WordPress Archives - Page 21 of 25

Jun 17 2011

Security for Your WordPress Site: Processes, Passwords, & Plugins

One of the most important things to consider when developing a site for a client is client education and training on site security. While it is true, that once we develop a site for someone, information security belongs to them. We could have implemented all the best WordPress security plugins and processes, but if the user has a poor password then it will only be a matter of time before they are exploited.

So, first and foremost information security, site security, belongs to both the developer and the client. As far as the client is concerned, if their site gets hack or there is a problem with the site due to security vulnerabilities, the first person they will blame is the developer. However, if we educate our clients on the importance of information security, while it may be their tendency to blame the developer, it may not be their first recourse. Simply speaking, information security is everyone's responsibility.

Most of this information was obtained from WordCamp Phoenix Security Presentation by WPVibe.com co-founder Dre Armeda along with CEO and founder of Webdev Studios, Brad Williams.

So what are some security tips around passwords, plugins, and processes?

Processes

Browser Processes
1. Use a secure connection whenever possible, e.g., https://.
2. Use NoScript FireFox extension if you use FireFox.
FTP Processes
1. Use sFTP or SSH instead of normal FTP. FTP passes passwords unencrypted.
2. Don't store creditials in FTP client. As tempting as it is to have browsers and FTP clients remember your credentials, avoid doing this.
Hosting
1. Use hosts that talk about security. Free hosting is nice, but the cost of recovering a site may not be worth it.
2. Purchase a SSL certificate from your hosting company.
WordPress
1. Update WordPress! Minor WordPress versions (3.0.x, 3.1.x, 3.2.x). WordPress is open source and once they find a vulnerability, it is known. And if your site has not been updated, then all the hackers in the world know how to hack your site. Minor versions don't necessarily need development testing. Major releases (3.0,3.1,3.2) should be tested in a development/staging environment before implementation.
2. Update Plugins! Read the changelog and details to determine if new features are introduced. This is where you can check those change details to determine whether the plugin is adding new features, patching issues or known problems, or is a security upgrade.
3. Change database table prefix. The default is wp_ and everyone knows this. However, if you change it to something unique. The famous five minute install has a place for you to do this upon installation. However, there are also plugins that will help you change this. And if you know phpmyadmin and mySQL, the prefixes can be changed rather easily. See also my pictorial guide: Pictorial Tutorial on WordPress Security: Change the WP_ Prefix
4. Use Secret Keys with your wp-config.php. To get your secret keys visit the WordPress Secret Keys API. It's a hashing salt for your cookies on your computer. Newer installations have this in them already; however, older installations may not have it. So if you started with an older WordPress installation and have upgraded, you may want to check to make sure these are in place. Changing these on a live site will only render current cookies invalid and will have no adverse affects on the site.
5. Lockdown WP Login and WP Admin. Add the following code in wp-config.php to force SSL on login and on all Admin pages. Using SSL (https) on all admin screens in WordPress will encrypt all data transmitted with the same encryption as online shopping.
  On login only
  [php]define( 'FORCE_SSL_LOGIN' , 'true' );[/php]
  On admin pages
  [php]define( 'FORCE_SSL_ADMIN' , 'true' );[/php]
6. Create .htaccess file in your wp-admin to lockdown IP addresses. Add the following lines of code to your .htaccess:
  [html]
  AuthUserFile /dev/null
  AuthGroupFile /dev/null
  AuthName "Access Control"
  AuthType Basic
  order deny,allow
  deny from all
  #IP address to Whitelist
  allow from 67.123.83.59
  allow from 123.123.123.123
  [/html]
  This example will only allow a user with the IP 67.123.83.59 or 123.123.123.123 to access wp-admin. However, also note that IP addresses do change, and if you are locked you can go into the file edit it to include your new IP address or you can simply delete the file. Also, this file will not be deleted on WordPress upgrades since it does not belong to WordPress core.
7. Move wp-config.php. WordPress features the ability to move the wp-config.php one directory above your WordPress root. So if your WordPress wp-config.php file is located public_html/wordpress/wp-config.php you can place it to public_html/wp-config.php.
8. Disable WordPress Generator Tag. Viewing the source on most WordPress sites will reveal the version they are running. This helps hackers find vulnerable installations or older versions. To remove the code, find the following code in your header.php and remove it.
  [html]<meta name="generator" content="WordPress <?php bloginfo['version'];?>" />[/html]
  The wp_head() function also includes the WP version in your header. To remove it, add the following to your functions.php file:
  [php]remove_action( 'wp_head' , 'wp_generator' );[/php]
  Themes and plugins may also output their versions, but some may have an option to remove it, such as the Genesis Framework.
9. Use Trusted Sources for Themes and Plugins. Use WordPress.org. Themes found elsewhere may have some base64() code that can break your site or just add some black hat SEO. Instead of solely relying on Google or your favorite search engine, use these trusted sources:
10. Don't use admin for your username. All WordPress installs before WordPress 3.0 had an admin install. Change the admin username in MySQL:UPDATE wp_users SET user_login='hulkster' WHERE user_login='admin';. Or:
  1. Create a new account with a unique username
  2. Assign account to Administrator role
  3. Log out and log back in with new account
  4. Delete admin account (WordPress will allow you to reassign all content written by admin to an account of your choice.)
11. File/Folder Permissions. Good rule of thumb:
  - files should be set to 644
  - folders to 755
  - If your host requires 777, switch hosts.

Passwords

Use different passwords for your different sites.
Use a password management tool
Change passwords often
Don't ever share your passwords with anyone

Plugins

Security Plugins:

WordPress Exploit Scanner
WordPress File Monitor
Login Lockdown
AskApache Password Protect
BulletProof Security
Secure WordPress
BackupBuddy: Contains a Malware scanner module
See also WP Smith: The Best Security Plugins for WordPress 3.0+

Backup Plugins:

Website Scanning Tools

Malware Removal

Security Related Codex Articles

Blog Security Articles **Beware of DATE published!

Info graphic by WPBeginner:

Jun 16 2011

How to Change the Title Text for Your Custom Post Type

Have you ever wanted to use the Title section, but didn't want to call it Title? Surely, many of you have wanted to change the text in the title entry bar from the standard 'Enter title here' to something more specific for your custom post type. Well, WordPress has a filter for it.

[php]<?php
// Change 'Enter Title Here' text for a CPT
function wps_change_default_title( $title ){
$screen = get_current_screen();
$wps_cpt = 'wps_mycpt';

if ( $wps_cpt == $screen->post_type ) {
$title = 'Enter Staff Members Name Here'; //change this to whatever you'd like
}

return $title;
}

add_filter( 'enter_title_here', 'wps_change_default_title' );
[/php]

Jun 11 2011

Filter Hidden Metaboxes

So I don't lose this, I wanted to post this. To filter the default hidden meta boxes, use this code in functions.php:

[php]add_filter('default_hidden_meta_boxes', 'be_hidden_meta_boxes', 2);
function be_hidden_meta_boxes($hidden, $screen) {
if ( 'post' == $screen->base || 'page' == $screen->base )
$hidden = array('slugdiv', 'trackbacksdiv', 'postexcerpt', 'commentstatusdiv', 'commentsdiv', 'authordiv', 'revisionsdiv');
// removed 'postcustom',
return $hidden;
}[/php]

Jun 09 2011

BONUS: Adding a Taxonomy Filter to Your Admin List for a Custom Post Type

Recently, a friend sent some code over to me, and I thought it would be hugely beneficial for all to see it, especially in this series. For a custom post type that could have a lot of posts (like books) it proves priceless. You can find the original code here.

[php]
// Adding a Taxonomy Filter to Admin List for a Custom Post Type
add_action( 'restrict_manage_posts', 'my_restrict_manage_posts' );
function my_restrict_manage_posts() {

// only display these taxonomy filters on desired custom post_type listings
global $typenow;
if ($typenow == 'books_ibm') {

// create an array of taxonomy slugs you want to filter by - if you want to retrieve all taxonomies, could use get_taxonomies() to build the list
$filters = array('genre', 'writer');

foreach ($filters as $tax_slug) {
// retrieve the taxonomy object
$tax_obj = get_taxonomy($tax_slug);
$tax_name = $tax_obj->labels->name;

// output html for taxonomy dropdown filter
echo "<select name='$tax_slug' id='$tax_slug' class='postform'>";
echo "<option value=''>Show All $tax_name</option>";
generate_taxonomy_options($tax_slug,0,0);
echo "</select>";
}
}
}

}
[/php]

Please let me know what you think!?

Jun 06 2011

How to Create a Genesis Page Template with a Custom Post Type with Custom Content in Custom Fields

Recently, someone asked me how I would create a Genesis Page Template with a Custom Post Type using Custom Fields. One of the great things about Genesis is its ability to easily pull custom fields content. Previously I mentioned how to create a WordPress Custom Post Type Page Template in Genesis. Now, what if I want to have this page template to display custom content via custom fields?

Well here's the right way to do it via Genesis hooks:
[php]
<?php
/*
*Template Name: Author Interview
*/

remove_action('genesis_loop', 'genesis_do_loop');
add_action('genesis_loop', 'custom_do_loop');
function custom_do_loop() {
$mycpt = 'books';
$posts_per_page = 10;
global $paged;
$args = array('post_type' => $mycpt, 'posts_per_page' => $posts_per_page);

genesis_custom_loop( $args );
}

remove_action( 'genesis_post_content' , 'genesis_do_post_content' );
add_action( 'genesis_post_content' , 'genesis_do_custom_post_content' );

function genesis_do_custom_post_content() { ?>
<div id="post-<?php the_ID(); ?>" class="book-info">
<h3>Book Information</h3>
<p class="book-description"><strong>Description</strong>: <?php echo genesis_get_custom_field('_type'); ?></p>
<p class="book-pages"><strong><?php echo genesis_get_custom_field('_type'); ?></strong>: <?php echo genesis_get_custom_field('_pages'); ?> pages </p>
<p class="book-publisher"><strong>Publisher</strong>: <?php echo genesis_get_custom_field('_publisher'); ?> (<?php echo genesis_get_custom_field('_pub_date'); ?>)</p>
</div>
<div id="post-<?php the_ID(); ?>" class="book-review">
<?php the_content(); //OR, the_excerpt(); OR, the_content_limit( (int)genesis_get_option('content_archive_limit'), __('[Read more...]', 'genesis') ); ?>
</div>
<?php
}

genesis();
?>
[/php]