Protect Your WordPress Website - Setting Up IThemes Security
1 like1,133 views
The document outlines best practices for securing WordPress sites using iThemes Security, including recommendations for access control, maintenance, and global settings. Key security measures include using strong passwords, limiting user access, enabling two-factor authentication, and implementing brute force protection. It also highlights features of iThemes Security Pro, such as password expiration and activity logging for user roles.
Protect Your WordPress Website - Setting Up IThemes Security
- 1. WORDPRESS SECURITY USING ITHEMES SECURITY JASON YINGLING | LEAD DEVELOPER RED8 INTERACTIVE | RED8INTERACTIVE.COM @JASON_YINGLING | JASONYINGLING.ME
- 3. Page WORDPRESS HOSTING Support for latest software Optimized for running WordPress Malware scanning Work with WordPress 24/7 Backups 3
- 4. Page HARDENING Protecting your site from common security risks • Don’t use the ‘admin’ username • Strong passwords • Hide the login area • Brute Force Protection • 404 Protection • Malware scanning 4
- 5. Page ACCESS Minimize number of administrators Remove file editing from dashboard Two Factor Authentication 5
- 6. Page MAINTENANCE Keep WordPress up to date Keep plugins up to date Remove unused themes and plugins 6
- 8. Page ITHEMES LANDING PAGE Broken down into high priority, medium priority, and low priority 8
- 9. Page GLOBAL SETTINGS Write to wp-config.php Emails for lockout notifications, file change warnings, etc. 9
- 10. Page GLOBAL SETTINGS Error messages to display to locked out users 10
- 11. Page GLOBAL SETTINGS Enables blacklisting repeat offenders Good idea to switch these up from the defaults 11
- 12. Page GLOBAL SETTINGS Enables blacklisting repeat offenders Good idea to switch these up from the defaults 12
- 13. Page 404 DETECTION Blocks attacker for scanning for known vulnerabilities 13
- 14. Page AWAY MODE Allows for disabling access to the dashboard between certain hours Do you really need to be able to edit 24/7? Taking a vacation 14
- 15. Page BANNED USERS Enable HackRepair.com’s blacklist feature Enable Ban Users Permanently bans attackers IPs 15
- 16. Page BRUTE FORCE PROTECTION Limit the number of bad login attempts before temporarily locking out the offending host 16
- 17. Page BRUTE FORCE PROTECTION Switch it up from the default 4 Max Login Attempts Per Host 9 Max Login Attempts Per User 6 Minutes to Remember Bad Login 17
- 18. Page DATABASE BACKUPS Sends a database backup via email or stores on server Plugins • BackupBuddy • BackWPUp • WPmudev Snapshot • VaultPress 18
- 19. Page FILE CHANGE DETECTION Allows you to include and exclude specific files that may change often Helpful to see what files were changed if an attack happens 19
- 20. Page HIDE LOGIN AREA Change login url from /wp-admin to /something-else Makes it difficult for attacker to find login area Avoid using iThemes default /wplogin 20
- 21. Page SSL Requires SSL setup on server Allows you to force SSL for Dashboard 21
- 22. Page STRONG PASSWORDS Enables you to force strong passwords for users for certain user roles 22
- 23. Page SYSTEM TWEAKS Some of this may be performed by your host Good idea to have on unless you know something conflicts on your site 23
- 27. Page ADVANCED SETTINGS Change name of ‘admin’ user Change user with id of 1 27
- 28. Page ADVANCED SETTINGS Change WordPress salts 28
- 29. Page ADVANCED SETTINGS Change name of wp- content directory Not necessary on most WP specific hosts 29
- 30. Page ADVANCED SETTINGS Change database prefix to make your tables harder to find 30
- 31. Page ITHEMES SECURITY PRO Allow you to temporarily bump a users access 31
- 32. Page ITHEMES SECURITY PRO More password options Password generator on user profile Password expiration Force password change 32
- 33. Page ITHEMES SECURITY PRO Use Google’s reCAPTCHA for login, registration, and commenting 33
- 34. Page ITHEMES SECURITY PRO Allow users to setup Two Factor Authentication using Google Authenticator app 34
- 35. Page ITHEMES SECURITY PRO Log user activities at a certain role such as login, saving content, and more 35
- 36. Page LOCKED YOURSELF OUT? Login to your database via phpMyAdmin or a program like Sequel Pro Navigate to the itsec_lockouts table Delete the row with your IP 36
- 37. Page LOCKED YOURSELF OUT? Disable plugin via FTP Navigate to /wp-content/plugins Rename the ithemes-security plugin directory 37
- 38. Page QUESTIONS? Jason Yingling | Red8 Interactive @jason_yingling http://jasonyingling.me 38