10 Easy Ways to Secure your WordPress Blog

Excellent security tips for WP blogs. While I am in the process of upgrading the theme, I should certainly take a look at improvising on security.

Just tweeted this post

it is very true and thanks for the post.

it’s very interesting… i wil try it..thank you very much for this post

Wow. So someone can access a specific file that contains the login and password? I was about to go to bed but now I’ll need to check this out.

Well, I got my site’s dbase hacked down last week, it won’t show anything except the two number: “56″..
One of my friend told me that i should change the database and backup my old content.. Now it is live again..

I’ll try it…

This is a very helpful post.
I already experienced domain defacement in my previous blogs
And I agree that a strong password is very important.
We can include in our passwords not only numbers and letter but also hypens like @#$?*!!, to ensure security.

Great tips, I am going to implement these on my blogs, some of them got hacked recently and google started showing malware warning. Not only I lost a couple of day’s income, they also lost ranking and followers in these days. Had to remove the iframe code from index.php, files in wp-content, wp-includes and theme pages.

I am sure just removing the version code will prevent hacking bots that work on a particular version. I would add 11th way to this, keep looking for new versions and update wordpress version when a new version is available (it’s easy nowadays).

thanks this tips are indeed very useful and i will definitely used in the mentioned above.

@psd to html: You should remove the version because most hacks are targeted towards a particular version of wordpress. Many people also remove such info from their webserver and OS for the same reason.

Glad to read this info. I will apply these tips to secure my wordpress blog. Thanks for sharing this post!

nice post, that is a good plugin, and with that and a good password you should be good until you get huge and attract a lot of attention. i think that if that happens then you can afford to upgrade but this should get you started and be fine for quite a while. good post.

Good article,

is there a way to change the wp-admin folder name?
if not, would you recommend adding a htpasswd file in the wp-admin folder too?

Wordpress security issue is something that everyone should look after at the first place. There are so many hackers and vulnerabilities that can make you life very hard if you are not prepared for them. Thanks for sharing this great wordpress security tips.

Didn’t know about #2 (plugins folder). What has happened to v2.8, thought it was due start of April – just went and checked again after reading your post but still no sign.

I want to have it so when I post on my blog at Wordpress, it will automatically post the same blog on my MySpace page. I know there is a way to do this with forums and bulletin boards – posting on WordPress and having it show up in the forums.

Wow I had no idea Wordpress was so unsafe – I’m definately going to implement these tips. Thank you very much for this!

I’ve installed and used the Security plugin, it works very easily and well.

A really nice tip you have here Sir! Also, you can add removing those footprints created by WP themes.

Excellent security tips for wp bloggers…

Thanks,
Sandeep

NIce tip, my brain is ever expanding with useful knowledge from this blog.

Thanks i will definitely use those mentioned above. These tips are indeed very useful.

It seems I still have a lot to learn in Wordpress. Thanks for sharing.

Thank you for the informations! Especially the tip nr. 6 is great, to protect wp-config.php.
Thanks

I’d add “don’t login from strange computers”. If you’re blog’s making some money buy a laptop and don’t use any other computer. You never know if there are any keyloggers on someone else’s computer.

You offer some very important tips, because with how easy most hosts make it to set up a wordpress site, a lot of new bloggers don’t even think about security.

Regarding #2, protect your plugins, can’t you also add Options -Indexes to your .htaccess file, to stop people from being able to view the contents of a directory?

Nice plugin of WP Security Scan. Thanks for share good tips for secure wordpress blog. Good work.

Nice list there.. Very little people bother to come up with this actually..

Thank you for sharing these tips. I need this to protect several of my wp blogs.

Good list. I picked up a couple plugins I had not yet considered. Thanks.

Good tips. I’ll download wp security plugin for my wordpress blog. Are this types of plugins available of blogspot?

Thanks for the list. It’s amazing to me that blog owners have to go through all of this trouble to prevent worthless people from getting into our sites… Can you tell I’ve been hacked recently?

THANKS FOR THE MUCH NEEDED TIPS TO insure efficiency with Wordpress!

Thanks for this information. I never even thought of some of these security flaws, like people looking at my plugins and finding out info about my site from the plugins I use.

I think there are some errors in your tips.

6. Protect your WP-Config.php file

should be

order deny,allow
deny from all

9. Limit WP-Admin access by IP

should be

order deny, allow
deny from all
allow from a.b.c.d. #your static ip

d 6th point.. for .htaccess file.. when i made the change, my site went down. exactly how do i put it?

Oops. Forgot the code tag:

# protect the htaccess file

order allow,deny
deny from all

# protect wpconfig.php

order allow,deny
deny from all

# disable directory browsing
Options All -Indexes


This is definitely useful tips for wordpress users. I will learn these tips first so I can apply it correctly. Thanks Alex.

Heads up. Your wordpress version is till showing. Nice list of tips. I’ll create my own top 5 secure wordpress tips and link back at this post.

Hey Alex, these tips are simply amazing! You’ve done a great job in putting such an extensive list all together. I am sure I am gonna try out most of them. Thesesafety tricks would definitely prove effective while safeguarding wprdpress powered sites. Thanks a bunch!

Hi Alex, I’m late to the party but can you please include the attribute to my original image as per the terms for usage of the image: http://www.flickr.com/photos/subcircle/500995147/

Very informative post.Thanks for all the tips for secure the word press blog.

This is excellent advice. I am currently using Login Lockdown, and Have the file permissions set to the correct levels on my server. I am also using the blank index.html file in my plugins directory to hide that stuff.

I am not however using the Wordpress version hiding fuctionality. I have plug-ins that won’t work if the Wordpress version is removed from it, and they are plug-ins I desperately need. I am not so sure hiding the version will help much though, as many of those automated bots will simply try the hack regardless of what version your running, if it don’t work they move on. This is akin to the major ports scans you see from bots on the net anymore.

Nonetheless, I didn’t know about the Wordpress Security Scan so I will have to check that out.

thanks for the good information