WordPress is a great way to build and manage a blog or website. Like any
online software though, there are steps you should take to secure your
WordPress installation and keep it safe from hackers. Some are common
sense for any website (secure website hosting and choosing a secure
password) and others are specific to WordPress (such as the plugins
recommended below). Here are seven steps to secure your WordPress
website.
1) Pick a Good, Reliable, Secure Website Host
Where you choose to host your WordPress website can make a
difference in your security. Two important things to look for are
server security and backups for restore.
Choose a host who offers you php5 and runs it in suEXEC mode. With
suEXEC you are able to lockdown your files more tightly. You can find
more technical (very technical) details here: http://en.wikipedia.org/wiki/SuEXEC
Also look for a host who offers a reliable backup system and will
restore your site for you free in the event of being hacked. Most hosts
offer weekly and monthly backups at a minimum. Some hosts also do
nightly backups and incremental hourly backups. I’m hosted on a server
with monthly, weekly, nightly, and incremental backups. This means that
if my site were to be hacked I could easily roll back to what it looked
like 3 or 4 hours ago. I wouldn’t loose much, if any, of my content or
other files.
2) Use Fantastico to Install Your Blog (or Change Your Admin Username)
If you install yourself with FTP and cPanel, you’ll have a default
username of "admin" which is very easy to guess. By using Fantastico,
you will be given the choice to pick a username and password that are
unique. Plus, it's easier than an install with FTP and cPanel. Either
way, don’t use "admin" for the admin username. And don't ever use "password" for your password.
3) Use a Secure Password
Hackers and bad people are constantly attempting to crack into our
online accounts and access everything from our email to our online
banking records. How can you stop them from easily accessing your
accounts? One important step is to use SECURE passwords that aren't
easily guessed or cracked by their software.
Here are tips on how to create secure passwords:
• Don't use names, dates, phone numbers, or addresses
• Don't use common words from the dictionary
• Mix up letters and numbers
• Make it at least 8 characters long (longer is better)
• Change it often (for online banking or hosting accounts, try every 3 months)
You may also want to use an online random password generator like this free one: http://www.random.org/strings
4) Stay on Top of WordPress News
Subscribe to the updates here so you’ll know immediately when the
developers release an update or patch for any security issues: http://wordpress.org/download/
5) Keep Your WordPress Installation Up to Date
It’s critical to your security to keep WordPress up to date. The new
versions of the script make that very easy and you can update in just a
couple of clicks. It’s under "Tools" then "Upgrade" on the menu on the
left of your admin pages.
For more detailed info on updates: http://codex.wordpress.org/Upgrading_WordPress
6) Keep Your Plugins Up to Date
Anytime a plugin is updated, be sure to update the version on your
site. You’ll know an update is available because when you login to your
admin area, there will be a number in bright orange-red circle next to
the "Plugins" link on the left. Click "Plugins" and it will show you
which have an update available. You can follow the steps to
automatically upgrade your plugin(s) as needed (backup your site before
you upgrade anything, including plugins).
7) Install Security Plugins
Here are two security plugins I run on my WordPress websites and recommend installing:
• WP Security Scan: http://wordpress.org/extend/plugins/wp-security-scan/
• Secure WordPress: http://wordpress.org/extend/plugins/secure-wordpress/
With these seven steps you'll have a more secure installation of WordPress.
To save a printable copy of these tips in PDF format, click here.
Bonnie Dubrow
16 Dec 2009, 22:25
Michelle, thank you for your suggestions. They are right on. I appreciate
your sharing them. I understand about the ones that are related to any
website. Maybe you could say something about the ones specific to
WordPress. And why would someone want to hack a blog in the first place?
Michelle Shaeffer
19 Dec 2009, 01:53
Hi Bonnie, thanks for the comment!
Suggestions 2, 4, 5, 6 and 7 would be specific to WordPress sites since
they're based on plugins and WordPress specific news/updates.
I've got to admit I don't fully understand the mind of a hacker. I have
worked with quite a few clients to recover sites though, and from what I've
seen, reasons vary, and aren't so much targeted at blogs or WordPress as
just websites in general.
The thing to understand about a site being hacked is that the hacker then
has control of the files, databases, etc. They can put a message on the
site or they can steal information from it.
Generally blogs wouldn't have credit card or similarly sensitive
information stored on them so they aren't going to be targeted for that
type of hack.
Some hackers do it for the purpose of defacing the sites to advance
political or religious ideology. These ones are the hackers who replace a
home page with some sort of manifesto. They often don't mess with anything
but the front page.
Some hackers do it because they keep a count of how many sites they've
hacked and it's a competitive thing to see how many sites they can hack and
how many different platforms they can hack.
Other times blogs are targeted and attacked to mess with search engine
results (sadly I've seen that advocated as a strategy to beat the
competition).
Some hackers do it just to prove to the site owner their site is not secure
and in a weird way feel like they're doing a service for people.
Then you've got the really bad hacks where your site is hacked into and
malware (viruses or spyware) or warez (illegally cracked copyrighted
software or other digital media) is uploaded or linked to from your pages
and they spread viruses through your site or distribute illegal files. Or
someone hacks in and puts a phishing page on your site where they can then
direct people to a "real" looking fake page and collect personal
information from people duped into thinking it's their bank, post office,
or other agency.
Best approach we can take is to be proactive about security and always have
good, recent backups.
Bonnie Dubrow
19 Dec 2009, 10:17
Thanks for explaining. And you did a good job, too. Are you suggesting we
take all the actions or is a subset sufficient?
Everyone with a blog, actually, with a website, needs to take action to
secure their sites. I'm guessing hacking is like breaking and entering.
Usually people will go for the easy entries. Anything that makes entry
tough will detour many.
Thanks for your knowledge and generously sharing it. I'm going to my blog
sites and put a link to our dialog.
Michelle Shaeffer
19 Dec 2009, 14:33
Yes, this is one reason WordPress is vocal about asking people to upgrade
every time they release a patch or new edition - hackers will usually
target known vulnerabilities and easy targets.
I suggest following all the steps for a WordPress site. It doesn't take
too long and makes a big difference in security.
