As the saying goes, the tall tree catches the wind. WordPress is the most widely used blogging platform in the world, so it's also a prime target for hackers everywhere. Strengthening your WordPress security is something every blogger has to do. WordPress releases security updates every so often, but keeping your site safe also depends on you. A Japanese organization once studied computer incidents (computers being attacked) and found that a large share of them came from user mistakes rather than from problems with the system itself. So in this post, I'll borrow an article from the Chinese blog Moonlight Blog to show you how to check whether your WordPress installation is secure enough.
The following content is quoted from http://www.williamlong.info/archives/1617.html
1. Upgrade WordPress to the latest version
In general, newer versions of WordPress are more secure. They fix known security problems, and major version upgrades may fix even more critical issues. (For example, older versions of WordPress had a serious remv.php vulnerability that could leave you open to DDoS attacks. Upgrading to the latest 2.7 release fixes this problem.)
2. Hide your WordPress version
Edit your header.php template and remove the WordPress version information. That way, hackers can't check the page source to see whether you're running the latest version.
3. Change your WordPress username
Every hacker knows that WordPress's administrator account is "admin" and has administrator privileges, so that's the account they'll target. Create a new user, give it administrator privileges, and then delete the old admin account. This keeps hackers from guessing your administrator username.
Blogger's note
- See this article: https://coder.tw/?p=2222
- If you change it manually, remember to edit the wp-config.php settings as well.
4. Change your WordPress user password
After you install WordPress, the system emails you a random password. Change it. That password is only 6 characters long, so change it to a complex password of at least 10 characters, mixing letters, numbers, and symbols as much as possible.
5. Prevent directory listing of WordPress folders
By default, WordPress installs plugins under /wp-content/plugins/. Normally, browsing that directory lists all the installed plugin names. That's bad, because hackers can use known plugin vulnerabilities to attack. You can prevent this by putting an empty index.html file in that directory. Of course, editing the Apache .htaccess file achieves the same thing.
6. Protect the wp-admin folder
You can protect the WordPress admin folder by restricting access to specific IP addresses. All other IP addresses get a "forbidden" message. The downside is that you can only manage your blog from one or two places. Also, put a new .htaccess file in the wp-admin directory so that the .htaccess file in the root directory can't be replaced.
7. Protection against search engines
Many WordPress system files don't need to be indexed by search engines, so edit your robots.txt file and add the line "Disallow: /wp-*"
Blogger's note: The robots.txt file lives in your site's root directory, and it determines which files search engines are allowed to index.
8. Install the Login Lockdown plugin
This plugin records the IP addresses and times of failed login attempts. If failed logins from one IP address exceed a certain threshold, the system blocks that IP address from trying to log in again.
9. WordPress database security
Don't use the default wp_ prefix for your database tables. Install a database backup plugin. No matter how well you protect your site, you should still back up your database regularly. Plugins such as WordPress Database Backup can make regular backups easy.
Blogger's note: If you didn't change the wp_ prefix during installation, you can edit the database manually or use Wordpress Security Scan to change it.
10. Install the Wordpress Security Scan plugin
This plugin automatically scans your WordPress installation against the security recommendations above and looks for existing problems. It's fairly easy to use.