+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Webmasters (https://hackforums.net/forumdisplay.php?fid=141)
+---- Forum: Website Construction (https://hackforums.net/forumdisplay.php?fid=50)
+---- Thread: [Wordpress] Starting a blog - are there any security measures I should take? (/showthread.php?tid=5626077)
Starting a blog - are there any security measures I should take? - James Burnham - May 18, 2017
What should I do to protect my blog from attacks?
* - Rushax - May 18, 2017
Wordfence is quite publicly used, however it is quite heavily resourced. I would say though this is one of the best free counter-measures that you can add to your site.
Changing certain settings for the login page is also quite a good deterrent from automatic scans:
https://managewp.com/change-your-wordpress-login-url
Adding HTTPS would also be personally recommended which can be done by CloudFlare's free Flexible SSL option or LetsEncrypt free SSL certificate option.
Also when someone tries to bruteforce a username and password, WordPress (if the username is correct but the password is wrong) shows the error message: Password is not correct. Therefore, this is a certain vulnerability that the hacker now knows they have got a correct username for accessing the site, now they only need the password.
To counter this, you can amend certain parts of the functions.php file to stop this from happening.
Tutorial for it can be found here: https://wordpress.stackexchange.com/questions/25099/change-login-error-messages
Adding 2 factor authentication is a good option for the website as well, and obviously choosing strong passwords for FTP / Database & WordPress login. I think the plugin
is called Clef that offers this (free also).
Most people get hacked because of their themes or most commonly plugins as they might be out of date or nulled.
- Don't use any nulled plugins or themes
Also make sure you keep all themes, plugins and WordPress version up to the latest version. There's a way to automate this process in the functions.php file also, or you can do it manually every time an update is required.
There was another premium plugin that was available on CodeCanyon which when installed and activated, fooled the automated scans into thinking the site was not WordPress and would move on.
Other than that I would say make sure you do weekly/monthly scans on WordFence, delete any unneccessary plugins or themes that are not being used, take backups of the site and limit the amount of attempts to login to a specific amount (available on Clef / WordFence).
* - focuss - May 19, 2017
Keep your website up to date, get a limit login plugin and you can even use the plugin wordfence if you want it to be even more secure.
* - rudel777 - Jun 7, 2017
read and research about vulnerability issue bro
* - TheGoldenRelik - Jun 8, 2017
1)Use SSL
2)Use 2 Step Verification where it's possible
3)Use Captcha on e-mail forms to prevent them from e-mail flooding
4)Keep everything up to date
5) I mean everything. Try plugins which are constantly evolving and have good reviews from other users or they have been referred in other blogs or websites.
* - Shikatanai - Jun 8, 2017
I only use wordfence to autoblock person that login with "admin" or "Admin" or related with. And use option for limit "false" password to 2
* - device - Jun 8, 2017
If you're using Wordpress go and check these plugins out:
https://wordpress.org/plugins/wordfence/
https://wordpress.org/plugins/better-wp-security/
https://wordpress.org/plugins/bulletproof-security/
https://wordpress.org/plugins/sucuri-scanner/
https://wordpress.org/plugins/better-wp-security/
https://wordpress.org/plugins/wp-security-scan/ to check your security yourself.
https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/
https://wordpress.org/plugins/6scan-protection/
* - HiddenEyE - Jun 8, 2017
i would suggest most importantly to scan your blog website with wpscan. if you need help on how to use it on a blog. Pm me. hope i did help out
* - Numinous - Jun 8, 2017
https://goo.gl/fpFelC
https://goo.gl/tcHqrx
https://goo.gl/nRj9He
You should check out these links,