Updating WordPress to the Latest Version
Gone are the days where people edit the core files of WordPress right?
I’m still guilty of editing my themes directly out of laziness. I know I can create a child theme or create some plugins, use custom styles and functions, but I don’t.
So, I lose the ability to one-click update my themes. That’s unfortunate (sometimes), but I don’t mess with the WP core, and when an update is avalable I go to all my sites and perform an update immediately.
People, good and bad, have access to the core WP code. The bad guys attack any exploits found. The good guys report and/or fix the exploits, and an update is posted. Without the update, your WP site is vulnerable (unless it’s just a feature upgrade).
Updating is easy. Go to Dashboard > Updates and you’ll see how in there. And if you are with a fully managed WP service like WPEngine, or you used your hosts “quick install” app, you are most likely getting the updates without any intervention.
But update you should. Always. Without fail. Same for plugins, and themes. D’oh!
Delete unused themes and plugins too. And make sure you are using plugins from reputable developers.
Updating the Password to Something Stronger
As mentioned, RoboForm generates strong passwords, but you don’t need a paid tool for that. There are lots of free web based apps that generate strong passwords out there.
People need to stop using kids and pets names, and dictionary words as passwords if they want any type of security.
The requirements for a secure password are:
upper and lowercase letters
at least eight characters long
and including “special” characters
(^%$#&@*).
I personally try to keep mine at 15 characters, and with RoboForm I can ensure a certain amount of numbers and special characters make it in there. When are they going to allow Tab, Shift, and CrLf in passwords? Is that possible? If so, get on with it password gods.
Password Protecting the wp-login.php File
Another line of defense is to password protect the wp-login.php file, which is the code that is executed to display the WP admin/user login form.
1)Create a password file– Open up a text editor, and create a file (use “save as,” and change to “all file types” because this won’t be a standard .txt extension) called .wpadmin and add the username and encrypted password using the steps below. Note the dot (.) at the beginning, and there is no actual filename, just an extension. If you are familiar with .htaccess you know what I’m talking about already.
The password to be used in the file should be hashed using the MD5 algorithm, making it useful for both Windows and Linux machines.
Here’s the format:
username:encryptedpassword
To create an encrypted password:
a)
Visit http://www.htaccesstools.com/htpasswd-generator/.
b) Enter a username and desired password in the appropriate boxes and clickCreate .htpasswd file.
c) Copy the generated text to your .wpadmin file and save it.
2)Upload the password file– Upload the file to a non-browsable folder.
Place it in: /home/username/ if using CPanel (‘username’ is not literal, it is your CPanel username), or /var/www/vhosts/domain for Plesk for example.
3)Update the .htaccess file– All domains under the “home” directory will utilize this password file. Therefore, if you have several add-on domains in your account using WP, they will all access the same password file.
Create a .htaccess file in a similar way that you created the .wpadmin file. Also, it will ultimately be uploaded to the same place.
The content for the file: (be sure to change the AuthUserFile path to the appropriate location – in most cases that means: replace ‘username’ with your cPanel username):
ErrorDocument 401 "Unauthorized Access"
ErrorDocument 403 "Forbidden"
AuthName "Authorized Only"
AuthType Basic
AuthUserFile /home/username/.wpadmin
require valid-user
Things to consider before employing the wp-login.php file protection. Do your sites cater to many users? They will all need to know the login info. Plus, if there is already a .htaccess file in the /home/username/ folder, you may need to merge the contents.
Ok, once it is in place and you visit the wp-login.php page of a WP install you will be prompted with a pop-up login screen that says:
Authentication Required
The server http://www.domain.com:80 requires a username and password. The server says: Authorized Only.
Dealwap