How to protect WordPress blog from hackers
A recent hack of our blog made me realise that blogs based on older versions of WordPress are at great security risk. I said “older versionâ€, because the company’s developers are making security fixes as soon as they’re found. WordPress Trac is where bugs are reported and tracked.
By releasing immediate security fixes they honour their end of the deal, but do we by upgrading our WordPress accordingly? I have to say, the majority of us don’t. Apart from upgrading WordPress, there are other server related issues which may look simple, but can be your saviour or doorway to destruction.
Exploits are inevitable; you will come across them every now and then. Exploits are an unavoidable by-product of major projects; they are part of the bargain: you fix them and move on. Here is what can be done to stay safe
- Subscribe to WordPress development blog . That should keep you alert of the latest security patches and versions. Don’t just read it act on it too. So, upgrade accordingly. Upgrading might force you to take down your blog/site temporarily for few hours, but it’s still better than your server being brought down for forever, right?
- Not only do you have to upgrade WordPress, keep an eye on your plugins. I had experienced persistent XSS Vulnerability (Plugin responsible-wp-feedstats 2.4) and SQL Injection Vulnerability (Plugin responsible- WP-Stats 2.01), fortunately these were taken care of.
- Stop anonymous comments and trackbacks, why? There’s history of WordPress Trackback Charset SQL Injection Issue and other Non-WP related spam flood.
- Check your server files and folder permission accordingly. Especially Config.php file, which is an open text based file in a Web accessible directory. Not only is it Web accessible, but it contains the login and password for your blog’s database. No need to be a rocket scientist to figure out what will happen if someone naughty can get access to that.
- Directories should have permissions of 755. NEVER 777. All files should have permissions of 644. If you do want to use the built-in editor; theme files should have permissions of 666. NEVER 777. Do not use any plugin that needs to write anything to the server. No matter how drastic it sounds, trust me it will save your ass.
- Last but not the least, if you are building your own theme/or asked someone to do that for you, please do try to consult/check for latest PHP security holes or common security flaws before using that as template.
All of the above do’s and don’ts are common sense, but unfortunately we get lazy and tend to ignore most of them. Learn from my mistakes.
5 Responses to “How to protect WordPress blog from hackers”
Leave a Reply
Also if you can:
- Have your webserver and database running in a chroot / jail. Then even if someone gets into your server they face a significant barrier to doing more damage.
- The ownership of files on the webserver and the process the webserver runs on should be different. Also makes its harder for a hacker to do more damage even if they do break in.
Good one Mike, though I won’t exactly call it a jail ïŠ perhaps secured facility sounds better.
PHP’s include is just one of the many ways to do that. But first of all we need awareness and full understanding of file permission
Thanks Kamrul – I should have been a little clearer by writing a “FreeBSD Jail” (http://en.wikipedia.org/wiki/FreeBSD_jail) or on other flavours of Unix a chroot (http://en.wikipedia.org/wiki/Chroot).
Chroot and Jail are not the exact same thing.
A chroot setup creates a virtual filesystem. For example if your website was running in /var/www/segala and you have chrooted the web server to /segala then the web server program (and any programs run by the webserver ) think that /segala is the top level directory on your filesystem.
A Jail is more powerful and can be used to create virtual machines that are kept separate from each other.
Cheers Mike for the tip, that Jail new for me. I was familiar with Chroot though, used it in several occasion. Have to look into that Jail.
Virtual filesystem becoming increasingly popular and necessary every minute.
Thanks for this information, I need to secure now my newly installed wordpress blog. Again, thnx for sharing this.
Kenneth