![\"\"](\"http:\/\/rinf.com\/alt-news\/wp-content\/uploads\/2011\/02\/wp-secure.jpg\" "\\"wp-secure\\"")
<\/a> I never thought it would actually happen to me, I always thought that getting your blog hijacked was something that happens to "other people", but when it happened to me I was devastated. I foolishly installed a "free" WordPress theme from an untrusted site. And weeks later I had links appearing all over my sidebar, and every time I removed them from my blog, they reappeared days later. I don’t know what was worse, the fact that my blog was now linking to bad neighbourhood sites or the fact that I knew there was a backdoor entry in my WordPress and I didn’t have a clue how to remove it.<\/p>\nAlmost a year on, and a year wiser, I’ve learnt quite a few things about WordPress security and I’m going to share with you the tips that helped me to lock down my WordPress blog.<\/p>\n
I’ll be asking you to perform a few tweaks to your blog, so as always back up both your database and your files in order to have some way of restoring your blog if things go pear shaped.<\/p>\n
Tip 1: Stay updated<\/strong><\/p>\n This one comes straight out of chapter "obvious", but as exploits and vulnerabilities are discovered, WordPress is fast to implement changes to patch them up. Having an out of date WordPress running on your blog means that you’re one of the remaining sites that are still open to the exploit. Check your back end administration panel for notifications of potential updates, and make sure to run them on all of your sites. You may need to have a test blog running with the same plugins and themes installed in order to run a "guinea pig test" to make sure they’re all compatible, before you actually run the updates on your live sites.<\/p>\n Tip 2: Make Regular Backups<\/strong> <\/p>\n No matter what security measures you have in place, you need to have good reliable backups just in case something goes wrong. I really like the WP-Db-Backup<\/strong> plugin as it automatically creates a backup of my database and sends it to me via email. You can set the frequency of time it takes to create the backup, I would advise you to make weekly or daily backups depending on how often the blog is updated. The WordPress files can be backed up manually via FTP by connecting to your web server, I make monthly backups of the files as they aren’t updated much.<\/p>\n It’s good practice to backup your files on an offsite server, I tend to use online backup services to upload all my music, documents and work related files using online backup, it’s a great way for mobile bloggers who work off laptops to safely backup their files in a safe location. <\/p>\n Tip 3: Lock down your WP-admin<\/strong><\/p>\n Many users down realise this, but the wp-admin isn’t as secure as it should be, in most cases it’s open for brute force password hackers to repeatedly attack the login page with a hash file and attempt to gain access to your login. Thankfully there are great steps you can take to prevent that<\/p>\n Tip 4: Lock down your WP-includes folder<\/strong><\/p>\n Not many users are aware of this but the \/wp-includes folder is viewable to the public if your server has enabled directory listing, the problem is the WP-includes can leave footprints of plugins and WordPress versions which may have security loopholes and can be exploited. To fix this:<\/p>\n Tip 5: Stay away from themes and plugins outside of wordpress.org<\/strong><\/p>\n Simply put, Always download your plugins and themes through your WordPress admin pages, they’re verified and tested by the WordPress team. Many WordPress themes acquired from outside have encrypted elements in them, some can be just hyperlinks to other sites, however many are shady enough to leave backdoor entries into your blog allowing them access onto your blog. Tip 6: Perform scans before installing unfamiliar plugins and themes.<\/strong><\/p>\n I highly recommend the Wp-Security-Scan<\/strong> plugin, it scans your WordPress installation for security vulnerabilities, and also scans themes and plugins to detect any irregular activity, such as encrypted elements and potential backdoor threats, when installing a new plugin, add it, but before activating run the Wp-Security-Scan to get the all clear before activating. Conclusion<\/strong><\/p>\n So there you have it, 6 great tips that you can execute in less than 30 minutes which will drastically increase the level of security of your WordPress blog. I hope you’ve enjoyed this post, and feel free to tweet it and post it on your frequently visited forums to help out other WordPress bloggers.<\/p>\n\n
\n
\n Themes and plugins outside of wordpress.org should only be acquired if they are reliable, do plenty of research before downloading, read up reviews, and even if there are many positive reviews check for authenticity and authority for these reviews.<\/p>\n
\n From my past experience of getting breached, I found Wp-mal-watch<\/strong> an excellent plugin, it scans your WordPress blog every night to look for traces of any security threats, such as suspicious files appearing on your web host, or unauthorised changes to your WordPress blog.<\/p>\n