The virtual world is unsafe. You may not have been the target of a phishing attack or a hack but that doesn’t mean you are immune or safe. When military networks and some of the most secured servers of global conglomerates are not immune, how secured is your website.
WordPress is an open source content management system. Millions of people have access to the same platform that you have used to host your website. It is obvious that many out there know much more about how WordPress functions and where its vulnerabilities lie. You should try and plug whatever loopholes that may exist. Truth be told, you cannot protect yourself from the kind of hacking attempts that Sony or the likes of Ashley Madison have faced recently. But you can protect yourself from the simpler threats. Here are some WordPress security vulnerabilities you should know. Here is a look at some WordPress security vulnerabilities you should know.
WordPress is just like any other software that attempts to fix its existing loopholes through the various upgrades. Every upgrade or new version comes with its existing bugs fixed. Thus, you must always upgrade your WordPress site. You may not like upgrading, you may have to work a bit harder every time there is an upgrade and you may have to work on the compatibilities of themes and plug-ins. It is quite likely that some themes and plug-ins would be done away with in a new upgrade and you may be compelled to redo your website from scratch or indulge in some substantial changes. Despite the inconvenience that you may have, you should upgrade. That is the only way you can have any existing problems or security vulnerabilities fixed.
Whether you upgrade or not, you must not make it obvious to any random visitor as to which version of WordPress you are using. Letting this information out in the public or making it accessible will allow miscreants to use the shortcomings of that particular version of WordPress. Let the miscreants work a tad harder than just visiting your site to know the version of WordPress you are using. You can remove the information pertaining to WordPress version from your site, which is typically in your page header meta and readme.html file, by inserting a code into your theme’s functions.php file.
The code is:
function remove_wp_version() {
return ”;
}
add_filter(‘the_generator’, ‘remove_wp_version’);
This will take care of the header. The readme.html file can be just renamed to protect the information.
You must limit the access that anyone can get or may have to plug-in and theme files. There is a theme file editor in WordPress that anyone having access to your dashboard will get access to. You must disable this access. Add this code to your functions.php file: define(‘DISALLOW_FILE_EDIT’, true);
You should have maximum login attempts to your site. You can consider having a timeout as well. This applies to all WordPress sites, whether you have the facility of members and visitors registering and using the site or you don’t have any such feature. Some websites may have universal registration option. Regardless of what type of site you have and what kind of access you allow normal visitors, you must not allow anyone to have unlimited attempts to login. This will embolden the hackers or anyone who has access to some tool that can be used to generate a password. Using unlimited combinations of username and password, any account can be accessed, whether it is Gmail or WordPress sites. Restrict how many times an IP address can be used to try and login to your WordPress site. Also decide how long before another attempt can be made from that same IP address. Have notification systems as well for any successful login attempt.
WordPress has an inherent problem where it will tell someone trying to gain access to a control panel if the username is wrong or the password. Should the username be right and get acknowledged, the miscreant would know for certain when WordPress notifies that the password is wrong for the given username. This problem can be fixed. You can change the message that is displayed at the time of invalid username/password notification. You can use the following code in your functions.php file:
function failed_login() {
return ‘The login information you have entered is incorrect.’;
}
add_filter(‘login_errors’, ‘failed_login’);
From limited login attempts to having a strong password, using safe plug-ins to upgrading WordPress whenever there is a new version, there are many ways you can protect your site and your content. WordPress allows numerous third party and open source tools to be used on the site. You must be careful what you choose to use. One malware loaded plug-in or one virus infected theme can make your site go kaput. WordPress alone cannot be blamed for all its security vulnerabilities. The nature of use can increase or reduce the security risks.
