Own WordPress Blog

How To Protect Your WordPress Blog From Hackers

Costa Fong — Fri, 18 May 2012 02:57:09 +0000

This is part 2 of the series on how to prevent your WordPress Blog from being hacked. Part 1 can be viewed here.

Transcript -

Hi! In step two, I want to show you another way to add an extra layer of protection to your WordPress site, and that’s to create two administrator accounts – the one from the install and another just in case you’re locked out because of a plug-in foul up or you screwed something up with your main administrator account or whatever the reason.

It’s better to have this little safety net and never need it than to be totally locked out of your site. Now, of course, you should not use admin as either of your administrator usernames.

Now, in the login details text document that we created in step one you had organizational stuff, go ahead and break that out and list your second admin user name and your strong password and let’s head on into the dashboard of our WordPress site and we’re gonna click on Users in the subpanel right here. We’re gonna go to Add New. And it will be helpful too to have access, you know, that login details text document, go ahead and scroll down to where you’ve added your email addresses too because you want to put that in right here. But first off, we’re gonna put in a username – again, not admin – and our strong password right in here.

We’ll just copy this from our text document because we went ahead and typed out our username and password on that text document first, so now it’s just a matter of copy and paste. And when you paste it in here, you’ll see the strength indicator either tell you that it’s weak or get out or it’s okay or it’s strong, and it’ll be green for go. And we are green for go. Type it in again. Of course, in my case, paste it in. And I’d say yes, go ahead and click on this. That way, the password and everything will be sent to the email address here, but that could be a little overkill because if you’ve got things organized properly, then you already have this stuff typed out on your login details text document anyway.

So, however you want to do that. The key thing, though, here under role, make that administrator. Click on Add New User. Now you can see you’ve got two in the administrator role section, and that’s what you’re looking for. Just in case this one here is attacked or hacked or, like I said, you’ve got a plug-in issue and it’s totally locked you out, whatever the case, you’ll still have access to everything via this administrator login. And, of course, you can also usually fix some of those issues by getting into your database but this is always helpful to have too. And, like I said, better to have it and not need it than to need it and not have it. That’s gonna bring us to the end of step two in adding an extra layer of protection to your WordPress site.

How To Prevent Your WordPress Blog From Hackers – Part 1 (Transcript) In this video, I want to talk about securing...

How To Prevent Comment Spam With MORE Than Akismet

Costa Fong — Wed, 09 May 2012 01:38:37 +0000

Yes, you can prevent comment spam with akismet, but by itself, Akismet is inadequate when you get more than just a few spammers attacking your comment forms.

Akismet is a WordPress plugin, bundled with the base software, that performs a very specific function. Each time a visitor posts a comment, the entire comment (including the comment headers) are sent to the Akismet service, where heuristics are performed. If a comment is identified as spam, it’s flagged as such in your database.

The problem with Akismet is the same problem that most spam filtering services have – false positives. Also, the filter is only as good as the people who flag comments (which haven’t been flagged already) as spam. Since the spam gangs move from server to server and use malware to send it from home PCs, Akismet is always going to be at least one step behind. The solution is to use multiple plugins that perform specific functions.

Growmap Anti Spambot Plugin

The Growmap Anti Spambot Plugin adds a checkbox and a sentence for the visitor to confirm that they are not a spammer. This stops most spam comments dead in their tracks because the majority of comment spam is automated. The reason it works is because it requires JavaScript being enabled on the visitor’s browser – most automated spambots do not use JavaScript.

It doesn’t stop human spammers unless human spammers have a conscience and 99.9 percent of them do not. For those it catches (mainly spambots), no other processing takes place, saving on server CPU resources and bandwidth.

Conditional CAPTCHA for WordPress

Conditional CAPTCHA for WordPress doesn’t even engage unless a comment is flagged as spam by Akismet. Once it does engage, however, the visitor is presented with CAPTCHA page and if filled out correctly, the comment will be placed in one of the queues. If it’s not filled out correctly, it can be trashed.

From personal experience, I’ve noticed very few human spammers actually filling out the CAPTCHA form.

The Result is the Only Thing that Counts

I get very few spam comments on my oldest blog (usually less than 10 per day) where I get more than 2000 visitors a day. I was getting more comment spam when I had less than 1000 visitors per day and that was because I relied on Akismet alone at the time.

There’s an old saying in the US, “your mileage may vary”, and it originally applied to gasoline consumption by American cars. It applied in the current context in that your results may not be as good as mine or they may be better than mine. I have a custom script available for people who are being bombarded by comment spam from specific sources but I’m not actually using it because these three plugins, when used together, works well enough without it.

About the Author

RT Cunningham writes about his personal projects and the websites he’s working on at RTCX.NET, from his home in the Philippines

How To Prevent Comment Spam With Akismet [See post to watch Flash video]...
Start Your Own WordPress Blog Part 11 – WordPress Plugins And Users Continuing this series of Starting Your Own WordPress Blog, after...
How To Prevent Your WordPress Blog From Hackers – Part 1 (Transcript) In this video, I want to talk about securing...

How To Prevent Your WordPress Blog From Hackers – Part 1

Costa Fong — Tue, 08 May 2012 05:33:20 +0000

(Transcript)

In this video, I want to talk about securing your WordPress site from the installation process.

So, the first thing you want to not do is you do not want to use the word admin as your administrator username. Back in the day, the manual process of installing WordPress, they did that for you. They installed automatically admin as your administrator username. And there are even still, to this day, some scripts out there, like SimpleScripts for example, that will do that as well. The thing is, though, is that when somebody who’s trying to hack in or break into your WordPress site, they’re aware of that and they’ve got basically two things, that’s all, just two things to figure out to be able to wreak havoc all over your site – the username and the password.

Now, if you’re using admin as a username, they’re probably gonna try that first off, and you’re basically giving up half the battle right there. So if you give a lame password, like, you know, maybe your birth date or something, and they’re gonna find that out most times by checking out your Facebook account, then they’re in. They’re breaking into your site and, you know, you’re up the creek without a paddle, so to speak. So, do not use admin as your username and use a strong password.

Now, as far as passwords, myself, I use a software called RoboForm. You can find it online. I believe it’s roboform.com, maybe, roboform.net. Do a search for RoboForm and you’ll find it.

You can use, in this case, click on generate, and the way I’ve got it set up here, I’ve got a minimum of eight characters, a maximum of twelve and special characters, numbers, upper, lower case letters, the whole nine yards. And whenever something asks for a password, I pop this guy out, click on generate new, boom! … does that. This box checked. It’s already in my clipboard so I can paste it to a text document somewhere which, by the way, brings me to a good organizational tool, and that is as soon as I get a domain and I have it established with a CPL control panel, I’ll create a folder structure kind of like this.

I’ve got a folder on my computer listing all my sites, all my domains, and in a particular domain folder, I have a couple more folders – one for backups, which contains a couple more folders for database and files which, by the way, if you use a software program like WTwin, you can find it at … WP Twin, you can find that at wptwin.net. It’s about $50 to $100. That takes care of this for you all in one fell swoop. Totally awesome! Check that out if you’re into backing up things on a regular basis, which you should be, by the way.

I’ve also got another folder here called Images. But what I’m leading up to is this character right here. I would name this text document XYZ whatever my domain name is dash login, my lack of imagination stuff. Open this up and, basically, in here I’ve got just about everything that’s associated with that domain, from the FTP and CPL login stuff and my username and password for my blogs, whether it is a network or a multi-site set up on that blog or a number of blogs associated with that domain. I’ve got them all in this one text document, I’ve got email addresses that are associated with that domain, Gmail account, YouTube account, Google Analytics, everything I got associated with that domain, boom! … in one text document.

Do that for every single domain right from the get go. That way, when you get to the point of creating your WordPress site, whether it’s from manual or from one of those one-click wonders, like SimpleScripts or Fantastico De Luxe, you’ve got everything you need right here that can be quickly added. And whenever your site is created, go ahead and copy down the database name, username and password, and again you’ve got everything right here. Just as an example here, anytime I make a change, I note the date the change took place and the original or the prior password in this example. So if we come on over to my C-panel control panel, for example, and, in this case, my host is D9. your host, you more than likely will have Fantastico De Luxe but some of them nowadays are kind of adding to, some of them are even phasing out Fantastico De Luxe because, as cool as it is, it rarely has updated scripts.

For example, this one here under WordPress 3.1, which is so six months ago. Let me show you another one here. The one I like the best in this particular hosting package is Softaculous. We checked this one out. All the software scripts in here that I use anyway are up to date. For example, WordPress version 3.3.1 came out yesterday. At the time of this recording, this came out yesterday noon. So, less than 24 hours ago, they’ve already got this one.

Actually, I checked this last night and this is already in there, so it’s almost instantaneous, so something to be aware of. So that’s one of the pluses with Softaculous. The drawback with Softaculous and another one is SimpleScripts with my host monster account, those do have admin as the username. Softaculous allows you to change it before you install the WordPress program. SimpleScripts with host monster does not.

So that’s one thing I wanted to point out real quick is that if you already have admin as your username or you are using a host monster hosting account and a SimpleScripts installation which installed your WordPress site using admin as your username, here’s how you can fix that. Login to your PHP my admin account. Choose the database that’s associated with that particular WordPress site. Down at the very bottom, more times than not, you’ll see a table called Users. Just click on that and you’ll see right here under User the word admin. I know, you don’t see that in my case because I don’t use admin as my username but, in your case, you probably would. And what you want to do is you want to change that. Come over here and click on Edit. Come on up here where it says user log in, blah, blah, blah.

Change this from admin, if that’s what it’s showing, to whatever else you want it to be. And while you’ve got your text document out – because I know you are now keeping things organized, right? – go ahead and copy that in here so you got it. Don’t forget to save that too. Likewise, once you’ve changed this, come on down here and click on Go, and that saves it for you. And you are good to go. So that’s it for that.

A couple of other things I wanted to mention before I move on to step two of securing your WordPress site is that whenever you go to log in to your WordPress site and if you are an avid laptop user … Let me log out of here and I’ll show you what I mean … do not check this box. Frankly, even if you’re a desktop user, I would try to discourage you from checking this box. While it is convenient to simply navigate to your login page and your stuff’s gonna automatically be populated in there, click on login and you’re good to go, but what if you’re not the one at your computer, what if you’re not the one at your laptop because somebody just stole your laptop and they are now at your laptop or at your computer? They open this up, boom! … they are now wreaking havoc on your WordPress site. So, again if you’re a laptop user or even a desktop user, try not to use that. I use RoboForm not just for generating passwords but also for logging into sites like this. *[07:39] and there we are.

One last item I want to cover with you before moving on is that you want to try to keep your stuff up to date. In other words, when WordPress comes out with a new version like it did yesterday, you want to update it. Whenever you’ve got plug-ins that come out with updates, you want to update those as well. And, usually, when WordPress comes out with a new version, plug-ins you have installed are soon to follow to stamps dated with the new WordPress version.

The thing is, though, sometimes, depending upon what plug-ins you’ve got installed, sometimes a new version of WordPress may not place nice with those particular plug-ins and vice versa. So my suggestion is to go ahead and install a test WordPress site while you’re in the installation frame of mind. You’ve just installed your new WordPress site, go ahead and install another one in a subdirectory called Test Blogger, Tester, whatever. That way, you can test these new installs, these new updates, these new upgrades before you test in on your main site. If it’s gonna break your test site, by all means, don’t install it or upgrade it on your main site until the creators of the plug-in or the creators of the new version of WordPress get together with each other and make things compatible with one another.

While I do suggest highly that you keep your site up to date, you don’t want to do so at the risk of breaking your site. That’s kind of counter-productive. So, having a test site where you can test out these new upgrades is really the best way to go. And, frankly, if you are interested in getting that program I was talking about, WP Twin at wptwin.net, that is perfect. That way, you can go ahead and create your test site and once you’ve got your main site completely created, plug-ins installed, activated, couple of posts in there and everything, before you test your new install or new updates on your test site, do a clone of your main site, install that clone on your test site.

That way, your test site is an exact replica of your main site. Then go ahead on your test site, pull in the new version of WordPress, the updates to the themes, the updates to the plug-ins, and if it doesn’t break then, then you know for certain that your main site will not break either, then go ahead and do the updates on your main site. That way, you’re not gonna be frustrated. Yes, it’s gonna take a couple of extra minutes to do the pre-testing on your test site but wouldn’t you rather spend a couple of extra minutes doing that than a couple of extra days having to rebuild your blog because it broke from that new install or upgrade. Just my two cents worth.

That’s gonna bring us to the end of step one in securing your WordPress site. I’ll see you in step two.

How To Prevent Comment Spam With MORE Than Akismet Yes, you can prevent comment spam with akismet, but by...
How To Prevent Comment Spam With Akismet [See post to watch Flash video]...
Start Your Own WordPress Blog Part 8 – The WordPress Admin Dashboard After you have successfully changed your Permalink structure and if...
Start Your Own WordPress Blog Part 12 – WordPress Tools And Settings One of the least used feature in your WordPress Dashboard...
Start Your Own WordPress Blog Part 9 – WordPress Admin Dashboard Sidebars For this part of my series on Starting Your Own...
Start Your Own WordPress Blog Part 5 – Getting Your First Web Hosting Plan So far, in this series of Starting Your Own WordPress...

How To Check Number Of Your WordPress Blog Visitors

Costa Fong — Thu, 26 Apr 2012 03:20:58 +0000