Case Study: Security Hardening WordPress

I’m often asked by clients to perform security reviews and security hardening procedures on their WordPress sites.  In this post I want to tell you what I think the key areas are that need to be addressed when securing your site.

WordPress security is an issue, I have fixed dozens of hacked sites, by following this guide (and the videos that acompany this post) you can make your site much less attractive to the would-be hacker.

Video Coaching

I have a free video coaching guide to show you how to make all of these changes I mention below, simply join my mailing list in the sidebar to the right for details of the coaching videos.

The processes are quite long and drawn out, so a video explains it in much more detail.

Before You Start

You are going to make fundamental changes to your site if you follow this guide, please take a backup and know how to restore before you start, you have been warned 🙂

Keep Your Site Up To Date

The first and most important step if to keep your core wordPress file and all plugins up to date.  Many updates to WordPress are security patches, so whenever the banner pops up at the top of your dashboard, take action and update your site.

The only caveat I would add is to check that any critical plugins (e-commerce etc) are compatible with the latest update before you do that.

Change Default Table Prefix

By default the WordPress tables are called wp_, so a hacker knows that the users are held in wp_users table, they already have part of the puzzle if they try an SQL injection.

Change the default table prefix to wp_{somethinghardtoguess}_

Change Default Admin Name

On earlier versions of WordPress you were forced to accept admin as the default super user name, this had thankfully changed with newer installs, you can choose your admin user name.

If you are using admin as your super user, consider changing it for something more difficult to guess, the hacker already has half the puzzle if he know your admin login name, a brute force attempt to send thousands of passwords to yoru site is made much easier.

Security Keys

WordPress has the facility to encrpy a lot of the security information it holds in browser cookies to stop people gaining access to those credentials, but you need to add some encryption keys to wp-config to make this work.

Look for teh following section

define(‘AUTH_KEY’,        ‘LONG STRING’);

define(‘SECURE_AUTH_KEY’, ‘LONG STRING);

define(‘LOGGED_IN_KEY’,   ‘LONG STRING’);

define(‘NONCE_KEY’,       ‘LONG STRING`’);

define( ‘AUTH_SALT’, ‘LONG STRINGl’ );

etc etc

Use the following tool to set random encrypted keys https://api.wordpress.org/secret-key/1.1/

Use Strong Passwords Throughout

Make sure you are using strong passwords over all of the important layers of your site.  WordPress users have a password strength guide, but you may want to use this tool for the other layers http://www.pctools.com/guides/password/

The passwords you need to check are

• WordPress admin logins
• The WordPress database password (held in wp-config)
• FTP users
• The login to your hosting panel

Don’t use the same password on all layers, and consider changing hte password on a regular basis

Hide WordPress versions

If a hacker knows what version you are running, it makes it easier to find vulnerabilities.  Hide the version of WordPress you are running.  It can be found in two key areas

The file yourdomain.com/readme.html, delete this file.  Note this will be re-isntalled with each new version installed, I like to set the file permissions to 000 on this file.

If you view source of your wordpress page you will see the version written into the source code, this is a good plugin to remove that loop hole http://wordpress.org/extend/plugins/replace-wp-version/

Access Backend via HTTPS

To ensure all access to your backend dashboard is encrypted, I like to do the following

Ensure I can access my site via https, check with your hosting company, you may need to buy an SSL certificate.

Enable the force ssl options,you can either force all logins to be encrypted or all backend activity to be encrypted by adding one of the following commands to yoru wp-config file.

• define(‘FORCE_SSL_ADMIN’, true);
• define(‘FORCE_SSL_LOGIN’, true);

For more details on SSL admin see http://codex.wordpress.org/Administration_Over_SSL

Only FTP To Your Site Using SFTP

Not really a WordPress security fucntion, but only upload and download files to yoru site using SFTp not FTP, your ftp password will be sent in the clear over the net if you use FTP.Check with your hosting company on how to configure SFTP.

For more details on using SFTP see this post https://neilmatthews.com/sftp-flip-sake

Security Plugins

There are a couple of additional security plugins I like to install

wp-malwatch, kind of an anti virus plugin for your site to spot malware

Login lockdown – stops incorrect logins after three attempts and locks the user ID

Want A Secure WordPress Install

If you want me to secure your site, get a quote for a security review from my WordPress technical support page