Hi guys this is my first post on wpcult the great site Austin built. Hope you guys find it usefull.
If you run a blog using the wordpress software then your blog is a target to hackers. Below I will list some hacks and just how they can help you keep your business/site safe.
The following is code to Block Bad Queries and protect your blog from malicious URL Requests.
Place the following code into a text file and name it what ever you like for example blockbadqueries.php upload it to your plugin folder and activate it in your wordpress admin just as you would any other Plugin
<?php
/*
Plugin Name: Block Bad Queries
Plugin URI: http://perishablepress.com/press/2009/12/22/protect-wordpress-against-malicious-url-requests/
Description: Protect WordPress Against Malicious URL Requests
Author URI: http://perishablepress.com/
Author: Perishable Press
Version: 1.0
*/
global $user_ID; if($user_ID) {
if(!current_user_can(‘level_10′)) {
if (strlen($_SERVER['REQUEST_URI']) > 255 ||
strpos($_SERVER['REQUEST_URI'], “eval(“) ||
strpos($_SERVER['REQUEST_URI'], “CONCAT”) ||
strpos($_SERVER['REQUEST_URI'], “UNION+SELECT”) ||
strpos($_SERVER['REQUEST_URI'], “base64″)) {
@header(“HTTP/1.1 414 Request-URI Too Long”);
@header(“Status: 414 Request-URI Too Long”);
@header(“Connection: Close”);
@exit;
}
}
}
?>
This Great plugin was made by Jeff Starr of Digging into WordPress
Protecting your blog with .htaccess
.htaccess files have lots of possibilities. below is some code that will help protect your wordpress from modification of _REQUEST and/or GLOBALS and scripts injection.
This is real simple just paste the following code into your .htaccess file. Always make a backup of your .htaccess before editing, better to be safe.
Options +FollowSymLinks
RewriteEngine On
RewriteCond %{QUERY_STRING} (<|%3C).*script.*(>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|[|%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|[|%[0-9A-Z]{0,2})
RewriteRule ^(.*)$ index.php [F,L]
Thanks to Oussama for this great hack
[...] See the original post here: WordPress Security Hacks [...]
[...] More: WordPress Security Hacks [...]
Congratulations on your first post. It’s a really useful article. I run my blogs on wordpress and I know that it really means a lot for it to be protected. Will be trying your suggestions here. I am looking forward to your future posts. More Power!
[...] WordPress Security Hacks [...]
Thanks for this nice information Miguel. I have just started a new wordpress blog and I was looking for such tips to protect my blog from hackers.
Yes, I think protecting our blog is very important..It can help keep my business/site safe.
Thanks for the comments guys by the way Andrew got a interesting site there
The best defense Wordpress it’s protecting with .htaccess. Also, use the IP security.
this is a good start!
As the Wordpress blog installation and maintenance is pretty easy people are widely using the Wordpress. If it is easy to hack any Wordpress it will affect many people badly so I found your post is very useful and could give warning to blog owners. Thanks for the excellent post.
A hacker does for love what others would not do for money
thanks for this tips!
THis help me much to get remove some annoying spam control and injection for some of my blogs
So is it safe using wordpress anymore. We have already 2 website are currently with wordpress templates.
This is real simple just paste the following code into your .htaccess file. Always make a backup of your .htaccess before editing, better to be safe.
Read more: http://wpcult.com/wordpress-security-hacks/comment-page-1/#comment-4617#ixzz0jofgCq97
I really liked. I wish you good work
Thank you for this article.
Nice informations
With the ever increasing popularity of blogging and wordpress in particular, it is to be expected that this will attract hackers on a large scale. The continual upgrades to the wp is a real but necessary pain. Thanks for publishing some of your solutions to these problems.
a nice security plugin is WP Security Scan – http://wordpress.org/extend/plugins/wp-security-scan/ – it will help you finding some open doors
Thanks for the tips, we just recently started our Wordpress blog in January and I have been overwhelmed with the number of spam comments and have numerous security concerns. Looking forward to future posts!
Thanks for that.
Wanted to say, people nowadays who are using scripts that are bought or available for free, completely ignore the fact that these scripts might actually be vulnerable, and think they are not because some company makes them.
A successful webmaster should always put security on the top of his priorities, update his software and check it for vulnerabilities regularly.
Thanks for that! I always appreciate not having to upload another plugin : )
Thanks been looking for some more protection for our blog – always hard to keep up with this sort of thing. Will it work for V3?
Wow!!! Nice Stuff buddy…..
Recently there is a attack over Wordpress Blogs by Hackers.The saddest part is exploited security Hole not yet Identified,
Dirty Attack Over Hundreds Of WordPress Blogs
http://www.techpraveen.com/2010/04/dirty-attack-over-hundreds-of-wordpress.html
is it really works?
Great article with some very useful information. I will be implementing much of it as soon as I am done commenting.
Thanks for the post~ keep posting…
How to install stats counters, widgets, customisation of blog theme etc.
I never had any problems until I started using WP. Don’t get me wrong I still really like it as a platform for blogging, but so far no hacking issues, just some other stuff.
thanks! his article is very useful. I’ve seen pages where hackers have hacked in and promote other sites or business, your tips should help people stay secure with wordpress