WP Blog Host Video Tutorials » Security

Guarding WordPress Against Hacker URL Requests

WP Blog Host — Mon, 28 Dec 2009 16:01:11 +0000

Update: This plugin can now be found in the WordPress plugin repository for easy installs.

I was skimming through my Google FeedReader the other day and read an excellent article by Jeff Starr of Perishable Press which showed us how to create a very simple plugin to help protect our WordPress sites from malicious WordPress crackers.

He found this code in the pastebin repository, a site where people who write computer code can come together and help one another.

A dead giveaway that someone is trying to hack into your blog is when you see terms like the following being used:

base64()
eval()

The plugin shown below will attempt to block such requests. So with that, let’s get on to the tutorial.

The How-To Video

Remember you can click the “full view” button to see it a little better.

Step-by-Step

Step1: Head over to Perishable Press and copy the code Jeff shows us by clicking here (link opens in a new window).

Step 2: Open a text editor and paste the code in. Be sure to save the file as a .php file (for example, block-bad-requests.php).

Step 3: Zip up the file you just created using a zip program like WinZip or the zip utility that comes with Windows.

Step4: Upload, install, and activate the plugin.

Quick, simple, and effective.

SEO Egghead WordPress Firewall Plugin Video Overview

WP Blog Host — Sat, 21 Nov 2009 18:13:56 +0000

Note the video below showcases where my blog use to be located. It’s now located at Blog Training Classroom.

Update: In the video I mention visiting SEO Egghead’s site, downloading the file, zipping it up, and then installing it on your blog. Since I created this video, SEO Egghead has added it to the WordPress plugin repository, so to install it all you need to do is head over to your Dashboard area, go to Plugins, and then search for WordPress Firewall.

Update 2: Someone “forked” this plugin and conveniently named it WordPress Firewall 2. Either plugin will work just fine. I’m using the original WordPress Firewall.

Awhile back I wrote an article on my blog called, 2 Easy Ways To Set Up A WordPress Firewall. In it, I highlighted a WordPress Firewall security plugin released by SEO Egghead which greatly increases your blog’s security against common exploits and hacks.

In this video, I’ll go over how to install the plugin and a few of its settings.

If WordPress security is important to you (and it should be), I have an ebook I wrote called, WordPress Defender which you can pick up and details a ton of information on how to secure and monitor your blog against hackers.

How To Upgrade WordPress Manually

WP Blog Host — Sun, 16 Aug 2009 18:25:11 +0000

How To Create A Simple Maintenance Page

You could always download a WordPress maintenance mode plugin, but in this case it probably won’t work. When you follow the upgrade instructions on WordPress.org, you’ll notice it says to deactivate all your plugins.

So, here’s how to create a custom maintenance page without a plugin.

Step 1

Create a simple html file and place it in your blog’s root directory. Name it something like, maintenance.html. Inside the maintenance.html file you can put anything you want. “Hi. I’m out to lunch for a few moments while the construction crew is busy at work . . .”

But why stop there? Your site is better than that. Customize the page with your site’s colors and images. Maybe add a video or your latest blog post. CSSgirl wrote some tips and shows some examples on the topic of creating a memorable maintenance page.

Step 2

Ok so now you have your maintenance.html page set up; the next step is to redirect everyone to it while you’re doing your upgrade.

Navigate to your blog’s root directory in your web hosting control panel and open your .htaccess file.

Once opened, you’re going to add this code at the top:

# Use this code to redirect visitors to maintenance.html file while upgrading
Options +FollowSymlinks
RewriteEngine on
RewriteCond %{REMOTE_ADDR} !^618\.124\.259\.25
RewriteCond %{REQUEST_URI} !/maintenance.html$
RewriteRule $ http://your-site.com/maintenance.html [R=302,L]

The yellow parts above are the areas you need to change. Visit What is my IP address? to find your IP address and put those numbers in under the first yellow highlight. Next add the url path to your own maintenance page in the second yellow part.

And that should do it. Your site should now show a maintenance page to everyone except you (your IP address was whitelisted). To see what everyone else sees, add a # sign in front of the IP line:

# RewriteCond %{REMOTE_ADDR} !^618\.124\.259\.25

The # comments lines out.

When you’re finished, leave the code in your .htaccess file for next time. To disable the code, just add a # in front of each line:

# Use this code to redirect visitors to maintenance.html file while upgrading
# Options +FollowSymlinks
# RewriteEngine on
# RewriteCond %{REMOTE_ADDR} !^618\.124\.259\.25
# RewriteCond %{REQUEST_URI} !/maintenance.html$
# RewriteRule $ http://your-site.com/maintenance.html [R=302,L]

Remember, if you need help with upgrades, visit the blog services page and use the contact form there to get in touch with me.

How To Backup Your WordPress Database Using phpMyAdmin

WP Blog Host — Sun, 16 Aug 2009 18:21:15 +0000

This tutorial will show you how to download a backup of your WordPress database to your computer. This is a vital topic you should learn.

This tutorial will show you how to do it through phpMyAdmin (a more advanced way just in case plugins aren’t working). If you’re looking for an easy way to backup your database, try the Il Filosofo Database Backup plugin.

How to Change Your Display Name on Your WordPress Blog

WP Blog Host — Sun, 16 Aug 2009 18:14:00 +0000

By default, WordPress displays your username publicly as the author of your posts. This can, however, pose a security issue because you’re giving everyone your blog’s username login info. Also, it’s best to use a username that is not easily guessed which typically means you won’t be using your name.

So let’s change how WordPress displays your name to the world but at the same time not give out what your blog’s username is.

Follow The Guided Tutorial

When you install WordPress for the first time, you must either provide a Username in order to log into your WordPress account or one will be assigned to you automatically (i.e. the admin Username). If you host with WpBlogHost and install WordPress on your web hosting account, you can specify your own unique Username.

When you author a post or comment in your blog’s comment section, by default WordPress displays your Username as the author’s name (see the image above, left side).

This tutorial will show you how to change that so the name you want to display will be shown.

Step 1 – Find Users

Log into WordPress and in the left sidebar menu click on Users.

Step 2 – Edit User

On the right you should see a list of the Users for your blog. Move your mouse to the one you want to edit and when the menu shows, click Edit.

Step 3 – Choose Your Display Name

Scroll down until you see Display name publicly as and choose how you want your name to be shown in posts and comments.

Step 4 – Click Update User

Congratulations, you’ve changed your User display name.

How To Change Your WordPress Username & Password Through phpMyAdmin

WP Blog Host — Sun, 16 Aug 2009 18:01:07 +0000

There may be times when you need to change your username and password for your WordPress blog. Perhaps you forgot what they were, but an even bigger reason why it is good to know how to do this is if someone hacks into your blog they might change your password.

This is how you can take back control of your blog and regain access by changing your username and password through the database.

How To Password Protect a Directory Using WP Blog Host Hosting

WP Blog Host — Sun, 16 Aug 2009 15:03:01 +0000

At times you may want to upload something to your hosting account but only allow a select group to view it, for example a family photo or backup file. Here’s how you can password protect a directory so that you can limit who can view anything contained within it.

How To Remove The WordPress Version Number From Your Source Code

WP Blog Host — Sun, 16 Aug 2009 14:54:21 +0000

One way hackers might try to gain more information about your blog is learning what version of WordPress you’re using by viewing your source code. Here’s how to remove that piece of information.

Just paste this code into your functions.php file:

remove_action(‘wp_head’, ‘wp_generator’);

I’d like to give credit to the good guys over at Digging Into WordPress. It is there where I first found this code.

No related posts.