Don’t Get Hacked: 6 Ways to Secure Your WordPress Blog

Webmasters often overlook security when it comes to their WordPress blogs. After all, WordPress is an excellent piece of software and most blogs are not hacked. However, before you get too comfortable in vulnerable bliss, we suggest that you take the following steps to make your website more secure.

1. Prevent Unauthorized Access to Your wp-admin Directory

Probably the most important way to prevent attacks is to limit access the the WordPress admin directory. This can be done in one of two ways:

Option 1: Limit access by IP Address

Create an .htaccess file in your wp-admin directory. Next, determine your IP adderss. (You can figure this out by visiting WhatIsMyIPAddress.com.) Next, put the following code in the .htaccess file.

<Limit GET POST PUT>
order deny,allow
deny from all
allow from xxx.xxx.xxx.xxx
</Limit>

To allow multiple IP addresses, simply add a new allow line for each allowed IP address.

Option 2: Password Protect the wp-admin Directory

If you have a dynamic IP address or plan to work on your website from multiple locations, limiting access by IP address is probably not the way to go. As an alternative, you can password protect the admin directory.

To create password-protection for this directory, you will need two files: an .htaccess file and a .htpasswd file. And for best results, the .htpasswd file should be placed in a directory not accessible via the web. Additionally, your password should be encrypted. To facilitate the creation of these files, we suggest using the .htaccess file generator and .htpasswd files generator from htaccesstools.com.

2. Change the Admin Username

By default, all WordPress installs have an an administrator with the admin username. Instead, create a new administrator account and delete the default account.

3. Hide Your Directory Structure

It is also good practice to hide your directory structure. By default, many WordPress installations enable any visitors to snoop and see all files in folders lacking an index file. And while this might not seem dangerous, it really is. By enabling visitors to see what files are in each directory, they can better plot their attack.

To fix this problem, you can do one of two things:

Option 1: Use An Index File

For each directory that you want to protect, simply add an index file. A simple index.html file will suffice.

Option 2: Use An .htaccess File

The preferred way of hiding the directory structure is to use the following code in an .htaccess file.

Options -indexes

4. Keep Your WordPress Install and Plugins Up-To-Date

With every new release, there have been notable security fixes which are disclosed to the WordPress community. If you don’t upgrade, hackers will be able to easily exploit your websites from known vulnerabilities.

5. Delete Any Unnecessary Plugins

More often than not, disabled plugins are left in the plugin directory. Unfortunately, this can be a security risk. So, be sure to remove any disabled or unnecessary plugins.

6. Change the WordPress Database Table Prefix

By default, the database tables that hold WordPress data have the prefix wp_. This means that if a hacker attacks your website, they will be more easily able to access all tables because they will know the table names. To prevent this from happening, you should choose a unique table prefix.

For a new installation, simply edit the wp-config.php file as shown below:

$table_prefix = 'youruniqueprefix_';

If you would like to update an already existing WordPress installation, you will need to update the wp-config.php file as shown above in addition to renaming all WordPress database tables. This can be done via PHPMyAdmin or some similar web interface that inables you to update your databases.

A few more security fixes…

Some other ways to secure your blog include:

1. hiding your WordPress version.
2. using security plugins such as Secure WordPress.
3. creating a long and complicated FTP username and password to prevent direct file access.
4. restricting access to your wp-config.php file in the event that your server’s PHP install is broken.

 

If you have any additional suggestions for blog security, feel free to share.

Tags: open source, security, software, WordPress