PHP Scripts and Programming

Steps to Keep WordPress Secure

April 15th, 2013  –  Category: Information, PHP Programming, WordPress Plugins, WordPress Programming  –  No Comments »

It has been brought to my attention that WordPress is becoming a juicy target for hackers and bot-nets.  As such, here are some simple steps you can take to prevent your WordPress site from being hacked.

• Change your admin password regularly.
  One strategy that hackers are using is simple brute-force attacks to try and guess your password.  You should change it regularly, and make sure the password you choose is very hard to guess.  Long combinations of letters, numbers and symbols are best.  Sentences can be good too.  Consider using a password storage solution such as LastPass.
• Install a plugin to block bad logins.
  There are a number of plugins out there which can lock user accounts if too many bad login attempts are detected.  Installing one of these would be a good security measure.
• Run VaultPress
  VaultPress is an excellent backup/security plugin that will both keep your site backed up, as well as searching regularly for suspicious code.  A really valuable addition.
• Change the admin username.
  This takes a little more technical work because you have to modify the database manually, but changing the admin username to something other than “admin” can go a long way.

These steps are a great start to securing your site, but what if you’ve already been compromised?  How can you tell?  Here are some steps you can take to find out.  It’s somewhat technical in nature though so proceed at your own discretion.

1.  Download the entire site.
2. Use a search tool to search for suspicious phrases.
   Using a tool such as Eclipse, you can search the entire filesystem of a given site for particular strings of text.  Hackers will often hide backdoors in normal looking WordPress files.  You can find many of these by searching all the files on the site for strings like “eval” and “base64″.  Also look for backticks.
3. Look for suspicious files.
   Search your wp-content/uploads folder for any files ending in .ph* (.php, .phtml, .php4, …)  If any are found, check them out to ensure they’re not running anything suspicious.  Generally, if there are any, they should be empty.
4. Compare the files  to a clean WordPress folder.
   One thing you can do to determine if there are bad files is to compare your current site files to a clean WordPress install.  Download the same version of WordPress as you currently have running (hopefully the latest) and compare the files with each other.  One way to do that is to use a version control system like GIT.  You can commit the clean WP install first, then overlay your files on that, and easily see any differences.
5. Download the raw database and check for suspicious code.
   Once downloaded as raw SQL, you should be able to search the code for strings such as “<?”, “eval”, “base64″, “<script”, and backticks.

Related Reading:

PHP Solutions: Dynamic Web Design Made EasyThis is the second edition of David Power's highly-respected PHP Solutions: Dynamic Web Design Made Easy. This new edition has been updated by David ... Read More >

PHP and MySQL Web Development (4th Edition)PHP and MySQL Web Development, Fourth Edition
The definitive guide to building database-drive Web applications with PHP and MySQL

PHP ... Read More >

The Joy of PHP: A Beginner's Guide to Programming Interactive Web Applications with PHP and mySQLA Beginner's Guide to Programming Interactive Web Applications with PHP and mySQL

Have you ever wanted to design your own website or browse... Read More >

Links:

• Everything Kindle
• Man Who Has Everything
• Photographic Greeting Cards
• The Occasional Joke
• The Technology Blog