Ultimate Tutorial to Make your WordPress Blog 100% Secure

May 17th, 2009 - Hacks, Tips & Tricks, WordPress

Every WordPress blogger wants to make his blog 100% secure so that no hacker could hack it. So, I had written a tutorial to do it:-

1. First of all add the following code at the beginning of your public_html/.htaccess file:-

Options All -Indexes

2. Add the following code according to the type of your ip address in wp-admin/.htaccess

Static ip address:

AuthUserFile /dev/null
AuthGroupFile /dev/null
AuthName “Access Control”
AuthType Basic
order deny,allow
deny from all
allow from xx.xx.xx.xx

You will have to change the xx.xx.xx.xx to your static ip address.

Dynamic ip address:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REMOTE_ADDR} !^xxx\.xxx\.
RewriteRule .* http://www.kishan.info/ [R,L]
</IfModule>

You will have to change the xxx.xxx to your dynamic ip address’s first six numbers. For example, if you dynamic ip address is 111.111.111.1 then you should change it to 111.111. After doing this you’ll be only able to access the wp-admin folder if your ip address starts from what you have given in the htaccess file.

2. Change your user from admin to something else. If you don’t know how to do it then follow the tutorial:-

a. Go to Users -> Add New and fill up the details. Select “Administrator” as the role.
b. Logout from the admin account and login to the new account.
c. Goto Users and delete the admin account.
d. Check the Attribute all posts and links to: button and select the newly created user name in the drop down box.
e. Now click on Confirm Deletion.

3. Download the following plugins and install them:-

WP Security Scan – It will perform a security check of your blog and tell you what shall be fixed in your blog.

Chap Secure Login – It will send the password encrypted when you login for non-ssl blogs.

Login LockDown – It will block the IP for (user set) minutes after giving (user set) login attempts to block Brute Force and Dictionary Attacks.

If you don’t know how to install WordPress plugins then goto this link and follow the instructions given there.

4. Change your WordPress database prefix. If you don’t know how to do then go to this link and follow the tutorial.

Some tips which you should follow:-

All always update your WordPress version and plugins.
Change your admin password weekly.
Choose a unique password with uppercase, lowercase, numbers, spaces and special characters (e.g. K!$_h@N) and never use it in other websites.
Never tell anyone what plugins and WordPress version you are using.

Share |