La semana pasada se conociĂł la noticia de que muchos sitios que utilizan Wordpress estaban siendo vĂctimas de un ataque masivo para robar contraseñas de administrador utilizando el mĂ©todo de la fuerza bruta, provechĂĄndose de los administradores que dejan como usuario âadminâ y de que el formulario de login de Wordpress no dispone, de por sĂ, de mĂ©todo alguno para prevenir este tipo de ataques (ir probando combinaciones hasta que alguna funciona).
I have been using Wordpress for many years and I find it interesting to share some of the security measures that I consider basic to maintain a secure installation. I wonât go into detail about any of the topics, but if anyone wants me to elaborate a little more or write a post about it, I will.
Set file and directory permissions
From the terminal, if we have access to the server, we will make sure that the directories and files have the permissions set correctly. In most cases as follows:
For directories:
find /path/to/your/wordpress/install/ -type d -exec chmod 755 {} ;For files:
find /path/to/your/wordpress/install/ -type f -exec chmod 644 {} ;Set the secret keys of your wp-config.php
The secret keys of our Wordpress are used to provide greater security to the cookies of our site and that third parties âdo not impersonate us.â You must enter them in the wp-config.php file and you can generate them randomly from here.
Rename the user admin and make sure their password is strong
Most Wordpress users keep the user âadminâ as administrator of their site, so if someone tries to hack it it will be twice as easy, since they will only have to enter the password. That is why it is important not to use, or even have, a user called âadminâ on the blog. We can create a new administrator using this user and then log in with it to delete the old one or also access PhpMyAdmin and modify it as explained here.
Needless to say, we will also have to have a secure password, for which âHow Secure is My Password is very interesting, a page that tells you the strength of it. Using services like 1Password or LastPass can also help us.
Keep Wordpress and the plugins you use updated
The biggest vulnerabilities tend to occur in older versions of Wordpress or outdated plugins, because hackers have more time to tinker with these versions, so a good way to prevent attacks is to keep everything updated whenever possible.
Change the Database Prefix
By default, Wordpress sets the âwp_â prefix on our database tables. This is a problem because we are giving clues about what our tables are called: wp_options, wp_posts, wp_comments, etc. By modifying the prefix we will make it more difficult for hackers.
To do so, if we have not yet installed Wordpress, we will only need to edit the following line in the wp-config.php file:
$table_prefix = âr235_â;
We can change âr235_â to whatever we want, as long as it contains numbers, letters or underscores.
In the event that our blog already has a tour, we will have to change the prefix of all the existing tables, which we can do by dipping directly into the database (Be careful!) or using the [WP Security] plugin Scan](https://wordpress.org/extend/plugins/wp-security-scan/ âWP Security Scan in the Wordpress plugin repositoryâ), which performs this task automatically
Prevent brute force attacks on user login
If you use the blogâs âadminâ username or a simple password, the chances of a brute force attack being successful are very high, but if not, there is also some possibility since Wordpress does not limit the number of erroneous accesses in short periods of time, so with patience (or using a large number of infected computers) it can be achieved. To prevent this you can use a plugin, such as Simple Login Lockdown or similar.
Protect access to htaccess files, wp-config.php and wp-includes directory
Only you and the server should have access to these two files, which are very important since they contain private data (such as the database password and username) and the blogâs redirection rules.
To prevent third parties from accessing them, add the following lines to the .htaccess file:
For wp-config.php:
<files wp-config.php>
order allow,deny
deny from all
</files>For .htaccess:
<Files .htaccess>
order allow,deny
deny from all
</Files>For the wp-includes directory:
# Block the include-only files.
RewriteEngine On
RewriteBase /
RewriteRule ^wp-admin/includes/ - [F,L]
RewriteRule !^wp-includes/ - [S=3]
RewriteRule ^wp-includes/[^/]+.php$ - [F,L]
RewriteRule ^wp-includes/js/tinymce/langs/.+.php - [F,L]
RewriteRule ^wp-includes/theme-compat/ - [F,L]#BEGIN WordPress
Disable the Wordpress HTML editor for plugins and templates
If someone accesses your administration panel, by default they will have access to editing your templates and plugins. It is not recommended to make changes to the blog files from the administration because if we screw up there is no turning back, we do not have to undo, so it is highly recommended to disable this feature by adding the following line in the wp-config.php:
define('DISALLOW_FILE_EDIT', true);Hide the version of Wordpress you use
By default, for statistical reasons, Wordpress shows in the blog header code the version that is being used, which can facilitate the task of hackers when searching for vulnerabilities. To avoid this, in the functions file of our template we can add the following line:
remove_action('wp_head', 'wp_generator');If we prefer, we can also use a plugin that performs this task automatically, such as Secure Wordpress.
Make backup copies
Although it does not have to do directly with security, it does have to do with making you feel safer and saving you some headaches in the event that something fails. To make database backups you can use a plugin (easy) or program a script that performs the task automatically (hardcore) using CRON.
A plugin to perform this task easily can be WP-DBManager (Wordpress Database Backup has not been updated for a long time).
If youâre going hardcore, you can edit the following shell script to your liking and then run it periodically with CRON:
DBNAME='BASE_DATOS'
DBPASS='CONTRASEĂA'
DBUSER='USUARIO'
#Email al que se enviarĂĄ por correo la backup
EMAIL="EMAIL"
#El prefijo que utilices en tu base de datos
PREFIX="PREFIJO_DB";
DATE=`date +%Y%m%d` ;
#We export the DB
mysqldump --opt -u $DBUSER -p$DBPASS $DBNAME > backup.sql
#We compress it
gzip backup.sql
#We encode the file as an attachment and send it by email
uuencode $DBNAME-backup-$DATE.sql.gz $DBNAME-backup-$DATE.sql.gz | mail -s "[bocabit.com] Complete MySQL Backup" $EMAIL
rm $DBNAME-backup-$DATE.sql.gzRecommended plugins to secure our Wordpress
Finally, I leave you a list of some of the plugins that I use to save myself headaches and keep Wordpress a little more secure.
- Akismet: To avoid spam in blog comments.
- Secure Wordpress: Deactivate Wordpress versions and perform other small tasks.
- WP Security Scan: Detects vulnerabilities in our installation and automatically changes the database prefix.
- Simple Login Lockdown: Prevents brute force attacks on user logins.
- WP-DBManager: Make backups of our blog, optimize and fix the database.
If you know more plugins or security tricks, I encourage you to leave a comment.