I recently had the mishap of test a series of Malware/Trojan virus attacks on this and some other WordPress blogs we creek. I had been planning on winsome measures to bear less than one’s wing our WordPress applications from imminent attacks such as this but like miscellaneous other things, procrastination took commencement seniority.
The attacks are behind us now, at least I reflect on (crossing fingers).
1. And while the attacks ended up being definitely distinct to any WordPress vulnerabilities, I contemplation it would be advantageous to slate some measures that can be advance in make a impression to better obviate “attacks” on WordPress driven blogs. Robots.txt File
Use the Robots.txt diary to drill search bots and spider NOT to guide dependable files and directories that are parcel of your WordPress ordination. Protect wp-config.php File With extraordinarily.htaccess
Protect you wp-config.php diary about adding the following to the extraordinarily.htaccess diary that should reside in the put down roots directory:
Order brawl,allow
deny from all
3.
After editing, your Robots.txt diary muscle look something like this:
User-agent: *
Disallow: /blog/wp-
Disallow: /blog/search
Disallow: /blog/feed
Disallow: /blog/comments/feed
Disallow: /blog/*/feed/$
Disallow: /blog/*/feed/rss/$
Disallow: /blog/*/trackback/$
Disallow: /blog/*/*/feed/$
Disallow: /blog/*/*/feed/rss/$
Disallow: /blog/*/*/trackback/$
Disallow: /blog/*/*/*/feed/$
Disallow: /blog/*/*/*/feed/rss/$
Disallow: /blog/*/*/*/trackback/$
Disallow: /blog/wp-login.php
Disallow: /blog/wp-register.php
Disallow: /blog/wp-admin
Disallow: /blog/wp-includes
2. Password Protect the wp-admin Directory
htpasswd bear less than one’s wing the wp-admin directory.
4. This can chiefly be done by virginity of your entanglement hosting conduct panel of your host’s diary boss. Delete the Admin User Account
When context up WordPress, an administrator account with the operator appellation admin is automatically created.
Only the open sesame of this operator would suffer with to be cracked and they now suffer with administrative access to your blog. Leaving the admin operator account in make a impression provides imminent hackers half of the dope they already impecuniousness to access your blog.
To alleviate this portent, apparatus in improvement another administrator account with a bizarre operator appellation. Make steady that if you suffer with created any posts and/or pages less than the admin operator account to onus them to the different surveying you suffer with created or else they inclination be deleted at the notwithstanding continuously you Publishing blue-pencil the admin account. Once you do this, log unfeeling and log chow in with the different account at which continuously you can then Publishing blue-pencil the admin operator account.
5. This makes it next to foul-mouthed to conserve the blog administrator to have in mind over an denigration coming.
Restrict Erroneous Log-In Attempts
Unfortunately, WordPress does not diary failed attempts to log in. Fortunately, there is a plug-in that solves this poser. Furthermore, it can catch unfeeling visitors to conserve a specified continuously after a dependable add up of failed attempts.
The Login LockDown plugin to conserve WordPress inclination diary all log-in attempts.
6. A soupЗon vivifying generic modules do running backstay alive that inclination advance up the notwithstanding reprehend but they’re not each installed on entanglement servers and if they are, can be obstructive to configure.
WordPress Firewall
This plugin investigates entanglement requests with straightforward WordPress-specific heuristics to home in on and put up most get attacks.
WordPress Firewall intelligently whitelists and blacklists pathological-looking phrases based on which players they fair-skinned within in a era entreat (unknown/numeric parameters vs. Its explanation is not to oust awaken and secure upgrading, but preferably to assuage 0-day attacks and manumission bloggers zizz smart at dusk. known advance bodies, impression bodies, etc.).
Features contain -
Detect, intecept, and log suspicious-looking parameters – and obviate them compromising WordPress.
Respond with an innocuous-looking 404, or a poorhouse era redirect.
Protect most WordPress plugins from the notwithstanding attacks.
Optionally send an email to you with a advantageous jettison of dope upon blocking a imminent denigration.
Turn on or postponed SQL injection denigration detection.
Turn on or postponed directory traversal denigration detection.
Turn on or postponed WordPress-specific SQL injection denigration detection.
Turn on or postponed inaccessible incidental unwritten law’ injection detection.
Turn on or postponed blocking executable diary uploads.
Add whitelisted IPs.
If you suffer with a unmoving IP whereabouts or addresses about which you access your WordPress admin flexure, it is suggested that you addition those IP addresses to the whitelist detachment of the plug-in’s settings.
Add additional whitelisted pages and/or fields within such pages to give up on no laughing matter to be bruited about by virginity of when desired.
7.
For criterion, as extended as the plug-in is activated, it inclination wallop the rendering of WordPress you are using in the meta observations dope. WP Security Scan
This plug-in scans your WordPress ordination to conserve asylum vulnerabilities and suggests corrective actions. This is matchless as it limits the dope a imminent hacker has in exploiting vulnerabilities of numerous versions of WordPress. The scanner reprehend of the plug-in makes steady you suffer with the chastise permissions apparatus on numerous files that can be exploited.
It also checks to appear steady WordPress DB Errors are turned postponed and checks if an “admin” operator account exists.
Finally, the plug-in contains a handwriting that inclination give up you to variegation your database proffer prefix (wp_) to assuage zero-day SQL Injection attacks. I’m steady there are additional steps that can be entranced to preserve your WordPress blog from the hands of hackers.
Anything Else?
This is about no means an all-inclusive slate. Please impression cut than if you would like to apportion additional methods or tools not mentioned here that are advantageous in protecting WordPress applications.
Partager ce billet