WordPress Security Tips

[petermeadit]

Thanks Chris

Yeah Chris it was a great talk, very inclusive...

This might be a bit off topic, but how does the security requirements change if you use CiviCRM, do you know?

Thanks for the feedback, much appreciated!

 

[chris]

Hi Peter, as long as you keep site backups and make sure everything is updated you'll be reducing the security risks.

 

[johno69]

I've been using a great wordpress plugin that helps you stay on top of things.

http://www.wordfence.com/

 

[chris]

I've been using a great wordpress plugin that helps you stay on top of things.

http://www.wordfence.com/

Definitely plan on checking that one out, thanks!

 

[Cooper Mills DomainLawyer]

I've been using a great wordpress plugin that helps you stay on top of things.

http://www.wordfence.com/

Thanks for the link, I have been using another plugin but I havent seen much security software available for Wordpress

 

[Data Glasses]

After being hacked last year i use two plugins

Wordpress Secure and Wordpress Firewall 2

I get regular notifications of hacking attempts ......so far so good

 

[Blue Wren]

Recent Wordfence update is pretty good; Theme and plugin scanning is now free.

 

[johno69]

Recent Wordfence update is pretty good; Theme and plugin scanning is now free.

Yes. Only issue i've found is they assume you have twentyten installed.

I got about 125 "File Missing" notifications, on a few sites.

 

[findtim]

Yes. Only issue i've found is they assume you have twentyten installed.

I got about 125 "File Missing" notifications, on a few sites.

can you expand on that comment of " they assume.... " as i never use that theme, i use studio press themes so does that mean it doesn't work as well OR..... i have to keep doing something every update?

in your experience with it.

tim

 

[johno69]

It works fine. It scans for default core WP files and notifies you if they have been changed or are missing.

They seem to have included the twentyten theme as core WP files in the scan. (The scan assumes you have it installed)

So because I have deleted it totally, it alerts me that these files are missing.

You can simply tell Wordfence to ignore these missing files and it will be fine.

It's a must use plugin for me on every site.

 

[findtim]

So because I have deleted it totally, it alerts me that these files are missing.

have you not found if you delete twentyten that when you update WP to new version wp reinstalls twentyten? so i have found its a waste of time deleting it!

tim

 

[johno69]

have you not found if you delete twentyten that when you update WP to new version wp reinstalls twentyten? so i have found its a waste of time deleting it!

tim

This has never happened to me. I always delete themes i'm not using as a security measure. And none have ever magically re appeared.

You can always upload a theme via FTP and activate it via MYSQL if everything comes crashing down.

 

[johno69]

Another tip, always update themes and plugins even if you are not using them. Even if they are deactivated.

Update update update.

 

[findtim]

Another tip, always update themes and plugins even if you are not using them. Even if they are deactivated.

Update update update.

my tip NEVER update a theme or plugin on a clients site until you have done it on a test site.

i have a test site that i do the first update on so if it stuffs up then i can find the problem rather then get phone calls from clients

tim

 

[johno69]

Yeah of course or backup.

Just making a point of deactivated stuff getting neglected. All too common.

 

[DamianLondon]

Hi All

definately a lot to consider with security when it comes to WP. Most owners develop using WP to complete sites / blogs on the cheap, so security and backups sometimes are left last on the to do list.

After having multiple issues with one particular site I turned to Sucuri (http://www.sucuri.net/). Sucuri is a monitoring and malware removal service. You pay a yearly fee but if one of your sites gets hacked, they fix it for you.

Other monitoring software I use includes WSD Security, Spammer Blocker, Threat Scan, Firewall and UserLocker. UserLocker is a bit of a pain in the A** at times, but it automatically locks logins for Admin if someone is trying to use your Admin login.

D

 

[johno69]

Hi All

definately a lot to consider with security when it comes to WP. Most owners develop using WP to complete sites / blogs on the cheap, so security and backups sometimes are left last on the to do list.

After having multiple issues with one particular site I turned to Sucuri (http://www.sucuri.net/). Sucuri is a monitoring and malware removal service. You pay a yearly fee but if one of your sites gets hacked, they fix it for you.

Other monitoring software I use includes WSD Security, Spammer Blocker, Threat Scan, Firewall and UserLocker. UserLocker is a bit of a pain in the A** at times, but it automatically locks logins for Admin if someone is trying to use your Admin login.

D

Wordfence does all this. And now free. I can't sing it's praises enough.

 

[DamianLondon]

Thanks, will check it out. Human intervention @ Sucuri is very good, but yes it does cost.

 

[Data Glasses]

To the russian hacker who tried no less than 39 times to hack my sites yesterday

.......GET STUFFED

It seems wordpress firewall 2 and secure wordpress did their job

once more .......... GET STUFFED !

 

[Suzabro]

Security talk

Yeah Chris it was a great talk, very inclusive...

I agree the security talk at bendigo meet up was very valuable. Definitely going to be making changes to ensure my sites are secure and data is backed up.