Book Image

WordPress 3 Ultimate Security

Book Image

WordPress 3 Ultimate Security

Overview of this book

Most likely – today – some hacker tried to crack your WordPress site, its data and content – maybe once but, with automated tools, very likely dozens or hundreds of times. There's no silver bullet but if you want to cut the odds of a successful attack from practically inevitable to practically zero, read this book. WordPress 3 Ultimate Security shows you how to hack your site before someone else does. You'll uncover its weaknesses before sealing them off, securing your content and your day-to-day local-to-remote editorial process. This is more than some "10 Tips ..." guide. It's ultimate protection – because that's what you need. Survey your network, using the insight from this book to scan for and seal the holes before galvanizing the network with a rack of cool tools. Solid! The WordPress platform is only as safe as the weakest network link, administrator discipline, and your security knowledge. We'll cover the bases, underpinning your working process from any location, containing content, locking down the platform, your web files, the database, and the server. With that done, your ongoing security is infinitely more manageable. Covering deep-set security yet enjoyable to read, WordPress 3 Ultimate Security will multiply your understanding and fortify your site.
Table of Contents (23 chapters)
WordPress 3 Ultimate Security
Credits
About the Author
Acknowledgement
About the Reviewers
www.PacktPub.com
Preface
Index

Sniffing out dangerous permissions


If your server's been round the block a few times, it may need a permissions spring clean.

Suspect hidden files and directories

Hidden files are generally fine, but can also be malicious backdoors. To list shy files in a terminal, along with the rest, use this syntax:

ls –la /path/to/somewhere

In your home directory, for instance, that should show up some files prefixed with a dot:

drwx------ [blah blah whatnot] .aptitude
-rw------- [blah more whatnot] .bash_history

Good. Now you can join the dots. Let's run some scans, printing results to the screen. The first is for a hidden directory. Repeat the scan replacing the d with an f for file:

sudo find / -name '.*' -type d –print

Note

Shared types will save a ton of time using a CLI for this job, but the alternative is to trawl file explorer. Drop sudo because you don't have privileges to elevate.

Variations on the regular .* theme could be ..* or .. * (with the space). Mix it up and, again for all examples, run scans...