Miami, FL (OPENPRESS) August 25, 2012 -- Cpwebhosting Announced WordPress Vulnerabilities security As we all know that running a WordPress-based website is often a pleasure, enabling you to focus on content and building relationships with readers and other websites.
Half of the WordPress sites out there are self-hosted, which means that the WordPress administrator carries the share of responsibility for a secure installation. Out of the box, there are several ways that WordPress security can be tightened down, but only a fraction of sites actually do so. This makes WordPress an even more popular target for hackers.
However, not everyone on the web is as friendly as you. Somewhere out there is a list with your blog's name on it, where it sits, waiting to be targeted by hackers? When they get around to your blog, they'll try various tactics to gain access to it, perhaps with the aim of selling legal drugs or infecting your visitor's computers with malware.
Here is a list of top WordPress vulnerabilities:
1. SQL Injection & URL Hacking: WordPress is a database-backed platform that executes server-side scripts in PHP. Both of these characteristic can make WordPress vulnerable to malicious URL insertion attacks. Commands are sent to WordPress via URL parameters, which can be abused by hackers who know how to construct parameters that WordPress may misinterpret or act on without authorization.
SQL injection describes a class of these attacks in which hackers embed commands in a URL that trigger behaviors from the database. (SQL is the command language used by the MySQL database.) These attacks can reveal sensitive information about the database, potentially giving hackers entrance to modifying the actual content of your site. Many of today's web site defacement attacks are accomplished by some form of SQL Injection.
Most WordPress installations are hosted on the popular Apache web server. Apache uses a file named .htaccess to define the access rules for your web site. A thorough set of rules can prevent many types of SQL Injection and URL hacks from being interpreted.
2. Access to Sensitive Files: Basically WordPress install has a number of files which you don't want unauthorized persons to access. These files, such as the WordPress configuration file, install script, and even the "readme" file should be kept private.
As with preventing URL hacking, you can add commands to the Apache .htaccess file to block access to sensitive private files.
3. Default Admin User Account: WordPress installs include an administrator user account whose username is simply "admin". Hackers may try to log into this account using guessed passwords.
Any element of predictability gives hackers an edge. Instead, log into WordPress and create a new user with an unpredictable name. Assign administrator privileges to this user. Now delete the account named "admin". A hacker would now need to guess both the username and password to gain administrator access, a significantly more challenging feat.
4. Default Prefix for Database Tables: The WordPress database consists of numerous tables. In many WordPress installs, these tables are named with a default prefix that begins with "wp_". For hackers, the ability to predict anything can provide an extra advantage.
An easier way to change table prefixes for an existing WordPress installation is by using the plug-in named Better WP Security. This plug-in contains several defenses including some discussed elsewhere in this article, with a simple point-and-click interface to change your table names to include a randomly-generated prefix.
5. Brute-Force Login Attempts: Hackers often rely on automated scripts to do their dirty work. These scripts can make numerous attempts to log into your WordPress administration page by trying thousands and millions of combinations of usernames and passwords.
A successful brute-force attack against a strong password effectively becomes impossible with these limits in place, because the hacker can never try enough variations (or rather, it would take many years of continuous attempts).
Two WordPress plugins which let you enforce a login limiter are Limit Login Attempts and the aforementioned Better WP Security.
Contact Information
CPWebHosting
Jim Partner
888-237-2521
Contact
www.cpwebhosting.com
