Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

How do you go about protecting a default WordPress installation?

What checklist do you use, best practices, tips and tricks, etc?

Any recommendations on plugins, third-party tools are welcome.

share|improve this question

7 Answers 7

up vote 13 down vote accepted

There is actually a really good guide to this on the wordpress website - Hardening WordPress.

However my personal short check list is

  • mod_security - @atdre already mentioned mod_security it is a very good step. However it does require a lot of tweaking of the core ruleset in order to allow wordpress to operate correctly. You will also most likely need to customise the ruleset depending on the plugins you use.
  • File Permissions - see here
  • Administration Over SSL - Use SSL for the Admin area see here.
  • Update - the most critical in my opinion keep wordpress up-to-date. By using the built tools, by patching manually or by using an update script (I wrote this one).
share|improve this answer

ModSecurity with the Core Rule Set isn't bad, but it's better to configure it explicitly for every input the app takes, as well as fixup the unescaped output it sends on the outbound. This works best in full proxy mode, but embedded has some other unique advantages. It might be clever to use both, especially since Wordpress is insanely insecure.

share|improve this answer

One step would be to secure the server (which is usually Apache) which is outlined in the responses of my previous question of Hardening Apache Server

share|improve this answer
  1. Change admin account username. If a hacker already knows your username that’s half the battle and he will try to guess your password.
  2. Change the WordPress table prefix during installation.
  3. Using a .htaccess file you can lockdown your wp-admin directory by IP address. This means only IP addresses you specify can access your admin dashboard URLs.
  4. Set a strong password for admin login and ftp access.
share|improve this answer

In addition to the great advice above, I have another suggestion: I recently published a Wordpress plugin that you might find helpful. I call it Foresight. It's available for download from the Wordpress Plugin Directory:

http://wordpress.org/extend/plugins/foresight/

(It's also mirrored on github.)

The plugin is pretty simple: all it does is load a "Foresight" link into the "Tools" section of your sidebar when you're logged in as an administrator. If you click on that link, you will be presented with a series of tabbed iframes, each of which displays the newest Wordpress exploits found at the following popular exploit trackers:

This tool isn't particularly fancy or anything. (I think of it as a dumb tool for a smart administrator), in that it's ultimately just loading a bunch of iframes. To use it, you just periodically load it up and browse the exploits, keeping an eye open for exploits in the Wordpress core or plugins that you use. If you find such an exploit, you can then make an intelligent decision regarding how best to proceed.

I made this plugin because, after the recent TimThumb debacle, it became obvious to me that many Wordpress administrators don't keep an eye on the exploit trackers. My hope is that this will make it slightly easier to do so.

share|improve this answer

There are hundreds of articles on this topic. Please read the following articles.

If you can afford it, rent a dedicated server so that other compromised websites that are hosted on the same box as yours don't effect you. You can do all that you possibly can to ensure that your website is secure, but if your host is using an outdated version of Apache or Linux, that alone could be your demise.

Regularly perform a checksum and/or code review on your plugins. It's common for hackers to inject shellcode into your plugins, both because you wouldn't expect it/look for it there and because it will be executed whenever that plugin runs. If you find any plugins you can't verify that you installed, remove it. Keep an eye on the date a plugin was last modified as well, document each modification you make to a plugin.

If you must store passwords, do so securely. Use a strong hashing algorithm with a per-user salt (no two salts should be the same). The users salt (if stored) should be in a separate database. Read this article (OSWASP) on how to store passwords in a secure fashion.

Speaking of databases, use the least privilege rule. Checking if a users credentials are correct doesn't require root privileges.

Be sure to perform validation on all user input. For searches, registration fields, etc. this will be easy, comments/reply not so much. Set a whitelist of valid input, restrict everything else. For example, on your registration page there is no reason to allow anything else but a-z, A-Z and 0-9 on the username field. Everything thing else should be explicitly restricted. From my experience, the easiest way to break into a website (Wordpress or not) is by exploiting incompetent validation. Make use of whitelists and character escaping.

Account for all attack vectors. If you're only doing a Wordpress installation, securing it is relatively easy. However, in the future you may install additional plugins and applications (Forums, e-commerce, analytics, etc.). You must then ensure they are kept up-to-date and that you have secure passwords.

Limit the number of login attempts a user can attempt before being locked out. Personally, I use the aptly named "Limit Login Attempts" but there are quite a few out there, such as Login Lockdown. Some people also use a CAPTCHA on their login page, it's a matter of preference. This will tremendously reduce the odds of a bruteforce attack (an already poor method of penetration) from being successful. Enable the optional logging as well.

If you need additional information, don't hesitate to contact me. I had a lot more to add, but decided to remove it to spare your energy ;)

share|improve this answer

For self auditing you may find plecost of interest.

Definitely check out http://codex.wordpress.org/Hardening_WordPress for a very comprehensive list of tactics and strategies. Other answers to your question have similarly useful links. Go through each one in turn until you feel like you have adequate coverage.

Also, be VERY aware of which plugins you install and how many. Whereas WordPress is under constant development and peer review, the same not be said of many of these plugins. Each one represents a security risk and must be maintained.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.