This document discusses WordPress security and how to prevent and recover from hacking attempts. It explains common reasons sites get hacked like for fun, profit or search engine optimization. It provides tips to check if a site has been hacked by looking for browser warnings, suspicious files or code. If hacked, it recommends recovering from backup, using a security service, changing passwords and keys, updating software and disabling file editors. It also stresses the importance of regular backups that include the database and files and are stored offsite.

1. blogVAULT
http://blogvault.net

2. WordPress
Security
AKSHAT CHOUDHARY
FOUNDER, BLOGVAULT

3. Why?
SITES GET HACKED!

4. Why will some
one hack a Site?
FUN AND PROFIT

5. they can

6. money
SEO
Affiliate Scam
Redirect to a different site
Political defacement
Use host for hacks

7. How?
VULNERABILITIES!

8. Where?
WORDPRESS CORE
PLUGINS
THEMES

9. How do I know if I
have been
hacked?

10. Browser warning

11. Warning

12. Sucuri SiteCheck - Free Tool

13. Inspect Files
htaccess
Javascript Files
Unknown PHP files
Existing PHP files

14. What to do when
my site gets
hacked?

15. Recover from
Backup
MOST RELIABLE METHOD

16. Use Sucuri
NOT FOOLPROOF, COSTS MONEY

17. Talk to an expert
DIFFICULT JOB. DON'T TAKE LIGHTLY.

18. Change Password

19. Change
Authentication
keys
REMOVES EXISTING SESSIONS.

20. Prevention is
better than Cure

21. Update
Wordpress /
Plugins / Themes

22. Change Database
Prefix
PREVENT SQL INJECTION ATTACKS

23. Disable File Editor
DEFINE('DISALLOW_FILE_EDIT', TRUE);

24. Make Folders /
Files Readonly

25. Prevent File
Execution
ADDHANDLER CGI-SCRIPT .PHP .PL .PY .JSP .ASP
.HTM .SHTML .SH .CGI

26. Use SSL / Google
Authenticator

27. Keys
define('AUTH_KEY', 'put your unique phrase here');
define('SECURE_AUTH_KEY', 'put your unique phrase here');
define('LOGGED_IN_KEY', 'put your unique phrase here');
define('NONCE_KEY', 'put your unique phrase here');
define('AUTH_SALT', 'put your unique phrase here');
define('SECURE_AUTH_SALT', 'put your unique phrase here');
define('LOGGED_IN_SALT', 'put your unique phrase here');
define('NONCE_SALT', 'put your unique phrase here');

28. Security by
Obscurity
REMOVE ADMIN USER / HIDE WORDPRESS VERSION / ...

29. Automatic
Backups
E.G. USE BLOGVAULT

30. What makes a good backup solution?
Complete - Database + Files
Offsite - Local backup is as good as none
Regular Backup
History of backup
Test the Restore
Secure Backup

31. blogVAULT
Thank you
http://blogvault.net
We are Hiring!