Latest ads
-
🎮 INDIAN PSN GIFT CARDS AVAILABLE NOW! 🎮
- madukaperera
- Updated:
-
🚀 Google AI PRO – 18 Months | Rs. 850 Only- lkkolla
- Updated:
-
🔒 NordVPN Premium – 3 Months- hrdilshan
- Updated:
-
🚀 Microsoft Office 365 Pro Plus – Lifetime Access! 🚀- hrdilshan
- Updated:
Wordpress HelpZ
- Thread starter namila007
- Start date
Wordpress eka gena tips me thread eken katha karamu [
10 Security Tips for WP
Security Tips
1. Nobody should be allowed to search your entire server.
WPdesigner advices us to NOT use this search code in the search.php
2. Directories should not be left open for public browsing
There is a potential problem letting people know what plugins you have, or what versions they are. If there is some known exploit that is linked to a plugin, it could be easy enough for someone to use it to their advantage. Make an empty wp-content/plugins/index.html file or just add this line in your
3. Drop the version string in your Meta Tags
A large number of WordPress themes have the WordPress Meta Tag that show the version of WordPress that is running on your blog which is an easy way to get your blog prone to hackers if you didn’t upgrade to the security-enhanced file permissions on both which is pointed out by Matt Cutts. Another solution involves a plugin that sets up a secondary new version.
4. Stay Updated
You need to keep your on your plugin/widget, theme, and Wordpress versions updated. Also, subscribing to the plugin/widget/theme Author’s RSS feeds makes keeping up with them much easier.
5. Take regular backups of your site and Database
You always have to take regular backups of your file directories as well as the database. WordPress Database Backup plugin creates backups of your core WordPress tables as well as other tables of your choice in the same database.
6. Use SSH/Shell Access instead of FTP
If someone gets a hold of your FTP login information (which is usually not encrypted and easy to get), they can manipulate your files and add spam to your site without you even knowing about it! Using SSH, everything is encrypted including the transfer of files, etc.
7. Stop worrying about your wp-config.php file
Keep your database username and password Safe by adding the following to the .htaccess file at the top level of your WordPress install:
This will make it harder for your database username and password to fall into the wrong hands in the event of a server problem.
8. Block WP- folders from the Search Engines
There is no need to have all of your filesWordpress files indexed by Google, so it’s best to block them in your robots.txt file. Add the following line to your list
Disallow: /wp-*
9. Block access to WP-Admin folder using .htaccess
There is an article written Reuben that talks about how you can protect your Wordpress admin folder by allowing access to it from a defined set of IP addresses. Everything else will bring up a Forbidden error message. So if you only access your blog from one or two places routinely, it’s worth implementing. Also, you’re supposed to create a new .htaccess file inside your wp-admin folder, not replace the one at the root of your blog
10. Don’t Use Default Passwords
Are you still logging into your wp-admin page with the same default password that was emailed to you? If so, CHANGE IT! You can follow the instructions given in the article “Hack Proof Password” posted by us earlier to imrove the strength of your password.
11. Change database table prefix
The default prefix used by WordPress is “wp”. You can easily change the prefix to other terms that are difficult to guess using the WP-Security-Scan. More detail on this plugin below.
12. Don’t use (or better yet, remove) the default “admin” username
When you install WordPress, it automatically generates a user with Administrator-level permissions called admin. It is strongly recommended that you do not use this username to make it harder for the hacker to guess your username and password via Brute force attacks. Even if you downgrade its permission role, it’s still a better idea just to remove this user altogether.
You can use the Change Username Plugin to change the Username of Admin Account.
Try these.....
Security Tips
1. Nobody should be allowed to search your entire server.
WPdesigner advices us to NOT use this search code in the search.php
Code:
<?php echo $_SERVER ['PHP_SELF']; ?>
Nobody should be allowed to search your entire server, or? Use this one instead:
<?php bloginfo ('home'); ?>
Block WP- folders from being indexed by search engines, the best way to block them in your robots.txt file. Add the following line to your list:
Disallow: /wp-*2. Directories should not be left open for public browsing
There is a potential problem letting people know what plugins you have, or what versions they are. If there is some known exploit that is linked to a plugin, it could be easy enough for someone to use it to their advantage. Make an empty wp-content/plugins/index.html file or just add this line in your
Code:
.htaccess file in your root:
Options All -Indexes3. Drop the version string in your Meta Tags
A large number of WordPress themes have the WordPress Meta Tag that show the version of WordPress that is running on your blog which is an easy way to get your blog prone to hackers if you didn’t upgrade to the security-enhanced file permissions on both which is pointed out by Matt Cutts. Another solution involves a plugin that sets up a secondary new version.
Code:
This tag is in the header.php file that displays your current version of wordpress.
<meta content="WordPress <?php bloginfo(’version’); ? />" name="generator" />4. Stay Updated
You need to keep your on your plugin/widget, theme, and Wordpress versions updated. Also, subscribing to the plugin/widget/theme Author’s RSS feeds makes keeping up with them much easier.
5. Take regular backups of your site and Database
You always have to take regular backups of your file directories as well as the database. WordPress Database Backup plugin creates backups of your core WordPress tables as well as other tables of your choice in the same database.
Code:
[B]WordPress Database Backup[/B]
[URL="http://wordpress.org/extend/plugins/wp-db-backup/"]Download[/URL]
[URL="http://www.ilfilosofo.com/blog/wp-db-backup"]Plugin HomePage[/URL]
WordPress database backup creates backups of your core WordPress tables as well as other tables of your choice in the same database.6. Use SSH/Shell Access instead of FTP
If someone gets a hold of your FTP login information (which is usually not encrypted and easy to get), they can manipulate your files and add spam to your site without you even knowing about it! Using SSH, everything is encrypted including the transfer of files, etc.
7. Stop worrying about your wp-config.php file
Keep your database username and password Safe by adding the following to the .htaccess file at the top level of your WordPress install:
Code:
<FilesMatch ^wp-config.php$>deny from all</FilesMatch>This will make it harder for your database username and password to fall into the wrong hands in the event of a server problem.
8. Block WP- folders from the Search Engines
There is no need to have all of your filesWordpress files indexed by Google, so it’s best to block them in your robots.txt file. Add the following line to your list
Disallow: /wp-*
9. Block access to WP-Admin folder using .htaccess
There is an article written Reuben that talks about how you can protect your Wordpress admin folder by allowing access to it from a defined set of IP addresses. Everything else will bring up a Forbidden error message. So if you only access your blog from one or two places routinely, it’s worth implementing. Also, you’re supposed to create a new .htaccess file inside your wp-admin folder, not replace the one at the root of your blog
10. Don’t Use Default Passwords
Are you still logging into your wp-admin page with the same default password that was emailed to you? If so, CHANGE IT! You can follow the instructions given in the article “Hack Proof Password” posted by us earlier to imrove the strength of your password.
11. Change database table prefix
The default prefix used by WordPress is “wp”. You can easily change the prefix to other terms that are difficult to guess using the WP-Security-Scan. More detail on this plugin below.
12. Don’t use (or better yet, remove) the default “admin” username
When you install WordPress, it automatically generates a user with Administrator-level permissions called admin. It is strongly recommended that you do not use this username to make it harder for the hacker to guess your username and password via Brute force attacks. Even if you downgrade its permission role, it’s still a better idea just to remove this user altogether.
You can use the Change Username Plugin to change the Username of Admin Account.
Try these.....
yaa....leesi tamai....mokadda site eka??? mage sote ekth WP tamai
http://dzoneonline.com/
http://blog.dzoneonline.com/
http://sinhala.dzoneonline.com/
http://live.dzoneonline.com/
thama.... what about u ?
mystique settings wala content wala post preview eke content kotase mokakda thorala thiyanne
Full/excerpt or something else?
home ekedi summery ekath ekka picture ekak thiyana widihata hadanne kohomada?
please tell
Full/excerpt or something else?
home ekedi summery ekath ekka picture ekak thiyana widihata hadanne kohomada?
please tell
i used Wp just for fun
http://slfear.wordpress.com/
but i planing to build my own site
how can i get my own domain name?without paying
or how can i remove wordpress.com in my domain for free?
is there any way to remove it 4 free?
or how can i create or host a server without paying?
if tre isnt any way how much will it cost?
im n00b for this so can any one help!!
any way thanks for this thread
http://slfear.wordpress.com/
but i planing to build my own site
how can i get my own domain name?without paying
or how can i remove wordpress.com in my domain for free?
is there any way to remove it 4 free?
or how can i create or host a server without paying?
if tre isnt any way how much will it cost?
im n00b for this so can any one help!!
any way thanks for this thread
hey machanz .....there r soo many free web hosting serves ..then u cn upload wordpress to ur own server..
http://www.000webhost.com/
try this one..this is a free web hosting site..Try this....
hey machanz .....there r soo many free web hosting serves ..then u cn upload wordpress to ur own server..
http://www.000webhost.com/
try this one..this is a free web hosting site..Try this....
hi thanks for ur help
i tryed to make my own server but i got some problems
i create new account in 000webhost.com and i download wordpress
but still i cant host my own so if u can pls show me step by step how to upload wordpress. it will help me and others who n00b like me.
THANKS AGAIN GOOD WRK BRO
hi thanks for ur help
i tryed to make my own server but i got some problems
i create new account in 000webhost.com and i download wordpress
but still i cant host my own so if u can pls show me step by step how to upload wordpress. it will help me and others who n00b like me.
THANKS AGAIN GOOD WRK BRO
machanzz.....steps tika dennam
1.mulinma filezilla hari wena ftp soft ekak dl karala install karaganna.
2.passe wp extract karala publick folder ekata upload karanna..
3.000webhost eke control pannel ekata gihilla mysql data base ekak hadanna..eke pass user name,servername copy karala tiyaganna.
4.wp up karaata passe site eke link ekata yanna.
5.site ekata ginhin wp setup karanna..
6.passe post danna
machanzz.....steps tika dennam
1.mulinma filezilla hari wena ftp soft ekak dl karala install karaganna.
2.passe wp extract karala publick folder ekata upload karanna..
3.000webhost eke control pannel ekata gihilla mysql data base ekak hadanna..eke pass user name,servername copy karala tiyaganna.
4.wp up karaata passe site eke link ekata yanna.
5.site ekata ginhin wp setup karanna..
6.passe post danna
oooooooook machan i will try now
Similar threads
