Thread: Update Wordress to avoid Hacks

Last night over half of my sites that are wordpress based were hacked.

I updated them all to the latest version of wordpress and that seemed to work - but it was a bit scary until I figured that was all it took.

So, if anyone is running sites on anything other than the latest version I suggest you update them when you get a chance.

Sad to hear about the incident. But better late than never, it is a good practise to set your wordpress blog to auto-update so that whenever an update is released it can take effect on your blog as well without the need of you to intervene. Yes, it may so happen that few of the plugins might not be compatible with a particular update, but within few days the plugin developers too would release the patch updates for it, so you need not worry about it too much. Moreover, it is important to keep changing your admin login details on a regular basis to avoid such incidences in the future. Also, as far as possible try to avoid disclosing the login credentials to anyone. If you do wish to offer an access, you may create separate user accounts for them with limited privileges.

We have a bunch of custom stuff on all our WP sites, so it's a little more difficult to update. Eek.

you will contact with administrator service provider and claim your request.

may I know which wordpress version you use when your blog hacked?
I'm using version 3.2, the latest version is 3.2.1

Originally Posted by alec11

may I know which wordpress version you use when your blog hacked?
I'm using version 3.2, the latest version is 3.2.1

I don't think it has to do with the WP version you are using. Even the latest version of WP is vulnerable to hacking. Does WP latest version can ultimately protect you from being hacked?

Install mod_security to fully protect your server.

Originally Posted by john123

Install mod_security to fully protect your server.

Thanks for this info john123, I appreciate it.

There many such security plugins available to install on your wordpress blogs. Updating your wordpress versions regularly is a good start to avoid hack attempts.

Well suggested john123.

Following is a list of precautions which may be implemented to avoid such instances :

• Check for Upgrade regularly
• Avoid using the admin account
• Delete the admin account
• Change default passwords
• Use strong passwords ie. containing a combination of alphanumeric + special characters
• Move your wp-config.php file
• Use secret keys in your wp-config.php file
• Change the wordpress table prefix
• Lockdown your htaccess to allow only certain IPS to access it
• Use shell access as opposed to FTP
• Create a blank index.thml in your plugins directory
• Block access to the wp-admin folder through .htaccess file
• Remove the WordPress version string from your header.hp file
• Block your wp folders from search engines
• Do not allow people to register as administrators by default
• Install and activate Akismet to avoid spams
• Backup your database and server files on a regular basis
• Use proper file permission settings on all files on your server
• Use secured connections to access your WP admin pages
• Scan for vulnerabilities

t easy, if you already have wordpress installed, Just Create a user and set as administrator. after created, now log in as new user that created and delete “admin” at user menu. If you have many posts written as that user (admin user), WordPress Will ask to you “Delete them or you will assign them to new user”, you should chose assign as new user if you want them exist.

It's very helpful,...thx buddy

My provider sent out an email saying the updates were available and that they will automatically do it for the clients. Otherwise, it is up to the user but it is nice to have the option. I haven't had my blog hacked yet.