How Macbook Air Became My Office
10 Things You Should Know About The WordPress Brute Force Attacks
Unless you have been living at the bottom of a well, you are probably well aware by now of the brute force login attacks hammering WordPress sites worldwide. Today, we are enumerating 10 things you should know about this situation and how to harden your WordPress installs -- and what to do if you are a victim of these attacks.
Unlike hacks that focus on vulnerabilities in software, a Brute Force Attack aims at being the simplest kind of method to gain access to a site: it tries usernames and passwords, over and over again, until it gets in.... They are, in short, an attack on the weakest link in any website's security: You. ~~ WordPress Codex
- Some web hosts have been disabling access to the
wp-login.phpfile across all WordPress installs. If that's the case, you won't be able to access your WordPress backend; you'll just have to wait it out. (Or change web hosts because this is really NOT how you cope with this situation.) - Follow the advice given on WordPress's own Codex on Brute Force Attacks article.
- Use a plugin that limits unsuccessful login attempts; two to consider are Login Lockdown and Limit Login Attempts
- If your web host is not one who has disabled the
wp-login.phpfile, you can protect it yourself by creating an authenticated user and password and modifying your .htaccess file. - Read this article and consider how to strengthen your passwords so that they are virtually hack-proof.
- Still not convinced about your login credentials? Then read what WordPress's creator, Matt Mullenweg, has to say about this recent hack attempt.
- If you are not using a self-hosted WordPress install but are instead blogging at WordPress.com, then enable Two-Step Authentication.
- Did I forget to mention? Update WordPress, update all your plugins; delete the ones you are not using (don't just disable them; delete them completely from your server); and update your theme if it needs updating.
- DIYers, learn how to rebuild your MySQL database after a hack.
- If the worst happens, you can hire a web developer with experience in threat management to help get your hacked site back on its feet, safe and sound.
10 Things You Can Do Right Now To Beef Up WordPress Security
Worried about security for your WordPress-based web site? You should be. Due to its popularity and ease of installation, WordPress sites are hacked more often than any other. There's a reason for this. But that doesn't mean you have to give them one. Here are ten things you can do right now to ensure that your WordPress-driven site is a bit more hack-resistent.
- Be sure WordPress itself is updated to the latest version. There should be no excuse for this since you can update WordPress from within the WP Dashboard (back up your database first of course).
- Be sure your plugins are updated. Again, this can be done from within the WP Dashboard.
- Be sure your theme is updated (unless you are using a completely one of a kind, hand-rolled, custom theme).
- If something prevents you from using the latest version of WordPress, you should disable WP from broadcasting the WP version your site is using. It's done with a very simple peice of code in your
functions.phpfile (see below). - Backup your database regularly (and TEST that backup to be sure it's functional). You can use one of several plugins -- we recommend either BackUpWordPress or WP DB Backup -- to backup your databse from within the WP dashboard and have a copy of the SQL dump sent to the email address of your choice or have it downlaoded to your hard drive. You can also schedule periodic backups with either of these plugins.
- Do not use the default admin account. In all "brute force" hacking attempts, admin is the User ID hackers will target. Don't let them have it.
- Set file permissions correctly on key files and folders. You should only allow your
.htaccessfile to be writeable when you are setting or changing permalinks. Otherwise, that file should be set to 444. Most files should be set to 644. Most folders should be set to 755. - Use secure FTP (SFTP) to access your files.
- Clean out your site's user base. Delete unused users and review each user's level to be sure they are not granted any more rights than they need to accomplish their tasks.
- Delete unused plugins and themes. Just because you aren't using them, doesn't mean they can't be a backdoor in for some hacker.
Removing Version Information From Older WordPress Installs
Here is the code that you should place in your functions.php file to disable version reporting. Use this only if you cannot upgrade to the latest WP version.
function wpvo_remove_version() {
return '';
}
add_filter('the_generator', 'wpvo_remove_version');
10 GetSimple CMS Sites
GetSimple CMS, a flat file CMS by Chris Cagle, is designed to serve a niche market for the small web site that doesn't need all the bells and whistles of WordPress, Drupal, Joomla!, CMS Made Simple or any other full-blown content management system. And it doesn't need a database. It runs completely on XML. And, the best thing about it? It's a snap to design for. Years ago, when we first discovered this clever CMS, we ended up designing our first GS web site on a Friday afternoon. It was a fluke, actually. Client called and needed a site up ASAP. Within an hour of her domain purchase, GS was up and running and within another hour, the site had a spanking new design. Since that time, we've created several other client sites based on Get Simple CMS. But enough about us.
Today, years after our first foray into Get Simple, I want to see if it's still being embraced by web developers as a solution for that basic-needs web design client. And it turns out that it is. From restaurants to financial web sites to artists, and everything in between. Although while I was researching Get Simple powered sites for this article, it seems that Get Simple is very popular among Irish and Polish web designers. I have no idea why. But enjoy the sample that I have collected. And think about using Get Simple when it seems that all the other CMSs out there may be overkill for your client's needs.
- Impressions:
- This is a business site based on Get Simple. It's well done and keeps true to the color palette. The only misfire, IMHO, is the styling of the Contact page. I find the dark blue input boxes a bit jarring. Other than that it's perfect. The site designers submitted the site to the Get Simple forum and indicated that the site is using the following plugins: Zegnat's multi-level navigation, P01-contact form, and multi-user management; along with jQuery Sooperfish menu and Cufon font replacement.
- Design Firm:
- Design: Marco Martins
- Development: Martin Terber
- Impressions:
- This is a very well done small business web site. It has a lot of visual interest, not only in the lovely design, but the sidebar photo gallery. Flash headers class it up even further. GetSimple can power a business web site, depending on the needs of the business. Otto's is a very informative site and I came away wanting to know more about this fascinating venue.
- Design Firm:
- Bad Cat
- Impressions:
- This is a Cafe and Restaurant in Kosice, Slovakia, with a very elegant site design. The site is using the P01-Contact and I18n Gallery plugins. The restaurant has a rich history and care is taken to share photos of yesteryear, along with a photo gallery showing what today's diner can expect. There is much attention to detail, from the well chosen typographical elements (check out the knife, fork and spoon dividers on the inner pages), to the understated color palette. Very well done indeed!
- Design Firm:
- PixelOfficer
- Impressions:
- This is a catering equipment company based in Croatia. It is content-rich. The web developer submitted the site to the Get Simple show case and mentioned the site contained over 100 pages. Now, you might say to yourself, that's way beyond a simple site that Get Simple should be required to handle. But the pages are simple ones, so it can rise to this task easily. Nice blue, "trust me" color palette, a jQuery slider showcases their equipment and adds visual interest. Get Simple plugins used include News Manager, Simple Cache, i18N Search, i18N Navigation, and Client Files.
- Design Firm:
- Arboretum
- Impressions:
- This is the web site for a Polish jazz ensemble. Nice site, dark background on white text. Very clever use of the piano keyboard in the design.
- Design Firm:
- Raffee
- Impressions:
- Very well done web site for a design and personal coaching consultancy. I am a bit vague on what exactly this company offers. Nonetheless, it's a great example of a small business web site based on Get Simple CMS. Just poke around on the site's pages and you can see just how much content is there. Just like with the Koncar site above, just because the site has a lot of pages doesn't mean it's too big for Get Simple to handle.
- Design Firm:
- Jonathan Ross
- Impressions:
- Another site from designer Jonathan Ross. This one is a Japanese restaurant. What I love about it is the suite of icons at the lower right where you can read reviews about this restaurant from various sources (Yelp, Urban Spoon, etc.). Brilliant marketing, I think. And of course, the beautiful food photography seals the deal.
- Design Firm:
- Jonathan Ross
- Impressions:
- This is the web site of a musical ensemble. Other than the splash page and media links, the site is almost minimalist in its design, letting the striking logo speak. Very well done Get Simple site.
- Design Firm:
- Luca Musolesi
- Impressions:
- This is the site for a wine label and the design cleverly picks up its cue from a wine bottle label, from the stamp in the lower right to the parchment paper background and the judicious use of typography. Everything about the site is well organized and easy to find.
- Design Firm:
- Unknown
- Impressions:
- This is a Polish web site specializing in pizza making stones and other accessories. They are sold via an online auction site called Allegro (which I imagine operates similarly to eBay here). Just as any good restaurant or cooking or cooking accessories site would do, it places mouthwatering photographs front and center. I am salivating as I write this. A gorgeous site, very well laid out.
- Design Firm:
- Unknown
Leitberg Financial Advisors
Otto's GartenBahn
Mala Prana Cafe and Restaurant
Koncar Catering Equipment
Cracow Metro Band
Cultural Design Group
Wasabi Asheville
Adrian Ensemble
Domaine La Garance
Stone Baking
Would you like a web site based on Get Simple CMS? No problem! Just contact us. A Pixelita Design is more affordable than you think!