Blogging Tips

WordPress is a leading blogging platform and CMS for just about any business website. Karol K. of ThemeMuse writes at ProBlogger, “It [WordPress] doesn’t have any preposterous security issues that beginning programmers could exploit. The problems, however, arise when you try to tweak your installation of WordPress by adding new plugins or themes, implementing hacks, or doing anything else that interferes with WordPress.”

Professional bloggers, novice bloggers, and large and small businesses have been picking up the WordPress platform and adapting it to suit their needs for years now. However, the adapting part is where many run into problems. Here are some of the easiest ways to ensure that your WordPress blog or website remains secure and online.

Password and Username Security for WordPress
Website security in general is often more about deterrence than creating an impregnable fortress. Hackers are looking for an easy target, and a WordPress blog with “admin” as the username and a weak password is just begging for trouble.

Christian Cawley of MakeUseOf suggests, “Protecting the actual act of logging on to your WordPress-based website is best effected by using an encrypted login plugin, as the website software doesn’t have this facility by default.” He recommends the Chap Secure Login plugin as one way to keep your password and username from being exploited.

Keep WordPress Updated
The latest version of WordPress is not released just to give you something else to do in your spare time. Most updates are critical for your site’s security. Christina Warren at Mashable writes, “Security holes will be discovered and bad guys will do their best to exploit them. Keeping your software up-to-date is a good way to stave off attacks, because reliable software vendors will fix their products once security holes are found.”

Limit Your Page Permissions for WordPress Security
Page permissions are security parameters you set that enable you or others to edit pages on your blog. Sometimes it’s convenient to make your page permissions open while setting up a blog, but once you’re up and running, you need to reset your page permissions in order to prevent hackers from accessing them. Check out the permission information in the WordPress Codex < http://codex.wordpress.org/Hardening_WordPress#File_permissions > in order to figure out which steps you need to take. Securing your blog this way may require some trial and error, but it’s well worth the effort.

Use WordPress Security Plugins
There are many WordPress security plugins that remove malicious files, expose weak points, and take defensive measures that will make your site more secure. One of the most thorough security plugins is Website Defender’s Secure WordPress Plugin. You can also keep track of potential weak points in your blog’s security by installing the WP Security Scan plugin.

The WP Firewall 2 plugin is another defensive measure that prevents changes from being made to your blog by any potentially malicious sources. According to the plugins page, “This plugin intelligently white lists and blacklists pathological-looking phrases, based on which field they appear within, in a page request (unknown/numeric parameters vs. known post bodies, comment bodies, etc.).” In other words, hackers will be restricted from making changes to your site since this plugin will recognize the code they enter.

In order to protect your database and other tables from attack, consider the Bullet Proof Security plugin. One blogger notes that this plugin “protects your blog against XSS, RFI, CRLF, CSRF, BASE64, Code Injection and SQL Injection hacking attempts. The bulletproof security plugin also optimizes your .htaccess file for the utmost security.” Chances are you don’t know what any of those acronyms mean, but hackers do, and that’s why you need to take note of this plugin.

Beware Unsecure Plugins for WordPress
While security plugins can be a big part of the solution, unsecure plugins also present a major part of the problem for WordPress blogs. You should generally only use regularly updated plugins that have a proven security record. Before installing a plugin, do a few searches of the user reviews and online in general to find out if anyone has been hacked while using the plugin you’d like to install.

If you stop using a plugin, just delete it in order to minimize your exposure to hackers. In fact, Karol K. at ProBlogger suggests removing unused themes as well.

Keep Your Computer Clean
By regularly sweeping your computer of spyware and scanning for viruses, you’ll keep your computer, financial information, and WordPress site more secure. If hackers can infect your computer, they can also gain access to your online information. A clean computer will ensure that you have a secure blog.

While WordPress makes blogging easier for many, the modifications users make can expose WordPress sites to attacks. With regular site maintenance, being careful about what you add to your blog, and using the best security plugins, you can keep your blog clean and secure for the long run.

This guest post is written by Lior Levin, a marketing consultant for a css company, and who also consults for a company that specializes in a to do list app for businesses and individuals.