Security should be everyone's number one priority. This needs to be determined from the outset, and with WordPress's growing popularity you can expect more and more hacks/hackers. If you have not heard already there are a few hacks already spreading through the WordPress community. However, there are plugins that can help patch up the WordPress CMS to help.
My favorites have been (not all are WordPress 3.0 compatible) and are:
- Admin Log (Download, Directory): Displays a list of all the admin pages accessed in the Blog admin area. This is updated every time a page in the admin area is accessed. Information displayed includes: admin page accessed, user, and time of access. However, this should be filtered better because it’s keeping some access pages that are unnecessary at all.
- Admin SSL (Download, Directoy): This administrator security plugin is very helpful to protect the admin pages, posts, secured logins, supports all SSL setups and encrypted cookie content. This plugin is compatible on wordpress 2.3-2.7 versions only.
- Akismet: This is a standard spam application that comes with WordPress by default. Be sure to set this up and have this running almost immediately.
- Angsuman's WordPress Guard Plugin (Download): This plugin adds Double Security For WordPress Administrator Panel, Protection over wp-admin directory, and Protection Against Future Vulnerabilities. Adding password protection to /wp-admin/ adds a 2nd layer of protection around your blog's admin area, login, and files. This forces an attacker or bot to attack this 2nd layer of protection instead of your actual admin files. This dramatically increases your security
- Authenticated WordPress (Download): The free Authenticated WordPress Plugin (compatible with all versions of WordPress) makes your blog content (posts, pages, categories etc.) accessible to registered users only. This allows you to display content to your users in a controlled fashion. It also allows private blogging i.e. makes your blog accessible to selected people only (like family and/or friends and/or business associates).
- Anonymous WordPress Plugin (Download, Directory): All the WordPress versions 2.3 and above have the feature to get automatic updates for plugins. During this process it will send some of your information like your blog’s URL, version number, list of installed plugins and activated plugins to WordPress.org. This information could be of potential use for hackers. So to avoid this, installing Anonymous WordPress plug-in is a feasible option. It will strip off your blog’s URL and version number and empty the activated plugins list. This plug-in is compatible with WordPress 2.3 and above.
- AskApache Password Protect (Download, Directory): It will block the bots and creates a safe wall for any vulnerability your WordPress blog may have. It will protect your password as well as your WordPress directories like the wp admin-directory, wp-includes, wp-content, including plugins. This protects your Admin-panel with a powerful htaccess protection, preventing all spambots and unwanted users to access you site. It provides you complete control over your site from both sides.
- Blogsecurify (Download): Forces users to login over a secure communication channel (SSL). This is similar in functionality to Force SSL plugin. As with Force SSL, it requires your server to have SSL enabled which also means it needs a SSL server certificate which doesn't come cheap and is a recurring expense.
- Chap Secure Login (Download): If you are not having a secure connection like SSL to protect your password, then you can use this plug-in for encrypting passwords. It will use the Chap protocol to hide the passwords and transmit it encrypted. The only information that is transmitted unencrypted is your username. Protecting password will give full security because password leaks will enable the hacker the gain full control of your WordPress blog.
- Database Backups: There are two that I use with this and I don't know which I prefer quite yet. WP-DB-Backup (Download, Directory) is a WordPress specific plugin that creates backups of your core WordPress tables as well as other tables of your choice in the same database. The content can be backedup at your HDD, email, domain space. You can restore the entire database with the same greatness if it is accidentally deleted or deleted by other hackers. This is the must have Plugin for your wordpress. Backupify is a social/web 2.0 backup system that can backup Facebook, Twitter, Flickr, Picasa, PhotoBucket, Delicious, Hotmail, Friendfeed, Basecamp, Zoho, Blogger, WordPress, and Google Apps.
- Force SSL (Download, Directory): For those will an SSL certificate, this plugin forces an HTTPS connection for security purposes. Force SSL simply redirects requests made via regular old http to requests for trusty new https, the SSL connection (secure connection).
- Invisible Defender (Download, Directory): This anti-sypbot plugin protects the registration, login and comment forms from spambots by adding the 2 extra fields that were hidden by CSS (cascading style sheet). This shows the number of blocked spammers in your Dashboard.
- Login Encrypt (Download, Directory): This will help encrypt the login information using the complex DES and RSA combination. It uses the JavaScript appended and encrypted the password of the user and generates a unique DES key. And by using this key, user can have secure login each time they login to your blog.
- Login Lockdown (Download, Directory): This records the IP address and time-stamp of every failed login. If certain login failure attempts were made from same IP range in certain period of time, it will disable all the requests from that range, which may also include yourself.
- Replace WP-Version (Download, Directory, German Homepage): Secure your WordPress installation and eliminate or replace your wp-version and database-version on easy way with a small plugin.
- Secure Files (Download): This plugin allows you to upload and download files from outside of your web document root for security purposes. It can be used to can restrict file downloads to users that are logged in, or have a certain user level.
- Secure WP (Download, Directory, German Homepage): It will help secure WordPress installation by removing miscellaneous items after the installation process which may aid hackers, such as your login pages, forums, adds index.html to plugin directory, removes wp-version except in admin-panel. Secure WordPress will add a blank index.html to the plug-in directory such that if anyone is trying to view the contents of the directory they will be viewing a blank page instead of the contents.
- Semisecure Login (Download, Directory): This increases the security of your WordPress login. This uses client-side MD5 encryption on password when the user log-ins. But many of the users neglect it, if they are using ForceSSL or AdminSSL.
- Theme Authenticity Checker (Directory): Scan all of your theme files for potentially malicious or unwanted code. This is a helpful plugin for you to check any theme you download somewhere to make sure the theme is safe for using.
- WordPress File Monitor (Download, Directory): Monitors your WordPress installation for editing/adding/deleting files. When a change is detected an email alert can be sent to a specified address. It also has ability to record the time-stamp of one of the above 3 modifications.
- WP-Ban (Directory): Wp-Ban bans users by IP, IP Range, host name, user agent and referer url from visiting your WordPress’s blog. It will display a custom ban message when the banned IP, IP range, host name, user agent or referer url tries to visit you blog. You can also exclude certain IPs from being banned. There will be statistics recordered on how many times they attemp to visit your blog. It allows wildcard matching too.
- wp-dephorm (Download, Directory): wp-dephorm protects your users from the prying eyes of phorm. This is achieved by setting a cookie to opt out of the phorm information mining. Your blog viewers will not have there information stored and used in marketing campaigns whilst viewing your site
- WP-Security Scan (Download, Directory): Semper Fi Web Design probably has one of the best security plugins available. Scans your WordPress installation for security vulnerabilities and suggests corrective actions regarding: passwords, file permissions, database security, version hiding, and WordPress admin protection/security.
- WP-SpamFree (Download): An extremely powerful anti-spam plugin for WordPress that eliminates comment spam, including trackback and pingback spam. It works invisibly without CAPTCHA’s, or other inconvenience to site visitors. The plugin includes spam-free contact form feature as well.
Now I do not use all of these plugins, or even half of these. However, there are some essential security items that must be addressed. The plugins that I use on every site are: Akismet, WP-DB-Backup (and/or Backupify), Login Lockdown, Secure WordPress (or Secure WP), and CHAP Secure Login or Semisecure Login or Login Encrypt.
There is one more that is in beta and is only by invitation, and that is WP-Security. More information forthcoming.