WordPress Security: Securing Sites From Hackers / Future Attacks

As WordPress is the most popular CMS available on the web but also vulnerable to threats if we don't follow the necessary security measures.


In one of previous guest post, Sarah Rexman mentioned some tips about securing WordPress and in this post I'm gonna share my own experience. While working as freelancer on oDesk, Elance and Freelancer; clients always have issues about securing their sites from hackers and ask about how to prevent from future attacks. So consider these points to secure your WordPress site for now and future:

• Keep your WordPress up to date. Latest stable version is 4.7.4 released on 20th April, 2017.
• Keep your all plugins, themes up to date.
• Always keep backup of your database, files and make it update after some interval.
• If site has been compromised, then you must change your salt keys from your wp-config.php file under root directory. You can generate new keys from here. It will force all users to have to log in again.
• Change your all passwords associated with site at regular interval.
• Use strong passwords for all logins. Include the mixture of atleast one uppercase letter, lowercase letter, special character, number.
• Change your WP-Admin username from admin to some other name.
• Change database prefix from wp_ to some other complicated characters to avoid zero-day SQL injection attacks.
• Remove timthumb script if your site running it as its no longer supported or maintained.
• Use plugins after testing it properly. Going through plugin review, Google search will let you know about the reputation of the plugin.
• Keep track of latest visitors through log files for tracking site users. If you find any suspicious activity at any particular time, then logs files might help you to know a bit about the attacker.
• Change permissions for .htaccess, wp-config.php, themes main files to 444.
• Proper file permissions for other files and folders. Best practice is to use 644 for files and 755 for folders.
• Keep your own system virus free.
• Always try accessing the site credentials from your own system only.
• Validate all user inputs  like URL, image uploads etc.
• Keep track of WP-Admin, FTP accounts user section for any unauthorized user.
• You can also use Wordfence plugin to monitor from malicious scripts.
• Put some security to the server on which your site is hosted, either it hosted on dedicated or a shared server.
• Keep updated with latest vulnerabilities.

Is your own site get infected with malware/virus, contact me through contact form to get rid of malware with future security implementation. In some cases, site might be hit by pharma hack, you can check it either through site content or by searching your site on Google with query "site:example.com pharma"

Having any further issue? Please comment down!

How To Secure Your WordPress Site?

This is a guest post by Sarah Rexman.

WordPress sites are vulnerable to viruses and attacks from hackers. If you have a very popular WordPress site, your competitors may try to attack your site to put you out of business. Others may attack your site to try to steal your information to take money from you.

It is very important to secure your WordPress site to withstand attacks and to protect the investment you have put into building a successful blog. You don’t have to be a developer or a hacker yourself to understand how to protect your site. Here are a few easy steps you can take to secure your WordPress site:

Choose a Good User Name and Password

How many of you are still using “admin” for your WordPress login user name? If you are, hackers already have half the information they need to access your site. Using “admin” as your login user name is akin to using “1234” as your password. You’re making it too easy for someone to get into your site.

You should choose a different name for your login – something hard to guess (not your name!) – and create a password that’s hard to choose. Some good tips for selecting a password include:

• Choose a phrase instead of a single word.
• Combine letters with numbers and symbols
• Do not use personal information such as birthdays, addresses, or names.
• Do not use common phrases or combinations such as “hello” or “password”.
• Be sure to change your password often to keep it secure.

Keep Software Up-to-Date

Out-of-date plugins, themes and even the WordPress software itself can create security risks for your site. Be sure to check for updates regularly. WordPress offers options for you to check for and download updates automatically.

If there are any plugins or themes on your site that you are no longer using, you should delete them. They present a security risk and make your site vulnerable to hackers.

Choose Trusted Sources

Before you ever download any plugins or themes, you should research the developer to make sure you are downloading from a trusted source. You never know whether your plugin or theme may be coded with a Trojan horse, worm, or other virus.

If you don’t have experience with a provider, research the company’s reputation on forums and sites that offer profiles and reviews of companies. Look for any reports about problems with the software and follow up where possible. If a developer is distributing themes or plugins with harmful content, news will spread around the web quickly.

Don’t Allow Users to Register

If you allow for guest posting or community contributions on your site, it may be tempting to allow members to register themselves to post content on your site. However, doing so may put your site at risk for attacks.

Be sure to manually register all users authorized to post content on your site, and make sure you have selected the appropriate controls.

Back Up Data

Regularly backing up your data is a good security practice for your computer, as well as any online activity. For a WordPress site, backing up your data is as simple as opening up your FTP client and copying all the folders to a location on your computer or an external hard drive.

There are also plugins that make backing up your data easy, and information can be stored by cloud providers. Check WordPress for a complete list of recommended backup plugins.

You don’t have to be a computer expert to keep your WordPress site secure from hackers. Taking these simple steps can help keep out most unwanted visitors. If you feel that you are particularly vulnerable – because you have a very high-profile or lucrative site – you can hire a professional to create custom security measures for you.

About the author:

Sarah Rexman is the main researcher and writer for bedbugs.org. Her most recent accomplishment includes graduating from Florida State, with a degree in environmental science. Her current focus for the site involves researching bed bug products and bed bug elimination.

5 Security Plugins For Your WordPress Blog

This is a guest post by Arsh Kapoor.

WordPress is the most well-known running a blog service these days. It’s being used by many people all over the world. But because of the reputation, it’s getting more interest by online criminals and spammers too. WordPress is very protected by itself, but there can be never too much ascertainable.

For simple customers, who never value a lot, plug-ins is the best way to protected your site. They are free,

quickly useful and secure. This publish puts together 35 best plug-ins to make your site perfect. They are each created for different requirements, so you will get the best security from each area.

The following are the plug-ins I discovered that can create WordPress more protected:

1) Limit Login Attempts: This tool prevents a person for 20 moments after he goes into wrong password 4 times (default principles, can be changed). It is good way to prevent Incredible Power strike.

2) Stealth Login: his tool allows you to make customized URLs for signing in, signing out, management and applying for your WordPress web page. Instead of marketing your sign in URL on your web page, you can make a URL of your option that can be simpler to keep in mind than wp-login.php, for example you could set your sign in URL to WebRetina Login for an simple way to sign in to your web page.

3) Chap Secure Login: Whenever you try to sign in into your web page, you can use this tool to give your code encoded. The encrypted sheild procedure is done by the Guy method. By initiating the Guy Protected Login tool, the only details given unencrypted is the login name, code is invisible with a unique number (nonce) produced by the procedure – and opportunely modified by the MD5 formula. In the first sign in there will be one, but do not fear is only a specialized mistake. Indeed in the next login’s function, if the are appropriate, there will not be mistakes.

4) Sabre: If you own a WordPress operated website where customers can sign-up easily and see a lot of bogus users, this tool can stop bogus person signing up by crawlers. It can add picture confirmation or numbers analyze to signing up process among other actions to make sure bogus customers are not designed.

5) Secure WordPress: This tool keeps your WordPress set up protected with the help of little features. It conceals information regarding your WordPress edition from non-administrators and tool listing from guests by losing a empty catalog.php computer file.

About the author:

This blog post has been written by Arsh Kapoor who is a technology lover and loves to blog on latest technology on its technical blog Check out his latest posts on cloud computing (Free cloud computing services).

How To Complaint Blogger & WordPress About Copyrighted Content Of Sites?

Hello everyone!! In this post, I'm gonna explain about reporting Blogger and WordPress about copyright content of your site (without any charge) just by filling a DMCA form. What is DMCA? DMCA (Digital Millennium Copyright Act) is a copyright law that control access to copyrighted works. So if you find any suspicious link from some other other website who is copying your posts, you can file a report to that website's hosting provider. Well if the infringing site's hosting provider is Blogger (Google's service) or WordPress, you can file a report without any charge, I don't know about other hosting providers, but mostly don't provide this service for free. You can get a better idea about it from DMCA's official website. The reason I'm telling here about blogger (Google's service) and WordPress is that these two provide the best blogging sites.

Coming back to post, let's follow the procedure to complaint Blogger and WordPress about copyrighted content:

For infringing Blogger URLs:

• Login to your Google (Gmail) account.
• Go to the link by clicking here.  

Note: Before continuing, ask the owner of infringing URLs to remove the copyrighted content.

• Under "What Google product does your request relate to?", choose Blogger/Blogspot.
• In next column, specify the nature of your request.
• Choose "I have found content that may violate my copyright".
• In next column, choose whether you're copyright owner or authorized to act on owner's behalf.
• Read the Important notice and after reading, check Yes under "I have read the above and wish to proceed".
• Choose your infringing work, choose Text.
• Again read the following instructions before continue.
• After reading instructions, click on "this form" written in last line of instructions.
• Under "Complainant's information", provide your correct information. 

Note: I recommend to enter your site's email address under "Contact email address" if you've otherwise proceed with your Gmail account.

• Under "Your Copyrighted Work":
  
  • Under "Where can we see an authorized example of the work?", mention your copyright URL (one per line) like http://yourblog.blogspot.com/2012/02/post.html (in case of Blogger) 
  Note: It's not mandatory for copyright URLs to be hosted by Blogger.
  • Describe about your copyrighted work under "Identify and describe the copyrighted work".
• Under "Allegedly Infringing Material", 
  • Under "Location of the allegedly infringing material", write URL of the posts where the infringing content is located.
• Under "Sworn Statements", check both fields.
• Put your signature and read the "Account Disabling" section.
• Click Submit and you've done.
• You will receive a confirmation email and Blogger team will reply to you within 2-3 business days.
• During this time, Blogger team will ask owner of infringing URLs owner remove infringement contents otherwise Google may remove the whole blog from search and even can suspend the site as they mentioned in "Account Disabling" section.
• Screenshots showing consequences of whole work I described above:

Confirmation mail

Mail received after 2 days about removing infringing URLs.

Note: Following same procedure, you can report to Google about other copyrighted Google products too.

For infringing WordPress URLs:

• Go to the link by clicking here.
• The whole procedure and complaint form is given here.

Note: Only reason behind this post is to make aware public about DMCA. Newbie register their free blog using blogger/wordpress and start copying posts from other sites (because they want more traffic) and even they don't remove content after responding from copyrighted owner. Some of my friends had lost their sites in it's unawareness even their sites were getting good traffic.

So write your own words, and even if you find any relevant information from other sites, then try to publish it in your own wording. It would definitely enhance your knowledge. Hope you understand and have a nice weekend!!