Tips & Tricks
WordPress Security Hacks
Hi guys this is my first post on wpcult the great site Austin built. Hope you guys find it usefull.
If you run a blog using the wordpress software then your blog is a target to hackers. Below I will list some hacks and just how they can help you keep your business/site safe.
The following is code to Block Bad Queries and protect your blog from malicious URL Requests.
Place the following code into a text file and name it what ever you like for example blockbadqueries.php upload it to your plugin folder and activate it in your wordpress admin just as you would any other Plugin
<?php
/*
Plugin Name: Block Bad Queries
Plugin URI: http://perishablepress.com/press/2009/12/22/protect-wordpress-against-malicious-url-requests/
Description: Protect WordPress Against Malicious URL Requests
Author URI: http://perishablepress.com/
Author: Perishable Press
Version: 1.0
*/
global $user_ID; if($user_ID) {
if(!current_user_can(‘level_10’)) {
if (strlen($_SERVER[‘REQUEST_URI’]) > 255 ||
strpos($_SERVER[‘REQUEST_URI’], “eval(“) ||
strpos($_SERVER[‘REQUEST_URI’], “CONCAT”) ||
strpos($_SERVER[‘REQUEST_URI’], “UNION+SELECT”) ||
strpos($_SERVER[‘REQUEST_URI’], “base64”)) {
@header(“HTTP/1.1 414 Request-URI Too Long”);
@header(“Status: 414 Request-URI Too Long”);
@header(“Connection: Close”);
@exit;
}
}
}
?>
This Great plugin was made by Jeff Starr of Digging into WordPress
Protecting your blog with .htaccess
.htaccess files have lots of possibilities. below is some code that will help protect your wordpress from modification of _REQUEST and/or GLOBALS and scripts injection.
This is real simple just paste the following code into your .htaccess file. Always make a backup of your .htaccess before editing, better to be safe.
Options +FollowSymLinks
RewriteEngine On
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
RewriteRule ^(.*)$ index.php [F,L]
Thanks to Oussama for this great hack
Here is a neat trick. Say you want to show a custom field in you post or in a certain categories post. There is a simple code you need to write in order to accomplish this:
<?php $image = get_post_meta($post->ID, "image", $single = true); ?>
<?php if($image != '') : if(in_category(7)) { echo ''; } else { ?>
<img src="<?php echo $image ?>" alt="<?php the_title(); ?>" /></a>
In the example above I am calling the variable $image and telling the server that it equals the value of “image” inside get_post_meta or “custom field” of the current post.
Then we are asking if that variable $image doesn’t equal nothing or != and if it is in the category id of 7, echo what ever is in the single quotes (which is nothing in this example), otherwise show the <img> and the value inside “image” which should be the location of the image.
Update: Thanks to Austin from PressedWords for pointing out his trick, from the comment below.
I talked about Disabling search engine on search pages in a previous post using the meta tag. Today lets go over the web bots Cached copy of your site. If you are working on builder your blog, or have a temporary site up, use the following code:
<meta name="robots" content="noarchive">
This will tell any bot to follow your site, index it, but prevents a cached copy of this page from being available in the search results.
A good idea when trying to get the most out of your blog is usging the meta tag to tell the web bots to search & index your site. But for good SEO you should apply this code in your header.php file of your WordPress blog.
<?php if(is_search()) { ?>
<meta name="robots" content="noindex, nofollow" />
<?php }?>
This will keep your site from getting a hit from bots over duplicate entries. 🙂
VideoGameDude.com
Winner: Free Revolution Theme
I was just sitting in the back listening to Shayne Sanderson from Insctinct, who talked about their e-commerce plugin and...
Wierd custom fields
I am not sure if this is from a pluigin error. But I suddenly have custom field names “atfemail_” and...
What is HTTP Protocol?
HTTP stands for Hypertext Transfer Protocol, and it’s the foundation of the web we know today. It’s a set of...
-
Pages5 months agoWrite For Us – Guest Post
-
Showcase5 months ago
StylizedWeb.com
-
News4 months ago
How to: Show/Hide any div box with jQuery in WordPress
-
Tips & Tricks4 months ago
Remove the title attribute using jQuery
-
Plugins4 weeks agoTop Membership plugins
-
Tips & Tricks1 month ago
How to: show/hide a widget in WordPress with jQuery
-
Guest Post4 weeks ago
The Top 10 Best Free Android Retro Games of all time
-
Tips & Tricks5 months ago
Limit the characters that display on the_title
Mamas
May 25, 2010 at 6:49 am
that its great tip but does it work for WP that host in free hosting ( not in self hosting )
Social Media Optimization
May 25, 2010 at 11:48 pm
I read this article. I think You put a lot of effort to create this article.Thanks for this post.
Andrea
May 29, 2010 at 8:30 pm
Congratulations on your first post. Thanks for the info on the plug in!
Market Samurai
May 30, 2010 at 3:07 am
I recently had a few of my wordpress blogs hacked and went through a arduous process of trying to make them more secure. I might have to add this to the list.
tuning
May 31, 2010 at 5:46 pm
thanks for this tips!
William@Create Wealth
May 31, 2010 at 8:15 pm
hey! great stuff for a first post, keep up the good work 🙂 looking forward to more, now I gotta check my WP security!
Pingback: Blogging Tips 1
Hover Coupon
June 6, 2010 at 10:01 am
Thanks. I am going to be starting up a WordPress blog soon when 3.0 goes final so this should be useful.
discount air jordan shoes
June 14, 2010 at 1:06 pm
Many wordpress software users do not know about the hacking on wordpress Thanks for sharing such a useful information soom
Bluetooth Compatible Headsets
June 16, 2010 at 3:58 am
Hey being your first blog it is really attractive and all the best you have made a good start…
Instant Focus Memory Supplement
June 17, 2010 at 11:39 pm
Thank you for the really helpful tips.
klaasj
June 21, 2010 at 6:18 am
This help me to get remove some annoying spam control and injection for some of my blogs
diseño web
June 22, 2010 at 3:51 am
Nice post and your site is very cool, I like it very much.
Kevin Tan
June 23, 2010 at 9:17 pm
Thanks for this Miguel. I will certainly look into this considering I haven’t really tried to protect my blog very well from hackers.
barış özcan
June 24, 2010 at 4:56 am
wellcome personal web page…
mezar işleri
June 24, 2010 at 4:58 am
It is a good idea to plot the data so that you can explore its features.
An exploratory plot of your data enables you to identify discontinuities
and potential outliers, as well as the regions of interest.
Thanks…
Giochi Super Mario
July 4, 2010 at 6:03 am
Thanks been looking for some more protection for our blog
Does it work on wordpress 3.0?
Kids Rolling Suitcases
July 4, 2010 at 6:37 pm
Hi Miguel,
Thanks for the info. I just downloaded WordPress 3.0, and I have heard that the first releases of newer versions can be vulnerable to attacks, so I am trying to do anything possible to keep my site safe. Thanks again for the info.
Rowan
July 5, 2010 at 6:53 pm
Thanks for yet another good post! These tips help me to trudge through the waters of wordpress security, so I feel that this gives me a leg up!
Compare Web Hosts / Compare Web Hosting
July 7, 2010 at 3:34 am
Welcome to the world of blog, I think you’re off to a solid start.
Pixelbox Design
July 12, 2010 at 3:36 pm
Excellent Article, Added to favs, keep up the good work.
Charlotte Lawyers
July 15, 2010 at 1:40 am
Protecting is a must in our blog cause we spend our precious time in updating our blog. Computer hackers now a days, wordpress blogs is there favorite. Some blogger protect their blog by frequently changing their passwords and they also keep WordPress installation up to date .
L4NiK
July 16, 2010 at 4:22 pm
Tnx. Useful article!
Site5 Rebate
July 17, 2010 at 2:19 pm
I am planning on making a WordPress blog in a few months. Right now I am reading HTML/CSS books, Php and MySQL to learn how to do things right. This security script is very interesting and I hope that by the time I am done with my blog, hopefully by next year, I will have a very strong grasp on a variety of programming languages and will understand exactly that the above script means!
Candida Pugliesi
July 18, 2010 at 1:44 pm
WE had our site hacked a few months ago, and if I had seen this post beforehand, it probably would have been prevented. Thanks for sharing this with the community.
Steve Marino
July 20, 2010 at 3:33 am
Thanks for sharing. Although it would be more preferable if WordPress would take care of these issues themselves rather than relying on nice people like to you do their job for them.
Willy
July 22, 2010 at 1:13 am
All my wordpress sites have been hacked earlier despite the security plugins I earlier installed. I will implement your tip. Hope it will plug the hole.
Purple Heart
July 23, 2010 at 12:33 pm
Is there anything that can not be hacked. I just setup my first wordpress blog. Now I have to figure out how to stop the hackers… How do you update or edit the code for wordpress?
Ryan Wilson
July 23, 2010 at 7:21 pm
I’m using WordPress a lot and thank you for the helpful informations and tips.
Pixelbox Design
July 24, 2010 at 5:17 pm
Excellent Article, keep up the good work.
blogb4
July 27, 2010 at 12:30 am
Thank you, i’ll use this method for my blog, because i have several blogs with WP
flybar
July 27, 2010 at 10:33 am
This is great stuff! All WP newbies should check this out even if they’re just starting. You wouldn’t want to build your site for months and build traffic only to be hacked. Even if you do get it back, there are irreparable damages like lost reputation and lost income during the span that your site was hacked.
Hey Zappy
July 28, 2010 at 10:56 am
IS this still good or necessary with the WordPress 3.0 version ?
aem intakes
July 29, 2010 at 1:08 am
Thanks for this useful info mate! I am using wordpress and this surely would be helpful!
Hair loss
July 29, 2010 at 8:23 pm
Thanks for this wonderful plugin.. I will install this for sure..
SQL Training
July 29, 2010 at 11:35 pm
Thanks a lot for this great post on WordPress Security. I will be using this tip to make my blog more secured and robust.
Hotels Bowral
August 3, 2010 at 8:31 pm
I love blogs like these – choice code and easy to understand. Thanks matey!
Sydney House Cleaning
August 3, 2010 at 8:33 pm
Isn’t it great when you find EXACTLY what you’re after? That’s what I got when I came here. Many thanks 🙂
Computer Tips
August 6, 2010 at 1:53 pm
Your first post and this is also the first thing everyone should do before starting the wordpress blog.Thanks man,I have implemented your suggestions in my blog
Jane
August 10, 2010 at 11:18 am
Thanks for the article. Very helpful
Rick
August 10, 2010 at 7:13 pm
Hey, is your site still up? I hope so, just found it and its great. Keep it up!
Online Fashion
August 15, 2010 at 6:22 am
no wonder i couldnt install themes on wp! grrr…
marcolins
August 19, 2010 at 10:16 pm
i am using wordpress and it looks so useful for me to post my articles.but i never meet the thing as u said above,what is the hackers,can you help me?
cyrano
August 22, 2010 at 1:38 pm
thanks for this article. i ve a website and i m aware of hacking problem.
Claudia
August 22, 2010 at 11:57 pm
Thank you for great article. Where else could anyone get that kind of information in such a perfect way of writing. Good work
workwear clothing
Gartoo
August 24, 2010 at 8:41 am
Interesting article, with so many bloggers using premade tools to create their sites, it really opens up the opportunities for hackers. I wonder if you could elaborate what the code is actually preventing?
SQL Training
August 25, 2010 at 3:56 am
It is really very important to have our WordPress site secured to keep our business safe…..I think this code will certainly help me make my blog secure
ripzipfx2004@yahoo.com
August 27, 2010 at 2:38 am
welcome, excellent read. keep it coming hacker
The Eye
August 29, 2010 at 12:04 am
Nice post because very useful information and i am using WP
Thanks
Car wash franchise
August 31, 2010 at 7:13 pm
Thanks for the post but i think if it is easy to hack any WordPress it will affect many people badly so I found your post is very useful and could give warning to blog owners.