Midphase Blog

Over the last several years, blogging has become a popular trend among online users. WordPress is the most commonly used publishing platforms by bloggers which can be attributed its relatively simple, user-friendly and intuitive interface and has unlimited customization features.

Most of the WordPress sites found in the blogosphere are self-hosted, meaning that the administrator is responsible for security,  privacy issues and obtaining affordable hosting. In a nutshell, there are several ways that the security of a WordPress blog can be enhanced; the problem is that few administrators apply these security tenets. This further makes WordPress blogs vulnerable and easy targets for hackers.

The following is a list of top five security concerns, with their possible solutions, for a WordPress blog.

1. Insecure Plugins and Themes
WordPress provides numerous free plugins and themes that enhance the functionality of your blog. However, it is important to note that some of these features may contain inbuilt vulnerabilities or sometimes-malicious code that can comprise your site. Therefore, it is important to download themes and plugins from accredited developers, and to always ensure that your WordPress plugins, themes and the overall platform are updated.

2. SQL Injection and URL Hacking
WordPress database oriented and runs its server scripts in PHP format. These two features make it very susceptible to malicious URL insertion attacks. SQL injection describes a type of URL attacks in which hackers embed codes in a URL that triggers certain behaviors from databases. From these attacks, hackers can scoop sensitive information and even modify the content in the site.

Modifying the default database tables’ prefix and setting stringent guidelines of accessibility in your Apache .htaccess file can prevent SQL injection and other URL attacks

3. Default Administrator Account
Many default WordPress sites feature an administrator user account whose user name is usually ‘admin’. Hackers usually attempt to log into these accounts by just guessing passwords. It is advisable that you do away with the admin account and create a new user with an unpredictable user name and a complex password. The hacker will have to guess the username and password, which is a much more daunting, nearly impossible, task.

4. Database Permissions
Database permissions allow the administrator to access and modify specific parts of the database. In case database permissions are not tight enough, hackers might exploit this weakness to modify content and structure.

Thus, it is important that you update your database permissions and put the right security checks to enhance its security. For instance, you can add commands in the. htaccess file to block access to sensitive files.

5. Password Predictability
Having a strong password can protect the site form brute force login attacks. Hackers usually rely on automated scripts to make password guesses to log into your WordPress administrator account.

An effective defense is to use a longer, mixed type password that will take longer for a brute force attack to crack the code. Additionally, you can install a login limiter. A login emitter blocks a user name or an IP address that tries and fails to send log in requests based on a set threshold rate. For instance, a login limit of 5 attempts per 10 minutes can be accompanied with a penalty timeout of one hour.

Be Sociable, Share!

• 

Filed under: Tips and Tutorials by Jake Neeley

Leave a Reply

Name (required)

Mail (will not be published) (required)

Website