There are lots of SSL encryption services out there, and they can assist you on how to install it. And for your WordPress blog, you can force your WordPress to always use SSL, add this line to your wp-config.php:
define('FORCE_SSL_ADMIN', true);2. Do not show unnecessary information to your visitors
Sometimes if you have an error then WordPress will automatically show you the error message. You can turn it off by adding this line to your theme’s function.php:
add_filter('login_errors',create_function('$a', "return null;"));3. Protect your wp-config.php file
Wp-config.php file stores your database connection string. This needs to be protected. Don’t allow anyone to see what is inside your wp-config.php. You can protect wp-config.php by using htaccess, add these lines to your .htaccess file:
<files wp-config.php>
order allow,deny
deny from all
</files>4. Hide your WordPress version
For a default installation, WordPress will show the WordPress version in your meta tags. This can be used by the attacker to know your WordPress version and find bugs to insert their malicious code into your blog. You can hide this WordPress version by adding this into your theme’s function.php:
<?php remove_action('wp_head', 'wp_generator'); ?>5. Blacklist spammers and bots!
I hate spammers! I believe you do too. Now I’m using the Disqus comment system to handle my comment system. Before I was getting 100 spams every day. This is annoying. Pay attention to your access_log, you can download it from the cPanel. See which IP is POSTing comments frequently, and block that IP! To block the IP you can use the .htaccess file, add this line:
<limit GET POST PUT>
order allow,deny
allow from all
deny from 123.456.789 #example ip
</limit>6. Use Disqus comment system to handle your comment system
Before I was getting 100 spams every day, this made me sick. Now I’m using the Disqus comment system. They can handle spams and your comments with their own bandwidth and resources. Open your account at Disqus and install their WordPress module, and you are done! No more spammers! 🙂
7. Prevent Script Injection
Script injection is mostly used by attackers to inject their unwanted script into your blog. Before someone attacks yours with this technique, you can prevent it by editing your .htaccess, add these lines:
Options +FollowSymLinks
RewriteEngine On
RewriteCond %{QUERY_STRING} (<|%3C).*script.*(>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|[|%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|[|%[0-9A-Z]{0,2})
RewriteRule ^(.*)$ index.php [F,L]8. Limit Your WP-Admin Access
Limit your WP-Admin access only from your IP and your co-authors’ IPs. This can limit access to your wp-admin only for your IP. Please don’t do this step if you don’t have a fixed IP or you travel a lot. Edit .htaccess to limit access to your wp-admin:
order deny, allow
allow from 127.0.0.1. #change to your static ip
deny from all9. Change The Default “Admin” Username
Before WordPress 3.0, the default user was admin, you couldn’t change it. But I suggest you change it. You can change your username by using phpMyAdmin. Open your phpMyAdmin and run this query:
UPDATE wp_users SET user_login = '[Your New Username]' WHERE user_login = 'Admin';10. Prevent directory browsing
As the default config, Apache will allow directory browsing. Don’t allow this. You can stop this by editing your .htaccess. Add these lines to prevent directory browsing in Apache:
Options -Indexes11. Protect your blog from bad queries from URL requests
If you pay attention to your access_log, sometimes you will see something strange with your URL request. That’s one technique of hacking. Insert a bad URL request to access your data in your website. This can be bad. You should take this seriously. To prevent this action, I have a plugin to block bad URL requests. All credits go to the respective owner:
<?php
/*
Plugin Name: Block Bad Queries
Plugin URI: http://perishablepress.com/press/2009/12/22/protect-wordpress-against-malicious-url-requests/
Description: Protect WordPress Against Malicious URL Requests
Author URI: http://perishablepress.com/
Author: Perishable Press
Version: 1.0
*/
global $user_ID;
if($user_ID) {
if(!current_user_can('level_10')) {
if (strlen($_SERVER['REQUEST_URI']) > 255 ||
strpos($_SERVER['REQUEST_URI'], "eval(") ||
strpos($_SERVER['REQUEST_URI'], "CONCAT") ||
strpos($_SERVER['REQUEST_URI'], "UNION+SELECT") ||
strpos($_SERVER['REQUEST_URI'], "base64")) {
@header("HTTP/1.1 414 Request-URI Too Long");
@header("Status: 414 Request-URI Too Long");
@header("Connection: Close");
@exit;
}
}
}
?>Save the code into a php file, for example block.php. And upload it into your wp-content/plugins folder. Then activate it from your WordPress Admin.