WordPress Security Hacks

Hi guys this is my first post on wpcult the great site Austin built. Hope you guys find it usefull.

If you run a blog using the wordpress software then your blog is a target to hackers. Below I will list some hacks and just how they can help you keep your business/site safe.

The following is code to Block Bad Queries and protect your blog from malicious URL Requests.

Place the following code into a text file and name it what ever you like for example blockbadqueries.php upload it to your plugin folder and activate it in your wordpress admin just as you would any other Plugin

<?php
/*
Plugin Name: Block Bad Queries
Plugin URI: http://perishablepress.com/press/2009/12/22/protect-wordpress-against-malicious-url-requests/
Description: Protect WordPress Against Malicious URL Requests
Author URI: http://perishablepress.com/
Author: Perishable Press
Version: 1.0
*/
global $user_ID; if($user_ID) {
if(!current_user_can(‘level_10’)) {
    if (strlen($_SERVER[‘REQUEST_URI’]) > 255 ||
      strpos($_SERVER[‘REQUEST_URI’], “eval(“) ||
      strpos($_SERVER[‘REQUEST_URI’], “CONCAT”) ||
      strpos($_SERVER[‘REQUEST_URI’], “UNION+SELECT”) ||
      strpos($_SERVER[‘REQUEST_URI’], “base64”)) {
        @header(“HTTP/1.1 414 Request-URI Too Long”);
@header(“Status: 414 Request-URI Too Long”);
@header(“Connection: Close”);
@exit;
    }
}
}
?>

This Great plugin was made by Jeff Starr of Digging into WordPress

Protecting your blog with .htaccess

.htaccess files have lots of possibilities. below is some code that will help protect your wordpress from modification of _REQUEST and/or GLOBALS and scripts injection.

This is real simple just paste the following code into your .htaccess file. Always make a backup of your .htaccess before editing, better to be safe.

Options +FollowSymLinks
RewriteEngine On
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
RewriteRule ^(.*)$ index.php [F,L]

Thanks to Oussama for this great hack

Miguel

Well been working with computers since the mid 80's and online since the late 80's early 90's so I am one of the older guys even though I am only in my early mid 30's ;) I feel alot older , I have worked in many different fields and am currently running companies in Mexico that both secure government contracts and Finance, have been involved in the finance part of many projects over the last few years and have so far been succesfull in all endevors, don't get much free time but when I do I would like to start rebuilding this site that I bought from Austin,since I am not a programer I will probably be writing about all kinds of things wordpress, security, seo, marketing, making money online, hosting, news, technology, bussiness, social networking and what ever comes to mind, when ever I get the chance to blog

Next Site Theme Update »

Previous « Game-Changing Paradigm Shift in Machine Learning!

View Comments

Jetski says:

January 12, 2011 at 7:35 am

Congrats on becoming a new site owner! And thanks for the great first post :)
Uzair says:

January 12, 2011 at 9:43 am

Nic post thanks for sharing
Web Design Preston says:

January 12, 2011 at 11:23 am

I know this thread is getting old now but Wordpress hacking is still a real issue. We have a large number of sites built on Wordpress and many of them have been hacked as recent as the last 2 weeks. Real bad hacks as well with the database wiped and everything. It's a pain because Wordpress is such a great platform to use and very popular with our clients - they love the easy CMS. Wish we could fix Wordpress hacking once and for all...!
Daniel @ PHP Programmer Philippines says:

January 13, 2011 at 8:09 am

Thanks for sharing this, i just used the .htaccess method to protect my wordpress blog, I was searching for a way to protect my blog from hackers and i got into this page. :)

Regards,

Daniel
E Learning Online says:

January 27, 2011 at 4:32 am

Miguel

Thanks, I will look at the second option
I am using these plugins on my blogs:
Firewall
Block Bad Queries (!) using it already
Chap Secure Login

highly recommended
thanks
Jack
Vienna Souvenirs says:

January 27, 2011 at 11:21 pm

I recently came across your blog and have been reading along. I thought I would leave
my first comment. I don’t know what to say except that I have enjoyed reading. Nice
blog, I will keep visiting this blog very often. Take a piece of Vienna back to your home
Pink Magic says:

February 2, 2011 at 3:02 pm

Internet security in general is often overlooked, especially with Wordpress. I've been the victim of two Wordpress hacks through various security holes!
Henri Labelle says:

February 3, 2011 at 6:32 pm

Thanks for this tip, I'll use it right now!!
Symptoms of Depression says:

February 7, 2011 at 8:43 pm

Yea, I know a number of people who have had their wp sites hacked. That is why I try to get everything set up properly from the very beginning to avoid any nasty surprises. I find that a couple of plugins work well, wp-security scan and wp malwatch. If you are running wp you should definitely install those.
Milwaukee SEO says:

February 10, 2011 at 10:02 pm

Great roundup of potential issues with WP security. Posts like these make it easy for us to identify loopholes and fix them up before our sites get hacked.