Phising attacks are also not very common with wordpress blogs and I have seen very rare cases in which wordpress users have fallen for phishing attacks, but almost every time a wordpress user will login into the dashboard by manually adding wp-admin to the end of the url, There are possibliles that wordpress users can be attacked by phishing attacks, but bloggers are already a bit tech savy and won't fall for these types of attacks, Alternatively if the hacker is smarter and can implement more advanced types of phishing attacks like desktop phishing ,tabnabbing or Dns Spoofing then there are chances that the wordpress user will fall for these attacks.
So How Do Hackers Hack Into Wordpress Blogs?Most of the skilled Hackers will target your wp-config as it's in an unsecure place by default. Wp-config file is the most important file present on your wordpress blog. It holds very sensitive information such as including your database access, table prefix and Secret Key, So in order to protect your wordpress blog from getting hacked you would need to harden your wp-config file. Here is how a wp-config file looks inside, As you can see from looking into it that it contains very sensitive information.
Protecting Wp-Config File From .htacessThe first step you should take write away is to add the following code to your .htacess file, This is the first step you should take in hardening your wordpress.
# protect wpconfig.phpChanging The Permission
deny from all
Last week I came across a wordpress blog, whose permission for wp-config file was set to readable, All the hacker needed to do is to upload a mysql database and use those to access victim's wordpress blog. So the bottom line is that the permission should not be set to readable, it should be set to something like "400".
Security keys were added in wordpress 2.6 to ensure better encryption of information stored in the user's cookies, A secret key also includes makes it harder to crack your passwords, If some how the hacker gets hold of your wordpress hash, You can get your secret keys from here, All you need to do is to add these secret keys to your wp-config file.
Moving Your Wp-Config FileBy default Wp-Config is located in the root folder, Wordpress themselves recommend users to move their wp-config file to some other place such as outside the root folder, This will prevent the Symlink bypassing attack to the some extent.
Moving To VPS Or Dedicated Host To Prevent Symlink Bypassing Attack
If your wordpress blog is on a shared host then it will be alot more vulnerable to symlink bypassing attack than on VPS or dedicated, If your blog is quite established and you can afford to move to VPS or dedicated hosting, Then I would recommend to move it right away.
I hope you have liked my post on Wordpress security, If you are looking for some more ways to protect your wordpress blog, I would recommend you reading the following post:
Tags: Wordpress Security
Kindly Bookmark it and Share it with Friends: