While core installation of Wordpress is easy to use, this presentation will explain in 10 steps with specific measures how to protect your WordPress websites.

1. 10 Steps
to secure
Wordpress
Sites

2. Area: Username and Password
1
Wordpress security

3. Use random username generator to set a
unique username
 Change default “Administrator" usernames
 Avoid typical “Administrator” usernames like admin,
administrator, root, manager, debug, user, system,
default, netman, superuser, guest, backup, sys,
sysadmin, siteadmin, test, …
Wordpress security

4. Area: Username and Password
2
Wordpress security

5. Set a secure password
 Use a password service such as LastPass
 Use a random 16 (at least) character password UPPER,
lower, digits, punctuation
Wordpress security

6. Area: Login Limits
3
Wordpress security

7. Block IP address after X number of login
attempts within a period.
 Use Limit Login Attempts plugin –
http://wordpress.org/plugins/limit-login-
attempts/
Wordpress security

8. Area: Folder and File
permissions
4
Wordpress security

9. Change directory permissions.
 WordPress folders/directories = 755
 WordPress files = 644
 .htaccess, php.ini, wp-config.php = 444
Wordpress security

10. Area: Protect configuration
files
5
Wordpress security

11. Use .htaccess to protect your wp-
config.php file.
 Add to .htaccess –
<files wp-config.php>
order allow,deny
deny from all
</files>
Wordpress security

12. Area: SQL Injection Protection
6
Wordpress security

13. Use .htaccess to stop SQL Injection
attacks.
 Add to .htaccess –
Options +FollowSymLinks
RewriteEngine On
RewriteCond %{QUERY_STRING} (<|%3C).*script.*(>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|[|%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|[|%[0-9A-Z]{0,2})
RewriteRule ^(.*)$ index.php [F,L]
Wordpress security

14. Area: Prevent Directory
Browsing
7
Wordpress security

15. Use .htaccess to stop SQL Injection
attacks.
Wordpress security
 Add to .htaccess –
Options - Indexes

16. Area: Disable User File Editor
8
Wordpress security

17. Remove the WordPress dashboard
Editor for themes and plugins.
 Add to wp-config.php –
define('DISALLOW_FILE_EDIT', true);
Wordpress security

18. Area: Change Default Table
Prefix
9
Wordpress security

19. Default MySQL DB table prefix is wp_
Change before installing new WP sites.
 Add to wp-config.php –
$table_prefix = ‘mynewprefix_';
Wordpress security

20. Area: Audit Changes
10
Wordpress security

21. Default MySQL DB table prefix is wp_
Change before installing new WP sites.
 Add WP Security Audit Log plugin -
http://wordpress.org/plugins/wp-security-
audit-log/
Wordpress security

22. This presentation has been submitted
by:-
Anuj Mathur
Anuj has over 14 years experience in
planning, managing and executing
software projects on the open source
platform. At AAPNA Infotech, he is
presently managing product initiatives and
process improvements.
Wordpress security