Server Configuration
1. Disallow bots from scanning the important WordPress directories
By using the Robots.txt ?le it is always a good idea to block the wp-content, wp-admin, etc… directories. This can be done by adding the following line:
Disallow: /wp-*
2. Turn off directory browsing.
Many servers by default allow you to browse the listing of ?les with in a given directory. You may have come across this before when a page is missing or there is no index to a directory. The server outputs a listing of the ?les in the directory instead. This is particularly important in regards to plug-ins. If someone can see which plugins you have on your site they might be able to see which ones are venerable.
This can be done through your .htaccess be using the code below:
Options All -Indexes
3. Protect your WP-ADMIN folder
The wp-admin folder is a critical security point with in WordPress. Denying access to this folder (as well as the wpconfig.php ?le) goes a long way to ensuring that your WordPress site is secure. This can be done in several ways and you may want to do all of them.
3.1 Limit access to your wp-admin folder by IP Address
If you know that you are on an IP Address that doesn’t change you can prevent any intruders by blocking every IP but
your own. The drawback here is that if you are traveling, are off site or trying to update the site from a location that is not your typical one you will be denied access as well.
This can be done through your .htaccess by using the example code below:
<Limit GET POST PUT> order deny,allow deny from all allow from 12.345.67.890 allow from 890.67.345.12 </Limit>
3.2 Limit access to your wp-admin folder through password protection
While not as secure as the IP Address method, it can be extremely effective to simply password protect your folder on the server level. This can also build upon the security enhancement of 3.1. For example if someone is able to spoof your IP address they still would need to hack your password to break in.
The easiest way to setup password protection is through the WordPress htaccess Password Protect Plugin .
Limit access to your wp-admin folder by hiding it There is no reason that your wp-admin folder has to be called wp-admin. Hackers look for this administration folder in
this location. One easy way to eliminate hacking of your site and administration area is simply rename the folder to something else. Simple enough?
Protect your wp-config.php ?le The password to your database is stored in plain, readable text in your con?guration ?le (wp-config.php). Access to your database gives hackers control over your complete site, so to say you need to protect it is an understatement. The ?rst and most obvious step is to ensure the permissions are set correctly. Some servers set the wrong permissions by default which allows anyone who wants to the ability to read the contents of that ?le. The permission should be set using SSH or through an FTP client to 640 chmod 640 wp-config.php
Additionally you can actually move the wp-con?g.php out of the main WordPress directory and still have everything function properly. This way hackers don’t know where to look for the ?le. For example if your wp-config.php is located in /public_html/blog/wp-config.php you could move it to /public_html.
5. Install the 3G Blacklist
A lot of WordPress installations are hosted on an Apache server. If your site is on an Apache server then you can improve the security (not just WordPress) by installing the 3G Blacklist. The 3G Blacklist is:
“a concise, lightweight security strategy for Apache-powered websites…the 3G Blacklist serves as an extremely effective security strategy for preventing a vast majority of common exploits. The list consists of four distinct parts, providing multiple layers of protection while synergizing into a comprehensive defense mechanism.
WordPress Configuration
1. Remove the WordPress version number from the META tags
Some hackers target speci?c versions of WordPress because of known open venerability’s. An easy way to prevent your site from coming up as a target is to simply remove any indicators of the software version.
In older version of wordpress your theme ?le would hav the following code in the header.php that generates a simple tag that outputs the current version:
<meta content=»WordPress <?php bloginfo(’version’); ? />» name=»generator» />
You can prevent this from being an issue by simply deleting that line of code.
Newer versions of WordPress output the version automatically through the wp_head(); function. You can remove these by installing the Secure WordPress plugin .
2. Disable the “Admin” account
By default WordPress creates an “admin” account every time you install it. While the passwords are generated randomly it is never a good idea to let people know the login of your most powerful account. Because all WordPress installations have the same username for the master account you are doing just that.
Simply changing the username from admin to something less obvious will improve the security of your site. This will have to be done through the database as WordPress won’t let you change or remove the account through the administration interface. The account is located in the wp_users table, and you can simply change the account name, display name, etc… to that of your choosing.
3. Change the WordPress table pre?x
All installations of WordPress use the same name for all of the tables on the database. The problem with this is that if a hacker is able to use a SQL injection exploit they know exactly which tables to change data on. If you use an alternative pre?x when you install the software this is prevented.
Already have a WordPress installation? The WP Security Scan plugin can help you switch.
4. Use secure connections when connecting to the ADMIN pages
To prevent data being intercepted between your computer and the server hosting your website you can actually force a secure connection to all of the administration panels. This will require that you purchase and implement a SSL certi?cate from your host ?rst, but once you have done this you can add the following code to your wp-config.php ?le to activate secure administration:
define(‘FORCE_SSL_ADMIN’, true);
5. Use Security Keys
WordPress doesn’t require that you take advantage of their “security key” tool that better encrypts cookies, there by better protecting your passwords. Using security keys is a simple process where you generate a key and make some simple modi?cations to the wp-config.php ?le.
WordPress Plug-ins for Security
1. Login Lockdown Plugin
This simple plugin will record the IP address of every failed login attempt. If there are too many failed attempts from one IP address the login function will be disabled for that IP range. This prevents brute force password break-ins.
2. Invisible Defender Plugin This plugin protects registration, login and comment forms from spambots by adding two extra ?elds hidden by CSS. The idea behind Invisible Defender is simple: SPAMBOTs either ?ll every form ?eld they ?nd (generic spambots) or ?ll WordPress-speci?c ?elds only (spambots which will recognise WP or are targeting WP only).
3. Maximum Security You can perform and identify a lot of the problems outlined in this document automatically through this full featured and robust plugin. It can identify permission issues and has an intrusion protection system.
4. Secure WordPress
Little help to secure your WordPress installation: Remove Error information on login page; adds index.html to plugin directory; removes the wp-version, except in admin area.
5. Secure Admin
Secures Login and Admin pages using Private or Shared SSL.
Original text from 3.7 DESIGNS