Circling the Wagons: How to Protect Your Wordpress Site

Written by GlobalMasterPlan on January 24th, 2008

Want to Learn How to Build a Business Not Just a Blog.. for FREE? CLICK HERE Now to Find Out How!

This is a slightly modified version of Matt Cutts post about how to protect your Wordpress Installation.

1. As Matt recommends, lock down your wp-admin directory using this. He uses an .htaccess to block all but a few IP addresses, but there are other ways to do this as well. Here’s Matt’s code. I’m sure all you Aspie’s out there are getting a kick out of this.

2. Once again following Matt, hide your plugins directory by dropping an empty index.html file in wp-admin/plugins directory.

Here is where I diverge from the Google-God.

3. Install the Instant Upgrade Plugin. Make sure you back everything up before performing the upgrades. I haven’t had problems, but others have.

4. Install the Wordpress Database Backups plugin. I have mine set up to email me a backup once a week.

PS - John Cow needs the Lighter Admin Drop Down Menus plugin for this site. :twisted:

Did You Download Your FREE Copy of "How to Build a Business NOT Just a Blog" Yet? Click Here Now to Get Your Copy!

RSS feed | Trackback URI

30 Comments »

Comment by Technology Blog
2008-01-24 02:05:26

Cool tips thanks 4 dat!

 
Comment by Webkinz
2008-01-24 02:27:30

i need to check out that instant upgrade plugin. never knew it existed.

 
Comment by Mike Huang
2008-01-24 03:14:32

Interesting post, I’ll keep this in mind.

-Mike

 
Comment by Neil Duckett
2008-01-24 03:57:49

Good tip on the plug-in, looks like a time saver.

 
Comment by AndrewPavelski
2008-01-24 06:38:25

Thanks for the plugins. I’m going to test out the instant upgrade one very soon!

 
Comment by Si Philp
2008-01-24 09:29:39

Another option would be to setup the admin area as a secure directory so that the user is then confronted with a username/password dialogue? Suppose it depends on how secure you want to be. I like the idea of nailing down ip address access though ( goes off thinking about subtext admin control ).

 
Comment by Enemy
2008-01-24 12:07:31

Thanks for these tips.

Have put some into place!

 
Comment by Allen
2008-01-24 12:08:03

I’d also suggest the wordpress plugin, Login Lockdown which will count the number of attempts someone tries to login in your wp-admin. Then it can block them when they reach the limit of failed login attempts.

This can help you against brute force login attempts.

http://www.bad-neighborhood.com/login-lockdown.html

 
Comment by Koka Sexton
2008-01-24 13:58:25

Thanks for the tips. I am adding all of them now. I never would have thought that a blog would be targeted for these types of attacks.

 
Comment by alanj878
2008-01-24 14:32:17

How about blogger since it is growing so fast. I wish I knew who could show me how to protect blogger.Since I have multiple blogger blogs

http://livelymoney.blogspot.com/2008/01/500-entrecredits-now-ultimate-competion.html

 
Comment by Chris Guthrie
2008-01-24 15:01:37

Hmmm, I already have my dedicated server set up to do a dump to the second harddrive everynight but imo the more backups you do the better.

I think I’ll check this plugin out soon.

 
Comment by Laarni
2008-01-24 15:40:34

Thank you for the tip. WordPress should consider this. HEYYYY! I’m in love with your site.

 
2008-01-24 19:55:17

Thanks for the info on how to do this. I need to get on it.

 
Comment by GlobalMasterPlan
2008-01-25 00:19:10

Thanks for the feedback, everyone.

@alanj878: You’ll have to weigh the pluses and minuses of using a hosted solution like blogger. The main reason I host my own is because I want to have a backup of everything I create and Blogger doesn’t help with this. It’s also more difficult to monetize a hosted site.

 
2008-01-25 03:24:15

Thanks. I think the blank index.html in the plugin directory is a great idea.

 
Comment by Jorge
2008-01-25 15:13:01

Nice tips!

 
Comment by Hafiz Dhanani
2008-01-26 02:00:47

Hmmm. I hate to put a dampener on things, put I’m not convinced that a ’slightly modified’ guest post should be published on a blog like this. I find the time to read John Chow dot Com because I appreciate the value of the blog. I know that the cow is on vacation, but I still don’t think it’s an excuse.

Am I being too harsh? What do you guys think?

 
Comment by shy guy
2008-01-26 08:54:51

I’ve using Wordpress Database Backup plugin from that url..

And I stored it at my computer..

But what I want to do if there’s something wrong with my wordpress??

Coz there’ only a word that I don’t understand at that txtfile…

Maybe you can explain ..

 
Comment by Simon
2008-01-27 21:37:37

@ Hafiz - depends on whether the blog readers gain anything from the post I suppose, although I agree that in general, I’d like to see “original” posts. What constitutes original, on the other hand, is a totally different question. ;)

Just on the blank index.html point, you can achieve the same effect in all directories by creating an .htaccess file in your blog’s root directory (or using the one already there), and adding at the top the line:

Options -Indexes

I just find it easier to deal with all directories at once, rather than looking for any that might be visible manually.

 
Comment by Spoof Videos
2008-01-28 02:26:14

Thanks Cow this is really a good idea and I am going to back up my blog before performing it…Hope it doesnot break my blog and make me MOO

 
Comment by Start Blogging
2008-01-29 23:20:08

I need that instant upgrade plugin. I’m always nervous about upgrading my wordpress!

 
Comment by Sauce The Game
2008-02-07 12:02:28

That auto-backup plugin I think may be one of the most useful plugins you listed there, just thinking about it now. It is good to have a backup on your PC/e-mail that you can easily access in the event of a problem.

 
Name (required)
E-mail (required - never shown publicly)
URI
Subscribe to comments via email
Your Comment (smaller size | larger size)
You may use <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong> in your comment.

Powered by CommentMilk

Trackback responses to this post