3 ms·

Dear HN hivemind, do you have any advice for me on how to keep my client's WordPress.org sites secure? A guide that you trust or maybe a good shared host that t

Dear HN hivemind, do you have any advice for me on how to keep my client's WordPress.org sites secure? A guide that you trust or maybe a good shared host that takes care of these things? Google just gives me a bunch of content spam, but I know that there's gotta be some best practices I can employ.

hannob 10y ago
1. You're using Wordpress, that's already good. It has autoupdates. You're unlikely to get hit by a vuln like this. 2. Don't disable autoupdates. 3. Avoid plugins and external themes. If you can stick to Wordpress Core. If you use plugins use as few as possible and only ones that are maintained regularly. Keep plugins and themes updated. 4. Don't disable autoupdates. Also, have I mentioned you shouldn't disable autoupdates?
- bigmanwalter 10y ago
  What if my clients like their absurd selections of plugins and themes?
mpol 10y ago
What is a good thing is keeping on top of updates for WordPress Core, plugins and themes. You could decide to not upgrade when a new major version comes out, like 4.8.0, but wait till there is a 4.8.1. Often there is a rush to pack new features in a new release, and the first update often has quite a few security fixes. Also, be picky about which plugins and themes you use. And if you notice that one becomes unmaintained (no updates anymore), make a plan to switch to something else. /edit: Commercial themes are often overloaded with lots of functionality that you don't need. If you care about security, avoid them. There are also plugins like WordFence, which might be a good idea (I don't really know). Most things that are in there should really be handled serverside, like mod_security rules and firewall rules. This topic is about WAF rules, which are serverside done afaik. If you just use shared hosting and have no control over the server, using WordFence might be a good idea.
trakout 10y ago
Keep it updated, and don't use 3rd party plugins.
CaveTech 10y ago
I would recommend using a wholly hosted solution, such as wpengine or wordpress.com. WP has a history of serious vulnerabilities and running a few instances yourself is not worth the operational costs.
- bigmanwalter 10y ago
  Can you recommend any on a low budget? wpengine.com is a bit pricey and wordpress.com has too few plugins.
davidgerard 10y ago
Wherever possible, outsource. wordpress.com if you can deal with their limited selection of themes and plugins, any number of third-party outsourcers whose bread and butter is WordPress if you need your own theming. (I maintain three WP myself by hand, but that's me being a control addict.) WP's core security is vastly better these days. So instead you'll fall prey to a cruddy plugin or theme ... especially the latter, being PHP written by designers. (Nothing against good designers, but design thinking is not security thinking.) A really useful shortcut: put /wp-admin/ behind Apache basic auth. This stops most doorknob-rattling automated 'sploits in their tracks. (Main barrier to doing this in practice is that nontechnical editorial people tend to get confused by two layers of password.)
fencepost 10y ago
Use a WordPress firewall - something that catches things like requests containing SQL, PHP or references to WP's internal keywords.
DamnInteresting 10y ago
I operate a semi-well-known website that has been running Wordpress for over 11 years, and it's been hacked and attacked relentlessly since the early days. On multiple occasions the attackers have managed to get their "dashboards" onto the server to insert spam links and use my server in a botnet. I keep my Wordpress and plugins up-to-date, but they still kept finding ways in. What finally worked for me was to write a simple front-loader to replace the Wordpress front-loader. It has a whitelist of allowed $_POST fields, a blacklist for $_POST content, and it deletes anything in $_FILES unless the user is on a whitelisted IP. This has kept the site safe for several years now so far. Mine is an extreme case, but maybe this approach will be helpful to other extreme cases.
- dotancohen 10y ago
  I would love to discuss your loader. I've added a few lines of if(){exit();} to index.php and if you have any ideas to share I would much appreciate the advice. My Gmail username is the same as my HN username. Thanks!

hannob 10y ago

1. You're using Wordpress, that's already good. It has autoupdates. You're unlikely to get hit by a vuln like this. 2. Don't disable autoupdates. 3. Avoid plugins and external themes. If you can stick to Wordpress Core. If you use plugins use as few as possible and only ones that are maintained regularly. Keep plugins and themes updated. 4. Don't disable autoupdates. Also, have I mentioned you shouldn't disable autoupdates?

bigmanwalter 10y ago
What if my clients like their absurd selections of plugins and themes?

mpol 10y ago

What is a good thing is keeping on top of updates for WordPress Core, plugins and themes. You could decide to not upgrade when a new major version comes out, like 4.8.0, but wait till there is a 4.8.1. Often there is a rush to pack new features in a new release, and the first update often has quite a few security fixes. Also, be picky about which plugins and themes you use. And if you notice that one becomes unmaintained (no updates anymore), make a plan to switch to something else. /edit: Commercial themes are often overloaded with lots of functionality that you don't need. If you care about security, avoid them. There are also plugins like WordFence, which might be a good idea (I don't really know). Most things that are in there should really be handled serverside, like mod_security rules and firewall rules. This topic is about WAF rules, which are serverside done afaik. If you just use shared hosting and have no control over the server, using WordFence might be a good idea.

trakout 10y ago

Keep it updated, and don't use 3rd party plugins.

CaveTech 10y ago

I would recommend using a wholly hosted solution, such as wpengine or wordpress.com. WP has a history of serious vulnerabilities and running a few instances yourself is not worth the operational costs.

bigmanwalter 10y ago
Can you recommend any on a low budget? wpengine.com is a bit pricey and wordpress.com has too few plugins.

davidgerard 10y ago

Wherever possible, outsource. wordpress.com if you can deal with their limited selection of themes and plugins, any number of third-party outsourcers whose bread and butter is WordPress if you need your own theming. (I maintain three WP myself by hand, but that's me being a control addict.) WP's core security is vastly better these days. So instead you'll fall prey to a cruddy plugin or theme ... especially the latter, being PHP written by designers. (Nothing against good designers, but design thinking is not security thinking.) A really useful shortcut: put /wp-admin/ behind Apache basic auth. This stops most doorknob-rattling automated 'sploits in their tracks. (Main barrier to doing this in practice is that nontechnical editorial people tend to get confused by two layers of password.)

fencepost 10y ago

Use a WordPress firewall - something that catches things like requests containing SQL, PHP or references to WP's internal keywords.

DamnInteresting 10y ago

I operate a semi-well-known website that has been running Wordpress for over 11 years, and it's been hacked and attacked relentlessly since the early days. On multiple occasions the attackers have managed to get their "dashboards" onto the server to insert spam links and use my server in a botnet. I keep my Wordpress and plugins up-to-date, but they still kept finding ways in. What finally worked for me was to write a simple front-loader to replace the Wordpress front-loader. It has a whitelist of allowed $_POST fields, a blacklist for $_POST content, and it deletes anything in $_FILES unless the user is on a whitelisted IP. This has kept the site safe for several years now so far. Mine is an extreme case, but maybe this approach will be helpful to other extreme cases.

dotancohen 10y ago
I would love to discuss your loader. I've added a few lines of if(){exit();} to index.php and if you have any ideas to share I would much appreciate the advice. My Gmail username is the same as my HN username. Thanks!