About a month ago, this WordPress blog was hacked. And since my other websites like ctrlq.org and hundredzeros.com are hosted on the same web server, the hacker successfully managed to wipe off all these sites from the Internet as well.
The web hosting company says that it could have happened because one of the sites was running an older version of WordPress. The passwords weren’t compromised though as all the login activity happened from known IP addresses. It was a tough period but fortunately, the deleted sites have been restored and the traffic is also back to normal.
Here’s a list of changes I have done to improve the security of my WordPress blogs though the perpetual worry that such a thing can happen again will remain.
You can actually create a completely random (hard to guess) username and then use your email address to log into WordPress. The plugin WP-Email Login will add support for email based usernames in the WordPress login form.
It is easy to remove the WordPress version from page but you need to make one more change. Delete the readme.html file from your WordPress installation directory as it also advertises your WordPress version to the world.
These random salts make your stored WordPress passwords more secure and the other advantage is that if someone is logged into WordPress without your knowledge, they will get logged out immediately as their cookies will become invalid now.
To enable error logging in WordPress, add the following code to your wp-config.php file and remember to replace /path/to/error.log with the actual path of your log file. The error.log file should be placed in a folder not accessible from the browser (reference).
Also, the following command will show the user login activity for a longer period of time grouped by IP addresses (replace USERNAME with your shell user name).
The web hosting company says that it could have happened because one of the sites was running an older version of WordPress. The passwords weren’t compromised though as all the login activity happened from known IP addresses. It was a tough period but fortunately, the deleted sites have been restored and the traffic is also back to normal.
Here’s a list of changes I have done to improve the security of my WordPress blogs though the perpetual worry that such a thing can happen again will remain.#1. Login with your email address
When you install a WordPress blog, the first user is called “admin” by default. You should create a different user to manage your WordPress blog and either remove the “admin” user or change the role from “administrator” to “subscriber.”You can actually create a completely random (hard to guess) username and then use your email address to log into WordPress. The plugin WP-Email Login will add support for email based usernames in the WordPress login form.
#2. Do not advertise your WordPress version to the world
WordPress sites always publish the version number thus making it easier for people to determine if you are running an outdated non-patched version of WordPress.It is easy to remove the WordPress version from page but you need to make one more change. Delete the readme.html file from your WordPress installation directory as it also advertises your WordPress version to the world.
#3. Don’t let others “Write” to your WordPress directory
Login to your WordPress Linux shell and execute the following command to get a list of all “open” directories where any other user can write files.find . -type d -perm -o=wYou may also want to execute the following two commands in your shell to set the right permissions for all your WordPress files and folders (reference).
find /your/wordpress/folder/ -type d -exec chmod 755 {} \;
find /your/wordpress/folder/ -type f -exec chmod 644 {} \;For directories, 755 (rwxr-xr-x) means that only the owner has write permission while others have read and execute permissions. For files, 644 (rw-r–r–) means that file owners have read and write permissions while others can only read the files.#4. Rename your WordPress tables prefix
If you have installed WordPress using the default options, your WordPress tables have names like wp_posts or wp_users. It is thus a good idea to change the prefix of tables (wp_) to some random value. The Change DB Prefix plugin lets you rename your table prefix to any other string with a click.#5. Prevent users from browsing your WordPress directories
This is important. Open the .htaccess file in your WordPress root directory and add the following line at the top.Options -IndexesIt will prevent the outside world from seeing a listing of files available in your directories in case the default index.html or index.php files are absent from those directories.
#6. Update the WordPress Security Keys
Go here to generate six security keys for your WordPress blog. Open the wp-config.php file inside the WordPress directory and overwrite the default keys with the new ones.These random salts make your stored WordPress passwords more secure and the other advantage is that if someone is logged into WordPress without your knowledge, they will get logged out immediately as their cookies will become invalid now.
#7. Keep a log of WordPress PHP and Database errors
The error logs can sometimes offer strong hints on what kind of invalid database queries and file requests are hitting your WordPress installation. I prefer the Error Log Monitor as it periodically sends the error logs by email and also displays them as a widget inside your WordPress dashboard.To enable error logging in WordPress, add the following code to your wp-config.php file and remember to replace /path/to/error.log with the actual path of your log file. The error.log file should be placed in a folder not accessible from the browser (reference).
define('WP_DEBUG', true);
if (WP_DEBUG) {
define('WP_DEBUG_DISPLAY', false);
@ini_set('log_errors', 'On');
@ini_set('display_errors', 'Off');
@ini_set('error_log', '/path/to/error.log');
}#9. Password Protect the Admin Dashboard
It is always a good idea to password protect the wp-admin folder of your WordPress since none of the files in this area are intended for people who are visiting your public WordPress website. Once protected, even authorized users will have to enter two passwords to log in to their WordPress Admin dashboard.10. Track login activity on your WordPress server
You can use the “last -i” command in Linux to get a listing of all users who have logged into your WordPress server along with their IP addresses. If you find an unknown IP address in this list, it is definitely time to change your password.Also, the following command will show the user login activity for a longer period of time grouped by IP addresses (replace USERNAME with your shell user name).
last -if /var/log/wtmp.1 | grep USERNAME | awk '{print $3}' | sort | uniq -cMonitor your WordPress with Plugins
The WordPress.org repository contains quite a few good security related plugins that will continuously monitor your WordPress site for intrusions and other suspicious activity. Here are the essential ones that I would recommend.- Exploit Scanner – It will quickly scan all your WordPress files and blog posts and list the ones that may have malicious code. Spam links may be hidden in your WordPress blog posts using CSS or IFRAMES and the plugin will detect them as well.
- WordFence Security – This is an extremely powerful security plugin that you should have. It will compare your WordPress core files with the original files in the repository so any modifications are instantly detected. Also, the plugin will lock out users after ‘n’ number of unsuccessful login attempts.
- WordPress Sentinel – Another useful plugin that monitors your WordPress files and alerts you whenever files are added, deleted and edited in any of the watched folders.
- WP Notifier – If you don’t login to your WordPress Admin dashboard too often, this plugin is for you. It will send you email alerts whenever new updates are available for the installed themes, plugins and core WordPress.
- VIP Scanner – The “official” security plugin will scan your WordPress themes for any problems. It will also detect any advertising code that may have been injected into your WordPress templates.
find . -type f -mtime -3 | grep -v "/Maildir/" | grep -v "/logs/"
Secure your WordPress Login Page
Your WordPress login page is accessible to the world but if you wish to prevent non-authorized users from logging into WordPress, you have three choices.- Password Protect with .htaccess – This involves protecting the wp-admin folder of your WordPress with a username and password in addition to your regular WordPress credentials.
- Google Authenticator – This excellent plugin adds two-step verification to your WordPress blog similar to your Google Account. You’ll have to enter the password and also the time-dependent code generated on your mobile phone.
- Login Dongle – This plugin takes a very unique approach to protect your WordPress. It generates a bookmarklet with a secret question that you can add to you bookmarks. While on the WordPress login page, enter you credentials and then press this bookmarklet to get into your WordPress – the button on the login screen won’t work.
No comments:
Post a Comment