I really like the guys at Inmotion Hosting. Normally when your blog get puts a huge load on their server the host usually shuts you down. The then send you and email and tell you to fix the problem. On the weekend I was notified that Ez eSports Betting had suffered a brute force attack! Instead of the usual “Hey dude, your site is stressing out our server fix it or else” email the guys at Inmotion Hosting they temporarily disabled the login script.
This is so much better than taking your blog offline as you’re the only one affected. As for everyone else business goes on as usual. They also provided a link as to how you can prevent these type of attacks. As I wanted to make my WordPress blog as secure as possible I took their advice.
Secure WordPress From Devilish Hackers
As you can see I produced a step by step video as to how you can secure your WordPress blog from hackers. As some brute force attacks focus on your wp-admin and wp.login.php scripts the following fixes will require them to provide a username and password before they can have access to your wp-admin! This takes all the stress off the servers making for happy hosts, secure WordPress sites and disappointed hackers.
I give credit where credit is due so I’m going to link to the tutorial that helped me to secure my blogs. Now where there is nothing wrong with that tutorial there was a couple of points that I misunderstood which caused me some issues. My fault not theirs! So, I thought it a good idea to do my own version in the hope that other non techies can benefit from it.
Note, this will only work on self hosted WordPress blogs that have access to cPanel.
Secure WordPress Login Steps
[highlight]Note, you should always make a backup of any file before you edit it.[/highlight]
Click on Password Protect Directories found under your security section of cPanel
Select your document root and then click on go.
Click on the wp-admin directory
Check Password protect this directory, give it a name, then click save
Click on Go Back
Now select a strong username! I like to think of my username as an extension of my password. Not using your actual name or easy to guess words makes it that much harder for hackers to infiltrate your security
You can use the password generator or invent your own difficult password. Use uppercase, lowercase, numerals and other characters to make your password as difficult as possible. My password always have more than 10 characters which I store in my password manager.
Once you’ve entered your username and password you click Add/modify authorised user. If you now try to login to your wp.admin you will be prompted with a username and password screen.
Now go back to cPanel and click on File Manager, Select the Document Root for your domain. Check Show Hidden Files (dotfiles), then click Go.
Click on you wp-admin directory, highlight your .htacess file and click edit. Then add the following code to your .htaccess
Once again don’t forget to replace the ‘edit’ part of my code to reflect the information in your cPanel. When all is done click on save.
Your WordPress blog is now so much more secure than it was before you started this little exercise. Having said that there is one more bit of code that you add to make it even more bulletproofed. Once again Inmotion Hosting provided me with the solution to “limit WordPress admin login attempts by IP address, or referrer.”
As my IP is always changing I went for the “you can protect your WordPress site by only allowing login requests coming directly from your domain name. Simply replace example.com with your own domain name
Most brute force attacks rely on sending direct POST requests right to your wp-login.php script. So requiring a POST request to have your domain as the referrer can help weed out bots.”
Here is the code to add to your .htaccess, the one you’re just finished editing.
The new code is the one between the #Wordpress Security tags. Just make sure you replace example.com with you’re own domain. That’s it! Your WP blog is now a lot securer than it was. I’ve even deleted my “limit login attempts” plugin as it’s no longer needed removing some of the strain placed on my server.
I hope you’ve found this post useful. If so why not share it around.