Wordpress security dissected and analyzed: Part 1 - The Community's Center for Security


The central voice for Linux and Open Source security news

Welcome!

Sign up!

EnGarde Community

Polls

What is the most important Linux security technology?

	SELinux
	grsecurity
	CIS Benchmark
	Bastille Linux
	iptables
	LIDS

Advisories

Community

Linux Events

Linux User Groups

Link to Us

Security Center

Book Reviews

Security Dictionary

Security Tips

SELinux

White Papers

Featured Blogs

All About Linux

DanWalsh LiveJournal

Securitydistro

Latest Newsletters

Linux Security Week: February 6th, 2012

Linux Advisory Watch: February 3rd, 2012

LinuxSecurity Newsletters

RSS Feeds

Get the LinuxSecurity news you want faster with RSS

Wordpress security dissected and analyzed: Part 1

User Rating:

How can I rate this item?

Source: Bandit Defence - Posted by Dave Wreski

Wordpress is very popular as both a blogging platform and a general CMS. [...] Unfortunately, the more layers of technology you add to a website (PHP code, MySQL databases, authentication mechanisms, fancy themes and endless plugins), the more security holes you potentially open up. Since I started this blog I’ve learned a lot about Wordpress security and how to reduce your risk of getting hacked. Here’s my attempt to not only suggest WP security best-practices, but also to explain how Wordpress works so you have an understanding of what leaves yourself potentially open to attack.

This part includes an explanation of what Wordpress is, what themes and plugins are, and how they might be malicious or buggy. The next part will include concrete advice on how to configure your web server, your blog, etc.

Read this full article at Bandit Defence

Comments

Clean up the TXT files too!

Written by PhilB_CMS on 2009-06-15 21:33:54

A additional security issue may be all of the “readme” and “info” and other files left behind - not just for WordPress and all the plugins and templates, but other apps as well. I recently found in my server logs two strange bots from Chinese IPs that were active looking for readme txt files. If a particular plugin or app version has a vulnerability, it certainly may be more effective to scan the txt files that could indicate versions.

Just to be on the safe side I remove all of the txt files, mods descriptions, etc from any web-accessible directory for my wordpress installs.

Only registered users can write comments.
Please login or register.