Download - WP Adelaide - Wordpress Security (2012-03-27)

WORDPRESS SECURITY

CORE AND PLUGINS

CORE AND PLUGINS

• Always update the core (test first)

CORE AND PLUGINS


• If possible, update all plugins

CORE AND PLUGINS


• If possible, update all plugins

•Monitor website update status (wpremote.com)

FILE PERMISSIONS

FILE PERMISSIONS

• SSH, FTP or a Control Panel’s File Manager?

FILE PERMISSIONS


• Folders – 0755, files – 0644

FILE PERMISSIONS



• Be careful with plugins setting directly permissions

FILE PERMISSIONS



• Be careful with plugins setting directly permissions

• Safe WP uploads (WP Filesystem API)

.HTACCESS

.HTACCESS

• Perishable Press (http://perishablepress.com/5g-blacklist-2012/)

.HTACCESS


•HTML5 Boilerplate (http://html5boilerplate.com/)

.HTACCESS



• Custom .htaccess (advanced)

.HTACCESS



• Custom .htaccess (advanced)

• Check logs (advanced)

HARMFUL PLUGINS

HARMFUL PLUGINS

• Be very cautious of plugins that upload files (even images) and bypassing WP’s Filesystem API

HARMFUL PLUGINS

• Be very cautious of plugins that upload files (even images) and bypassing WP’s Filesystem API

•One that does bypass it is Wordpress Download Monitor (by Mike Jolley)

OTHER THINGS TO KEEP IN MIND


• 24h monitoring site live status (http://uptimerobot.com/)



• Keep file and DB backups




•Make sure your passwords to the DB and WP are safe:





• Capitals and lowercase letters, Numbers and Symbols






• At least eight characters long






• At least eight characters long

• If possible don’t use words that are found in the dictionary