Web sites, hand-crafted in Toronto

Okay, chances are, this information might be too late for a lot of you.  You might be reading already having a blog set-up and running.  The good news is, all these tips can be implemented on a running blog.  It is easier, it is true, to set up the blog properly in the first place, but still, better late then never.

So here’s the deal:  WordPress is super-easy to set-up.  Like, wicked easy.  And it runs very well out of the box.  But, like anything online, it is open to attack from folks who would like to use your blog for their own purposes, or at least, make your work and efforts for naught.  WordPress does a lot to protect itself, but not everything.  And of course, there is no definitive “everything”.  Security is an ongoing process, growing and changing as hackers learn how to exploit other weak points in the system.

That being said, here is a list of things you can do during or after installation, to help secure your blog from attacks.  No promises, no guarantees, but be assured, you are setting your defenses well by following these steps.

1. Change your database prefix

During installation, you will run through a few screens, perhaps setting up a configuration file, and getting warned what you will need to actually do the set-up.  Then you will arrive here:

It looks so darn friendly and easy, and for the most part it is.  One thing they don’t mention, though, is the database table prefix.  It defaults to “wp_”.  They point out that you might want to change this, if you want to run two blogs on one database.  You might also want to change it, as every hacker knows that most WordPress installs use the wp_ prefix, so they can use javascript attacks to insert or change information in your database.  Change this to something else, think in terms of passwords, but keep it alphanumeric.  Remember to leave the “_” on the end.  Keep on installing.  If you have already set-up a wordpress install using the wp_ prefix, there are options.  You can use a plug-in, if you have the correct permissions on the database.  If not, you can do it manually (not fun).  This is basically going into your database, and updating every “wp_” prefix to something else, then updating your config.php file.  There is numerous guides on the web talking about this process.  Google it.

2. Change your log-in name

Want to know what else every hacker knows?  That every WordPress installation defaults the primary user as “admin”.  So if they want to use a brute-force attack (namely, running a script that just keeps guessing at log-ins/passwords until it hits), they already are half-way there.  They know your log-in.  So now you need to change it.  This might sound scary, but it’s actually pretty easy.  Most server-providers have a web-based interface that will let you get into you mySQL.  The table you’re looking for is “yourprefix_users”, edit the “admin” one, and change the name to something else.  If you do this while logged-in to your WordPress admin panel, you will be logged-out.  Just log-in with your new info, and she-bang, you’re there.

3. Prevent people from browsing your wp-admin file

Ever click a link, and instead of getting a sharp looking web page, you get a listing of all the files in the directory?  That is because there was no index.html file in the directory in question.  So the server presented you with all the files for you to choose from.  You can see why this would be a problem with your wp-admin file.  So here is what you do:  Check your wp-admin folder, and see if there is a file there called “index.html”.  If so, good you’re done this step.  Consider making a donation to your template designer, unless you payed for it.  If not, here’s the deal: Open up good old notepad, or texteditor or whatever plain-text program you like.  Look at the blank screen for a while.  Okay, now “save as”.  Yeah, just that blank screen.  But here’s what you need to do, make sure you’re not saving it as a .txt file.  In notepad, change the drop-down to “all files”, and save the file as index.html . Save it somewhere obvious.  Now upload it to your wp-admin folder, either via FTP or web-interface or whatever.  Just get it in there.  Once you’ve done that, stick one in your wp-content folder as well, just for good measure. Cool?

4. Remove version information from your header (?)

Okay, do some reading.  Lots of people will tell you to remove the code from your header that displays what version of WordPress you are running.  Sounds smart, right? A hacker could see that you were running an old version with known security breaks.  Then they could exploit your set-up.  Except that this is a bit like saying “Throw away your weight-scale and mirror, and you will never know you are getting fat, so you won’t die of heart-attack”.  Why not just make every effort to stay healthy?  So, instead of hiding your version information, display it proudly, because you keep your blog up to date.  WordPress is currently at version 2.9.2.  It will update itself, if only you let it.   A box appears at the top of your admin screens telling you it’s time to update, and click here to do it.  Pretty easy, right?  So do it.  If you want to be extra thorough, check out the WordPress Development Blog feed, and subscribe to it. Regular security patches, software updates and other helpful information.
http://wordpress.org/development/feed/

5. Be ready to fix your blog when all this fails

Okay, remember what I said about security being ongoing?  The way we good folks learn when the bad dudes have figured out a new way to exploit your site, is when it happens.  And it happens more often then you might think.  So here’s the deal:

• BACK-UP YOUR DATABASE.  The files on your server as well, at least your template files.  If somebody adds content maliciously, you can simply restore the database to before they made the additions.  If they corrupt your template, you can restore it.  There are DB back-up plug-ins available, but doing a mySQL export is not rocket-science.  Just do it regularly, and you’ll be good.  This also protects you from server problems as well.
• Keep an installation .zip handy on your computer. If you need to, you can always delete your entire install and re-install it, then use your DB and template back-ups to restore your blog to it’s original grandeur.
• Make sure you have your log-in and password for your *server* somewhere, preferably encrypted (if you haven’t started using truecrypt, it’s time.  Google it), and keep your information (both digital and physical) with your service provider up to date.  You’ll need this in a worst-case, if somebody blocks you out of your own server.

Follow these steps, and while you will not be immune to security threats, you will be well-protected, and will be ready if you find yourself hacked.  And as always, let me know if you know any good steps to help protect your blog. Let’s all help each other out.