Categories: Tips & Tricks

WordPress Security Hacks

Hi guys this is my first post on wpcult the great site Austin built.  Hope you guys find it usefull.

If you run a blog using the wordpress software then your blog is a target to hackers.  Below I will list some hacks and just how they can help you keep your business/site safe.

The following is  code to Block Bad Queries and protect your blog from malicious URL Requests.

Place the following code into a text file and name it what ever you like for example blockbadqueries.php upload it to your plugin folder and activate it in your wordpress admin just as you would any other Plugin

<?php
/*
Plugin Name: Block Bad Queries
Plugin URI:
http://perishablepress.com/press/2009/12/22/protect-wordpress-against-malicious-url-requests/
Description: Protect WordPress Against Malicious URL Requests
Author URI:
http://perishablepress.com/
Author: Perishable Press
Version: 1.0
*/
global $user_ID; if($user_ID) {
  if(!current_user_can(‘level_10’)) {
    if (strlen($_SERVER[‘REQUEST_URI’]) > 255 ||
      strpos($_SERVER[‘REQUEST_URI’], “eval(“) ||
      strpos($_SERVER[‘REQUEST_URI’], “CONCAT”) ||
      strpos($_SERVER[‘REQUEST_URI’], “UNION+SELECT”) ||
      strpos($_SERVER[‘REQUEST_URI’], “base64”)) {
        @header(“HTTP/1.1 414 Request-URI Too Long”);
 @header(“Status: 414 Request-URI Too Long”);
 @header(“Connection: Close”);
 @exit;
    }
  }
}
?>

 This Great plugin was made by Jeff Starr of Digging into WordPress

 

 

Protecting your blog with .htaccess 

.htaccess files have lots of possibilities. below is some code that will help protect your wordpress from modification of _REQUEST and/or GLOBALS and scripts injection.

 This is real simple just paste the following code into your .htaccess file. Always make a backup of your .htaccess before editing, better to be safe.

Options +FollowSymLinks
RewriteEngine On
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
RewriteRule ^(.*)$ index.php [F,L]

 

Thanks to Oussama for this great hack

Miguel

Well been working with computers since the mid 80's and online since the late 80's early 90's so I am one of the older guys even though I am only in my early mid 30's ;) I feel alot older , I have worked in many different fields and am currently running companies in Mexico that both secure government contracts and Finance, have been involved in the finance part of many projects over the last few years and have so far been succesfull in all endevors, don't get much free time but when I do I would like to start rebuilding this site that I bought from Austin,since I am not a programer I will probably be writing about all kinds of things wordpress, security, seo, marketing, making money online, hosting, news, technology, bussiness, social networking and what ever comes to mind, when ever I get the chance to blog

View Comments

  • Welcome Miguel! Your first post is a goodie, and what better subject to look at than security. If you leave the back door open you may turn around to find the pantry empty! Nobody deserves that, and paying attention to your security at home as well as on your website is a must to prevent unauthorized access and subsequent damages or losses.

    I'll keep my eyes open for future posts from you. Enjoy, and good luck with your blogging. Writing is inspiring and sharing your knowledge with others is very gratifying.

  • Hi!

    My Blog was hacked a few months ago. This deleted my footer.php and instead I got a footer.php with only invisible Spamlinks in it.
    I don't know how long this file has been on my blog because it didn't attract any attention from me. Who takes daily care about his page footer?

    So my question: are the above mentioned queries the only one which can cause problems?

  • Thanks been looking for some more protection for our blog – always hard to keep up with this sort of thing. Will it work for V3?

  • Place the following code into a text file and name it what ever you like for example blockbadqueries.php upload it to your plugin folder and activate it in your wordpress admin just as you would any other Plugin

  • Great post and I found it very useful. I also run my blog on wordpress and I'll take your suggestions to use.

  • Wow!!!
    It's a good lesson about hackings.great!!!
    how to hackers have hacked other business sites and other.......

  • that its great tip but does it work for WP that host in free hosting ( not in self hosting )

  • I read this article. I think You put a lot of effort to create this article.Thanks for this post.

1 3 4 5 6 7 25

Recent Posts

Lost? Since You Can’t Trust Apple Maps, Check Out These 3 Apps Instead

Maybe you have the new software on your Apple device that has made headlines as…

10 minutes ago

An Overview Of Business Models

Knowing Where To Start There are a number of conceptual business models that are used…

12 hours ago

Google’s New Tool For Bad Links

Google recently announced it has launched its Disavow Tool which allows webmasters to alert Google…

24 hours ago

5 Reasons Why You Should Or Should Not Use WordPress Plugins

Depending on your needs, WordPress plugins are the best and worst aspects of WordPress. The…

1 day ago

Adsense Pro Ultimate – Top Selling CTR Worpress Theme Review

Classic CTR Themes For WordPress have made it pretty easy to build informational websites using…

2 days ago

How to Incorporate a Website into Your Website Marketing Efforts

In today's techno-centric culture, you simply must have a business website, no matter how small…

2 days ago