Lockdown WordPress – JDM Digital

Over the last few weeks, we’ve noticed a considerable uptick in WordPress CMS site hacks (even GoDaddy got hacked). Although we’re not sure what might be causing this, we do know a few quick ways to get your house in order thanks to the security pros at Sucuri.

1. Scan & Buy Sucuri

If you think you may already have been hacked, you can scan your website using Sucuri’s free site scanner. Even if the scan comes back clean, we highly recommend ponying up a little dough and buying a Sucuri license. For the average user, you’re only looking at like $90/year. It’s worth every penny!

2. Install WordPress “Login Lockdown” Plugin

This free security plugin records the IP address and timestamp of every failed login attempt. After a certain number of failed attempts (a number you can choose) it will disable login for that IP address for some period of time (an hour, day, whatever). What’s the point? This makes it take years (if not decades) for a hacker to use a script that just guesses and guesses your login until it guesses right (called brute force password discovery). It’s a light-weight, highly customizable plugin and with over 150,000 downloads and counting it works. Did I mention it was free?!

3. Buy an SSL and Enable forced encryption login

SSL certificates are not just for eCommerce websites. Even if you’re site is all content a $70-$80 SSL certificate will allow you to encrypt (up the maximum the NSA will allow) the WordPress login screen. Just buy the SSL (GoDaddy’s running a special on them right now) and add the following to your wp-config.php file before the line that says: “That’s all. Stop editing” to force login over SSL: define('FORCE_SSL_LOGIN', true);

UPDATE:
Google is now rewarding sites under HTTPS with search rankings, but it’s just one piece of the security pie.

Share the love:

Discussion

Andy says:

04.25.2012 at 2:09 PM

Numbers two and three are good tools, but there’s only so much you can do to secure WP via the log in mechanisms. Most of the exploits I have seen in the wild use crafted URLS and bypass the WP login process completely.

For example, say there is a file in a plugin you installed that doesn’t check it’s inputs. If you pass the file some certain values, you can get the file to perform undesired behaviors – for instance, outputting parts of your database. A hacker can create a URL like http://www.example.com/wp-content/themes/plugins/exploitable-file.php?variable=whatever and blam, they’ve bypassed the WP login mechanisms but still gained more access than they’re supposed to have.

This is a simplified example and I just winged the URL, but you get the point. It just goes to show you that value behind having someone who understands web application development and security admin’ing your WP site. At the very least, a scan with a tool like Securi is a good idea.

CJ Chamberland says:

05.07.2012 at 7:46 PM

Justin – you are 100% correct – there is no such thing as a “magic bullet” that will secure anything. As far as security goes, the only secure site is the one that doesn’t exist. There will always be someone finding ways to break into something if they want in bad enough.

Technically plugin writers should be writing secure code, but that only happens in a perfect world so that leaves the burden on the site owner. Owners need to take more responsibility and an active part in securing their site. Unfortunately anyone can point and click to install a wordpress site now days.

DON’T EVER rely on a single security plugin like “sucuri” to secure your site – they only locate the issue AFTER your already infected. Take a pro-active approach and apply several layers of security to AVOID getting infected, instead of relying on someone to tell you after the fact. Use things like Firewall, Mute Screamer, File Monitor,etc. to notify you of possible attacks.

Their free scanner is nice, but it’s not going to find any backdoors left on your server by hackers either. They could report it as clean, but if the backdoor is still there, you won’t be clean for long.

Comments are now closed.

Get the Email

Join 1000+ other subscribers. Only 1 digest email per month. We'll never share your address. Unsubscribe anytime. It won't hurt our feelings (much).