TheWayOfCoding.com

I had written a basic securing wordpress article back in February of this year. Since then I’ve done a bit more research and came upon the idea of using Apache to help secure the administration directory and scripts, making it more difficult for intrusions to take place. It’s always a good idea to try and protect your sites as best you can. When dealing with open source software, the code is visible to the world, so any exploits that have been found can travel fast. Issues and security flaws get fixed on well known open source projects like WordPress, but it also leaves an un-upgraded system easily open to attack. One option to add a second layer of protection by using Apache server’s built-in directory password functionality. Thankfully, Askapache made a decent plug-in to save a good deal of time playing around with Apache .htaccess settings and researching the necessary code. While the plugin needs work, it functions with a bit finesse on your part. Download the Askapache Passw...

Please view this newer article for another method of securing the wp-admin directory from access. Here are a few tips to securing a wordpress based blog or site: Change the location of your wp-content directory. This is good for making your site’s source code less discernable as a wordpress blog. In the wp-config.php file: define('WP_CONTENT_DIR', $_SERVER['DOCUMENT_ROOT'] . '/wp-content'); define('WP_CONTENT_URL', 'http://example/wp-content'); Change “wp-content” to something else. Keep in mind that some plugins are not programmed correctly and have hard-coded links to the content directory as “wp-content”, so that could cause issues. If you notice your plugins not working, open the related source files and search for the phrase. ————————– Change the admin’s login name to something besides “admin” This can be done with something like phpMyAdmin to edit the database. The user_login varchar(60) field in the wp_users table is the value you wan...