Improve WordPress Security

Here is a list of tips you can apply to make your WordPress blog more secure 

Keep WordPress updated

The latest WordPress update usually fixes several security issues. If you do not regularly update WordPress to the latest version, malicious users can exploit security vulnerabilities in the older version of WordPress you may have installed and easily gain access to your blog.

Back up your database and website files regularly

Backing up your database and files is very important to prevent their loss in the event of an attack. WP-DBManager is a useful plugin for managing and automating your database backups. It automatically creates a database backup and sends it to the email address you specify in the plugin settings.

Use a complex password

A common mistake is to use a name or other personal information in your password, or to use passwords that are too simple (for example: 1234, house, etc.). A strong password is essential for a user with administrator privileges. When choosing a strong password for your blog or any other account that requires good security, make sure it:

• Is alphanumeric, meaning it contains both numbers and letters.
• Contains both uppercase and lowercase letters.
• Contains special characters (¬ ! #$%…).

Assign the correct permissions (CHMOD) to folders on your server / hosting account

One option is to use the WP Security Scan plugin. This plugin helps you determine whether your WordPress folders on your server / hosting account have the most secure permissions.

Prevent browsing of certain folders

Another basic rule for properly securing WordPress is to prevent visitors from browsing your site's folders.

For example, you should prevent visitors from seeing all the files in a folder when they enter http://www.tunombrededominio.com/wp-admin/.

To prevent this, simply add the following line of code to the .htaccess file in your server's root folder:

Options All -Indexes

Use the robots.txt file to disable access

The robots.txt file tells search engines which folders on your site you do not want their crawlers to explore.

For example, you should disable crawling of the “/plugins” and “/wp-admin“ folders.

To do this, simply copy the following text into a file in Notepad, name it “robots.txt”, and upload it to the root folder of your WordPress site:

#
User-agent: *
Disallow: /cgi-bin
Disallow: /wp-admin
Disallow: /wp-includes
Disallow: /wp-content/plugins/
Disallow: /wp-content/cache/
Disallow: /wp-content/themes/
Disallow: */trackback/
Disallow: */feed/
Disallow: /*/feed/rss/$
Disallow: /category/*

Protect the “/plugins” folder

The plugins you use can provide malicious users with valuable information about your site, so it is best to hide them. To do this, simply create an empty file in Notepad, save it as index.html, and then upload this file to the “/wp-content/plugins/“.

Review comments

Spammers fill blogs with comments if there is no moderation or spam filter. These spam comments can contain links to potentially harmful sites that can affect your readers and even your blog. Here are some plugins you can install to prevent spam in your blog comments:

• Akismet: A plugin for spam protection. It checks comments using the Akismet web service to determine whether they look like spam and gives you the option to mark a comment as spam or not.
• Math Comment Spam Protection: A plugin that asks readers a simple math question before they post a comment. This helps verify that the visitor is a human rather than a spam bot.
• reCAPTCHA: This plugin asks visitors to enter the characters they see in an image (Captcha) to check whether they are a human or a spam bot.

Change the database prefix

To make your database more secure, it is very important to change the default WordPress prefix, since it uses the “wp_” prefix for all tables, and a sufficiently knowledgeable user could exploit this security vulnerability.

The first step is to change the prefix in the following line of the wp-config.php file:

$table_prefix = ‘nuevoprefijo_’;

Next, rename the database tables using the new prefix. To do this, you can run the following SQL statement in your database:

RENAME TABLE wp_comments tonuevoprefijo_comments;
RENAME TABLE wp_links to nuevoprefijo_links;
RENAME TABLE wp_options to nuevoprefijo_options;
RENAME TABLE wp_postmeta to nuevoprefijo_postmeta;
RENAME TABLE wp_posts to nuevoprefijo_posts;
RENAME TABLE wp_terms to nuevoprefijo_terms;
RENAME TABLE wp_term_relationships to nuevoprefijo_term_relationships;
RENAME TABLE wp_term_taxonomy to nuevoprefijo_term_taxonomy;
RENAME TABLE wp_usermeta to nuevoprefijo_usermeta;
RENAME TABLE wp_users to nuevoprefijo_users;

Then run the following SQL statement so that WordPress works correctly:

T option_name = REPLACE(option_name, 'wp_','nuevoprefijo_');
UPDATE t45s4w_usermeta SET meta_key = REPLACE(meta_key, 'wp_','nuevoprefijo_');

Restrict access to files in the /wp-content folder

The wp-content folder contains your WordPress theme files, uploaded images, and plugins. WordPress does not access these files via HTTP. The only requests from a web browser should be for image, javascript, css, and xml files.

For this reason, it is advisable to restrict the “wp-content” folder so that only these file types can be viewed.

To restrict this access, create a file in Notepad, save it as .htaccess, add the following lines, and upload it to the “wp-content” folder of your WordPress installation:

Order deny,allow
Deny from all
<Files ~ “.(php|lock|xml|css|jpe?g|png|gif|js)$”>
Allow from all
</Files>

Block access to the wp-admin folder by IP address

You can restrict access to the “wp-admin“ folder so that only the IP addresses you choose can access it.

To do this, create a “.htaccess” file in the /wp-admin folder with the following lines:

AuthUserFile /dev/null
AuthGroupFile /dev/null
AuthName “Access Control”
AuthType Basic
order deny,allow
deny from all
allow from 000.000.000.000

Remember to replace 000.000.000.000 with the IP address you want to allow access.

Protect the wp-config.php file

The wp-config.php file contains all the information WordPress needs to access your database. Protecting this file is very important for your site's security.

To do this, simply add the following lines of code to the .htaccess file in the root folder of your WordPress server to prevent any bot or person from accessing this file directly:

<files wp-config.php>
order allow,deny
deny from all
</files>

Use secret authentication keys in wp-config.php

These secret keys make your password harder to discover through brute-force attacks. Simply visit WordPress Key Generator and copy the 8 keys into the following lines of the wp-config.php file:

define(‘AUTH_KEY’, ‘Clave auto-generada’);
define(‘SECURE_AUTH_KEY’, ‘Clave auto-generada’);
define(‘LOGGED_IN_KEY’, ‘Clave auto-generada’);
define(‘NONCE_KEY’, ‘Clave auto-generada’);
define(‘AUTH_SALT’, ‘Clave auto-generada’);
define(‘SECURE_AUTH_SALT’, ‘Clave auto-generada’);
define(‘LOGGED_IN_SALT’, ‘Clave auto-generada’);
define(‘NONCE_SALT’, ‘Clave auto-generada’);

Move the wp-config.php file

Since WordPress 2.6, it has been possible to move the file “wp-config.php” from the root folder of the WordPress installation, making malicious access more difficult. Simply move your file “wp-config.php” to any folder within your installation's root folder. If WordPress cannot find it in the root folder, it will automatically search all the other folders for this file.

Rename the “admin“ user

This makes it harder for malicious users to gain unauthorized access to your blog. To do this, simply run the following SQL statement in your database (remember to enter your own username where it says “NuevoUsuario"):

UPDATE wp_users SET user_login = 'NuevoUsuario' WHERE user_login ='admin';

Protect your blog against code injection

The following code protects your blog against code injections that modify the PHP GLOBALS and _REQUEST variables. Paste this into the main .htaccess file:

Options +FollowSymLinks
RewriteEngine On
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
RewriteRule ^(.*)$ index.php [F,L]

Hide the WordPress version

Displaying the WordPress version can give malicious users information about whether your blog is up to date. If it is an older version, they can exploit its flaws and take over the site.

WordPress automatically publishes this information in its theme. The following line of code tells WordPress not to publish it. Simply copy it into the functions.php file of your theme:

<?php remove_action(‘wp_head’, ‘wp_generator’); ?>

Limit login attempts to the WordPress administration panel

Sometimes a malicious user may think they know your password or may have developed a script to discover it. In this case, you need to limit the number of times a user can enter incorrect login credentials. You can easily do this with the Login Lockdown plugin, which blocks a user for X amount of time after they have entered incorrect credentials X times.

Use a secure connection

For security, WordPress users with an SSL certificate enabled for their domain (SSL is a cryptographic protocol that protects communication between networks) should use this encrypted channel to access the administration panel.

To do this, simply add the following code to the wp-config.php file:

define(‘FORCE_SSL_ADMIN’, true);

Hide login errors

When an incorrect username or password is entered, an error message appears on the login page indicating that access failed because the username or password was incorrect. If an attacker enters a correct detail, the error message will help them identify it. It is therefore advisable to remove this error message entirely.

To do this, simply include the following code in your theme's file functions.php:

add_filter(‘login_errors’,create_function(‘$a’, “return null;”));

Remove unnecessary plugins

It is always advisable to remove plugins that are not in use, as they can create security vulnerabilities that an attacker can easily exploit.

Article taken from the blog Trazos Web