Hi guys this is my first post on wpcult the great site Austin built. Hope you guys find it usefull.
If you run a blog using the wordpress software then your blog is a target to hackers. Below I will list some hacks and just how they can help you keep your business/site safe.
The following is code to Block Bad Queries and protect your blog from malicious URL Requests.
Place the following code into a text file and name it what ever you like for example blockbadqueries.php upload it to your plugin folder and activate it in your wordpress admin just as you would any other Plugin
<?php
/*
Plugin Name: Block Bad Queries
Plugin URI: http://perishablepress.com/press/2009/12/22/protect-wordpress-against-malicious-url-requests/
Description: Protect WordPress Against Malicious URL Requests
Author URI: http://perishablepress.com/
Author: Perishable Press
Version: 1.0
*/
global $user_ID; if($user_ID) {
if(!current_user_can(‘level_10’)) {
if (strlen($_SERVER[‘REQUEST_URI’]) > 255 ||
strpos($_SERVER[‘REQUEST_URI’], “eval(“) ||
strpos($_SERVER[‘REQUEST_URI’], “CONCAT”) ||
strpos($_SERVER[‘REQUEST_URI’], “UNION+SELECT”) ||
strpos($_SERVER[‘REQUEST_URI’], “base64”)) {
@header(“HTTP/1.1 414 Request-URI Too Long”);
@header(“Status: 414 Request-URI Too Long”);
@header(“Connection: Close”);
@exit;
}
}
}
?>
This Great plugin was made by Jeff Starr of Digging into WordPress
Protecting your blog with .htaccess
.htaccess files have lots of possibilities. below is some code that will help protect your wordpress from modification of _REQUEST and/or GLOBALS and scripts injection.
This is real simple just paste the following code into your .htaccess file. Always make a backup of your .htaccess before editing, better to be safe.
Options +FollowSymLinks RewriteEngine On RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR] RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR] RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2}) RewriteRule ^(.*)$ index.php [F,L]
Thanks to Oussama for this great hack
I know the whole community is weary and waiting for the release of the now…
I just came across an article over at WPHacks.com about a "how to" shift and…
The Ultimate WordPress Real Estate theme with custom developed plugins, single and multiple agents, extensive…
WordPress 2.6.5 is immediately available and fixes one security problem and three bugs. We recommend…
Another plugin I am using on this site: Comment Validation by Jörn Zaefferer. From Jörn's…
Woopra is the world's most comprehensive, information rich, easy to use, real-time Web tracking and…
View Comments
Congratulations on your first post. It's a really useful article. I run my blogs on wordpress and I know that it really means a lot for it to be protected. Will be trying your suggestions here. I am looking forward to your future posts. More Power!
Indeed, can just say the same as andrew. Very good start. Every active user of wp will like this article. I look forward for your ideas at wp 3 if its out :)
greez Markus
Thanks for this nice information Miguel. I have just started a new wordpress blog and I was looking for such tips to protect my blog from hackers.
Yes, I think protecting our blog is very important..It can help keep my business/site safe.
Thanks for the comments guys by the way Andrew got a interesting site there
The best defense Wordpress it's protecting with .htaccess. Also, use the IP security.
this is a good start!
As the Wordpress blog installation and maintenance is pretty easy people are widely using the Wordpress. If it is easy to hack any Wordpress it will affect many people badly so I found your post is very useful and could give warning to blog owners. Thanks for the excellent post.
A hacker does for love what others would not do for money
thanks for this tips!
THis help me much to get remove some annoying spam control and injection for some of my blogs :(
So is it safe using wordpress anymore. We have already 2 website are currently with wordpress templates.