{"id":2880,"date":"2013-04-15T13:39:46","date_gmt":"2013-04-15T17:39:46","guid":{"rendered":"https:\/\/www.highedwebtech.com\/?p=2880"},"modified":"2013-10-18T13:30:33","modified_gmt":"2013-10-18T17:30:33","slug":"secure-wordpress","status":"publish","type":"post","link":"https:\/\/www.highedwebtech.com\/2013\/04\/15\/secure-wordpress\/","title":{"rendered":"5 ways to secure WordPress easily"},"content":{"rendered":"

If you haven’t seen the news, there’s a massive attack going on against non secure WordPress sites. Sites are being hammered with requests to log in and once a match is found, the site\u00a0becomes part of a massive botnet. From the Ars story<\/a>:<\/p>\n

The unknown people behind the highly distributed attack are using more than 90,000 IP addresses to brute-force crack administrative credentials of vulnerable WordPress systems, researchers from at least three Web hosting services reported. At least one company warned that the attackers may be in the process of building a “botnet” of infected computers that’s vastly stronger and more destructive than those available today. That’s because the servers have bandwidth connections that are typically tens, hundreds, or even thousands of times faster than botnets made of infected machines in homes and small businesses.<\/p><\/blockquote>\n

So, what can you do to build a secure WordPress installation? A few things.<\/p>\n

1. Get the Better WP Security plugin<\/strong>
\nThis plugin<\/a> by\u00a0Chris Wiegman\u00a0gives you a ton of options to better secure WordPress, including interesting features like turning off your WP admin area during certain parts of the day. Grab the plugin from the WordPress repository here<\/a>.<\/p>\n

2. Use strong passwords
\n<\/strong>WordPress likes strong passwords, but make sure you have many users or a multisite setup, you should require all levels of users to use strong passwords. If you are generating passwords when you add a new WP user, use a strong one. I use this site often\u00a0to generate random keys and passwords<\/a>.<\/p>\n

Why are strong passwords important? Let’s look at three potential passwords: doctor1<\/code>,\u00a06TrSB45aO6<\/code> and\u00a0bl+4NF=(N35+ixq<\/code>.<\/p>\n

We should immediately not use the doctor1 code as its based on a dictionary word. If we use WolframAlpha to analyze this password, it returns that it’s a very weak password and this data:<\/p>\n

number of passwords | ~~ 2^36~~78.36 billion
\ntime to enumerate | ~~ 9.07 days (at 100000 passwords per second)
\npassword entropy | 36.19 bits<\/code><\/p>\n

For the password 6TrSB45aO6<\/code>, WolframAlpha calls this password very strong.<\/p>\n

number of passwords | ~~ 2^57~~174.9 quadrillion
\ntime to enumerate | ~~ 55456 years (at 100000 passwords per second)
\npassword entropy | 57.28 bits<\/code><\/p>\n

55,000 years to enumerate compared to 9 days on the last password, that’s pretty good. Let’s run the last one.<\/p>\n

WA calls bl+4NF=(N35+ixq<\/code> a very strong password and gives this data:<\/p>\n

number of passwords | ~~ 2^98~~3.953\u00d710^29
\ntime to enumerate | ~~ 125.3 quadrillion years (at 100000 passwords per second)
\npassword entropy | 98.32 bits<\/code><\/p>\n

Where it took 55,000 years last time, now it takes 125.3 quadrillion years<\/strong>. Can you even comprehend that number, and that’s trying 100,000 passwords a second. That’s a strong password.<\/p>\n

3. Use a password manager<\/strong>
\nBut Mike, you’re saying, how can I remember a password like bl+4NF=(N35+ixq<\/code>? Easy. Use a password manager. This one isn’t directly related to a secure WordPress, but if you create yourself a 40 character password, you’ll be safe. How safe? Let’s run one through WolframAlpha. Let’s use this one:<\/p>\n

FJpJi28pcAafzrt:Z9RSeb0kfRhszb.(0P]cN9LV<\/code><\/p>\n

At 100,000 passwords a second, that one would take 2.669\u00d710^66 years. I’m not even sure how many zeros that number would have. A lot.<\/p>\n

I use 1password<\/a> and all my passwords are 50 characters, for everything. It’s a bit pricey, but I was able to find a half-off coupon on the web pretty easily. What’s nice is that you can store your passwords securely in Dropbox and have all your passwords at home, the office and so on. LastPass<\/a> is another good alternative.<\/p>\n

4. Remove your admin user and change your database prefix<\/strong>
\nMany times, when you set up WordPress, the admin user is made by default. This is fine at first, but immediately create a new user, give that user administrative powers and remove the admin user. That’s a common target for hackers.<\/p>\n

It\u2019s good WordPress security practice to rename your tables from the default titles, because hackers often look for installs that haven\u2019t been changed, and can write their malware to look for tables named in most cases the default, such as wp_usermeta.<\/p>\n

The best time to change it is when you\u2019re first installing WordPress, but it is possible to do it after. I\u2019d recommend using a plugin like Better WP Security. It will do the heavy lifting for you. But if you\u2019re feeling adventurous, you can do it manually, by adding this line to your wp-config.php file:<\/p>\n

$table_prefix  = 'wp_2f2fss_';<\/pre>\n
You can make it whatever you like, just make sure you end it with an underscore. The next step is to rename your real database tables. This is slightly more tricky if you don\u2019t have access to the database itself or something my PHPMySQL admin. You can learn more about this process here<\/a>.<\/p>\n
5. Add another layer of authentication to your site<\/strong>
\n\"\"For several months, I’ve used Google’s Authenticator<\/a> app to sign into all of Google’s products as well as other sites that support it like Dropbox.<\/p>\n
While it’s a pain to enter in one more piece of data, it’s as easy as copying the information from your phone, which is something we all have with us 24\/7. When you login to Google, you’re asked for a 6 digit code, which you can have texted or called to you or use the Google Authenticator app, which gives you the code to enter.<\/p>\n
On your phone, it looks like this:<\/p>\n
\"\"<\/p>\n
There’s a WordPress plugin you can install to add this level of 2-factor authentication to your blog. The setup takes just a few moments. That screen looks like:<\/p>\n
\"\"<\/a><\/p>\n
That QR code there? Just take a picture of it with the Authenticator app and it knows all it needs to know to start generating keys for you. Once you’re all set, your WordPress login screen will look like this:<\/p>\n
\"Screen<\/p>\n
That, friends, is a pretty secure WordPress setup. Chances are very slim to none someone is going to crack both your strong password and the code generated by Google.<\/p>\n","protected":false},"excerpt":{"rendered":"
So, what can you do to build a secure WordPress installation?<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-gradient":""}},"footnotes":""},"categories":[58,64,68,79],"tags":[],"yoast_head":"\n5 ways to secure WordPress easily - HighEdWebTech<\/title>\n<meta name=\"description\" content=\"So, what can you do to build a secure WordPress installation?\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.highedwebtech.com\/2013\/04\/15\/secure-wordpress\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"5 ways to secure WordPress easily - HighEdWebTech\" \/>\n<meta property=\"og:description\" content=\"So, what can you do to build a secure WordPress installation?\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.highedwebtech.com\/2013\/04\/15\/secure-wordpress\/\" \/>\n<meta property=\"og:site_name\" content=\"HighEdWebTech\" \/>\n<meta property=\"article:published_time\" content=\"2013-04-15T17:39:46+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2013-10-18T17:30:33+00:00\" \/>\n<meta property=\"og:image\" content=\"http:\/\/www.google.com\/landing\/2step\/images\/how-works-img-1.png\" \/>\n<meta name=\"author\" content=\"Mike\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@mrichwalsky\" \/>\n<meta name=\"twitter:site\" content=\"@mrichwalsky\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Mike\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.highedwebtech.com\/2013\/04\/15\/secure-wordpress\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.highedwebtech.com\/2013\/04\/15\/secure-wordpress\/\"},\"author\":{\"name\":\"Mike\",\"@id\":\"https:\/\/www.highedwebtech.com\/#\/schema\/person\/c923dc4801e5e0b88fa4def573701980\"},\"headline\":\"5 ways to secure WordPress easily\",\"datePublished\":\"2013-04-15T17:39:46+00:00\",\"dateModified\":\"2013-10-18T17:30:33+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.highedwebtech.com\/2013\/04\/15\/secure-wordpress\/\"},\"wordCount\":911,\"publisher\":{\"@id\":\"https:\/\/www.highedwebtech.com\/#\/schema\/person\/c923dc4801e5e0b88fa4def573701980\"},\"image\":{\"@id\":\"https:\/\/www.highedwebtech.com\/2013\/04\/15\/secure-wordpress\/#primaryimage\"},\"thumbnailUrl\":\"http:\/\/www.google.com\/landing\/2step\/images\/how-works-img-1.png\",\"articleSection\":[\"PHP\",\"Security\",\"spam\",\"wordpress\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.highedwebtech.com\/2013\/04\/15\/secure-wordpress\/\",\"url\":\"https:\/\/www.highedwebtech.com\/2013\/04\/15\/secure-wordpress\/\",\"name\":\"5 ways to secure WordPress easily - HighEdWebTech\",\"isPartOf\":{\"@id\":\"https:\/\/www.highedwebtech.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.highedwebtech.com\/2013\/04\/15\/secure-wordpress\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.highedwebtech.com\/2013\/04\/15\/secure-wordpress\/#primaryimage\"},\"thumbnailUrl\":\"http:\/\/www.google.com\/landing\/2step\/images\/how-works-img-1.png\",\"datePublished\":\"2013-04-15T17:39:46+00:00\",\"dateModified\":\"2013-10-18T17:30:33+00:00\",\"description\":\"So, what can you do to build a secure WordPress installation?\",\"breadcrumb\":{\"@id\":\"https:\/\/www.highedwebtech.com\/2013\/04\/15\/secure-wordpress\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.highedwebtech.com\/2013\/04\/15\/secure-wordpress\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.highedwebtech.com\/2013\/04\/15\/secure-wordpress\/#primaryimage\",\"url\":\"http:\/\/www.google.com\/landing\/2step\/images\/how-works-img-1.png\",\"contentUrl\":\"http:\/\/www.google.com\/landing\/2step\/images\/how-works-img-1.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.highedwebtech.com\/2013\/04\/15\/secure-wordpress\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.highedwebtech.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"5 ways to secure WordPress easily\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.highedwebtech.com\/#website\",\"url\":\"https:\/\/www.highedwebtech.com\/\",\"name\":\"HighEdWebTech\",\"description\":\"Web & Marketing for Education & Nonprofits\",\"publisher\":{\"@id\":\"https:\/\/www.highedwebtech.com\/#\/schema\/person\/c923dc4801e5e0b88fa4def573701980\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.highedwebtech.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/www.highedwebtech.com\/#\/schema\/person\/c923dc4801e5e0b88fa4def573701980\",\"name\":\"Mike\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.highedwebtech.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/www.highedwebtech.com\/wp-content\/uploads\/2019\/11\/HEWT-2020-Logo.png\",\"contentUrl\":\"https:\/\/www.highedwebtech.com\/wp-content\/uploads\/2019\/11\/HEWT-2020-Logo.png\",\"width\":595,\"height\":128,\"caption\":\"Mike\"},\"logo\":{\"@id\":\"https:\/\/www.highedwebtech.com\/#\/schema\/person\/image\/\"},\"sameAs\":[\"https:\/\/www.instagram.com\/mikerichwalsky\/\",\"https:\/\/twitter.com\/mrichwalsky\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"5 ways to secure WordPress easily - HighEdWebTech","description":"So, what can you do to build a secure WordPress installation?","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.highedwebtech.com\/2013\/04\/15\/secure-wordpress\/","og_locale":"en_US","og_type":"article","og_title":"5 ways to secure WordPress easily - HighEdWebTech","og_description":"So, what can you do to build a secure WordPress installation?","og_url":"https:\/\/www.highedwebtech.com\/2013\/04\/15\/secure-wordpress\/","og_site_name":"HighEdWebTech","article_published_time":"2013-04-15T17:39:46+00:00","article_modified_time":"2013-10-18T17:30:33+00:00","og_image":[{"url":"http:\/\/www.google.com\/landing\/2step\/images\/how-works-img-1.png"}],"author":"Mike","twitter_card":"summary_large_image","twitter_creator":"@mrichwalsky","twitter_site":"@mrichwalsky","twitter_misc":{"Written by":"Mike","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.highedwebtech.com\/2013\/04\/15\/secure-wordpress\/#article","isPartOf":{"@id":"https:\/\/www.highedwebtech.com\/2013\/04\/15\/secure-wordpress\/"},"author":{"name":"Mike","@id":"https:\/\/www.highedwebtech.com\/#\/schema\/person\/c923dc4801e5e0b88fa4def573701980"},"headline":"5 ways to secure WordPress easily","datePublished":"2013-04-15T17:39:46+00:00","dateModified":"2013-10-18T17:30:33+00:00","mainEntityOfPage":{"@id":"https:\/\/www.highedwebtech.com\/2013\/04\/15\/secure-wordpress\/"},"wordCount":911,"publisher":{"@id":"https:\/\/www.highedwebtech.com\/#\/schema\/person\/c923dc4801e5e0b88fa4def573701980"},"image":{"@id":"https:\/\/www.highedwebtech.com\/2013\/04\/15\/secure-wordpress\/#primaryimage"},"thumbnailUrl":"http:\/\/www.google.com\/landing\/2step\/images\/how-works-img-1.png","articleSection":["PHP","Security","spam","wordpress"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.highedwebtech.com\/2013\/04\/15\/secure-wordpress\/","url":"https:\/\/www.highedwebtech.com\/2013\/04\/15\/secure-wordpress\/","name":"5 ways to secure WordPress easily - HighEdWebTech","isPartOf":{"@id":"https:\/\/www.highedwebtech.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.highedwebtech.com\/2013\/04\/15\/secure-wordpress\/#primaryimage"},"image":{"@id":"https:\/\/www.highedwebtech.com\/2013\/04\/15\/secure-wordpress\/#primaryimage"},"thumbnailUrl":"http:\/\/www.google.com\/landing\/2step\/images\/how-works-img-1.png","datePublished":"2013-04-15T17:39:46+00:00","dateModified":"2013-10-18T17:30:33+00:00","description":"So, what can you do to build a secure WordPress installation?","breadcrumb":{"@id":"https:\/\/www.highedwebtech.com\/2013\/04\/15\/secure-wordpress\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.highedwebtech.com\/2013\/04\/15\/secure-wordpress\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.highedwebtech.com\/2013\/04\/15\/secure-wordpress\/#primaryimage","url":"http:\/\/www.google.com\/landing\/2step\/images\/how-works-img-1.png","contentUrl":"http:\/\/www.google.com\/landing\/2step\/images\/how-works-img-1.png"},{"@type":"BreadcrumbList","@id":"https:\/\/www.highedwebtech.com\/2013\/04\/15\/secure-wordpress\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.highedwebtech.com\/"},{"@type":"ListItem","position":2,"name":"5 ways to secure WordPress easily"}]},{"@type":"WebSite","@id":"https:\/\/www.highedwebtech.com\/#website","url":"https:\/\/www.highedwebtech.com\/","name":"HighEdWebTech","description":"Web & Marketing for Education & Nonprofits","publisher":{"@id":"https:\/\/www.highedwebtech.com\/#\/schema\/person\/c923dc4801e5e0b88fa4def573701980"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.highedwebtech.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/www.highedwebtech.com\/#\/schema\/person\/c923dc4801e5e0b88fa4def573701980","name":"Mike","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.highedwebtech.com\/#\/schema\/person\/image\/","url":"https:\/\/www.highedwebtech.com\/wp-content\/uploads\/2019\/11\/HEWT-2020-Logo.png","contentUrl":"https:\/\/www.highedwebtech.com\/wp-content\/uploads\/2019\/11\/HEWT-2020-Logo.png","width":595,"height":128,"caption":"Mike"},"logo":{"@id":"https:\/\/www.highedwebtech.com\/#\/schema\/person\/image\/"},"sameAs":["https:\/\/www.instagram.com\/mikerichwalsky\/","https:\/\/twitter.com\/mrichwalsky"]}]}},"_links":{"self":[{"href":"https:\/\/www.highedwebtech.com\/wp-json\/wp\/v2\/posts\/2880"}],"collection":[{"href":"https:\/\/www.highedwebtech.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.highedwebtech.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.highedwebtech.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.highedwebtech.com\/wp-json\/wp\/v2\/comments?post=2880"}],"version-history":[{"count":0,"href":"https:\/\/www.highedwebtech.com\/wp-json\/wp\/v2\/posts\/2880\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.highedwebtech.com\/wp-json\/wp\/v2\/media?parent=2880"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.highedwebtech.com\/wp-json\/wp\/v2\/categories?post=2880"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.highedwebtech.com\/wp-json\/wp\/v2\/tags?post=2880"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}