In this chapter of keeping your wordpress blog safe and secure, I'll talk about keeping your sensitive wordpress folders hidden or not easily accessible to hackers. You can do it by locking you wordpress folder as well. Without further delay, I'll start listing the tips you need to follow to lock your wordpress folders.
I hope this tutorial did gave you some insight on how to keep your wordpress blog secure. I'll be posting last installment of this tutorial soon. So, stay tuned to Webmaster Tutorials for more updates.
- Hide Directory Listing: By default wordpress blogs show folder structure in URL, something like http://<sitename>.wordpress.com/MyFolder. When a smart programmers/hacker sees this, he/she can easily guess your folder structure. So, you have to hide it. You can hide by embedding following code in your index.php page.
<?
Header( "HTTP/1.1 301 Moved Permanently" );
Header( "Location: http://<sitename>" );
>
- Protect your wp-admin Folder: wp-admin folder is one of the most important folder in your wordpress blog. It has every detail which a admin would like to know. Once hacker cracks into this folder, he can be admin of your blog ! So, protecting this folder is extremely important. Only standard way to protect this folder is by allowing only authenticated users to view/edit that folder.
- Goto http://www.htaccesstools.com/htpasswd-generator/ site. Enter the user credentials of a user whom you want to give access to wp-admin folder in the text box given. Site will provide you with a .htpasswd file.
The uses MD5 hashing algorithm. It is world known fact that MD5 algorithm is almost unbreakable. So, you needn't worry about .htpasswd file getting cracked/hacked.
- Visit http://www.htaccesstools.com/htaccess-authentication/ site. Follow the instructions given in that site and it will give you a .htaccess file. Basically this file will have path for .htpasswd file in encrypted format.
- Copy-paste .htpasswd and .htaccess file in wp-admin folder. Please don't overwrite these files, if they are already present in your wp-admin folder. Understand what the new .htpasswd and .htaccess files has and then open existing files to edit accordingly. It is manual process, you have to do it manually.
- Now, you are done ! This trick will give extra security to your wp-admin folder. It is like double pass security system for a hacker to crack.
- Goto http://www.htaccesstools.com/htpasswd-generator/ site. Enter the user credentials of a user whom you want to give access to wp-admin folder in the text box given. Site will provide you with a .htpasswd file.
I hope this tutorial did gave you some insight on how to keep your wordpress blog secure. I'll be posting last installment of this tutorial soon. So, stay tuned to Webmaster Tutorials for more updates.
