What should I do to protect my blog from attacks?
|
Wordpress
Starting a blog - are there any security measures I should take? |
May 18, 2017 05:14 PM
(This post was last modified: May 18, 2017 05:21 PM by Rushax.)
Wordfence is quite publicly used, however it is quite heavily resourced. I would say though this is one of the best free counter-measures that you can add to your site.
Changing certain settings for the login page is also quite a good deterrent from automatic scans: https://managewp.com/change-your-wordpress-login-url Adding HTTPS would also be personally recommended which can be done by CloudFlare's free Flexible SSL option or LetsEncrypt free SSL certificate option. Also when someone tries to bruteforce a username and password, WordPress (if the username is correct but the password is wrong) shows the error message: Password is not correct. Therefore, this is a certain vulnerability that the hacker now knows they have got a correct username for accessing the site, now they only need the password. To counter this, you can amend certain parts of the functions.php file to stop this from happening. Tutorial for it can be found here: https://wordpress.stackexchange.com/ques...r-messages Adding 2 factor authentication is a good option for the website as well, and obviously choosing strong passwords for FTP / Database & WordPress login. I think the plugin is called Clef that offers this (free also). Most people get hacked because of their themes or most commonly plugins as they might be out of date or nulled. - Don't use any nulled plugins or themes Also make sure you keep all themes, plugins and WordPress version up to the latest version. There's a way to automate this process in the functions.php file also, or you can do it manually every time an update is required. There was another premium plugin that was available on CodeCanyon which when installed and activated, fooled the automated scans into thinking the site was not WordPress and would move on. Other than that I would say make sure you do weekly/monthly scans on WordFence, delete any unneccessary plugins or themes that are not being used, take backups of the site and limit the amount of attempts to login to a specific amount (available on Clef / WordFence).  
1)Use SSL
2)Use 2 Step Verification where it's possible 3)Use Captcha on e-mail forms to prevent them from e-mail flooding 4)Keep everything up to date 5) I mean everything. Try plugins which are constantly evolving and have good reviews from other users or they have been referred in other blogs or websites. 
If you're using Wordpress go and check these plugins out:
https://wordpress.org/plugins/wordfence/ https://wordpress.org/plugins/better-wp-security/ https://wordpress.org/plugins/bulletproof-security/ https://wordpress.org/plugins/sucuri-scanner/ https://wordpress.org/plugins/better-wp-security/ https://wordpress.org/plugins/wp-security-scan/ to check your security yourself. https://wordpress.org/plugins/all-in-one...-firewall/ https://wordpress.org/plugins/6scan-protection/  |
|
|
aerox.design
