Four More Security Tips To Keep Your WordPress Blog From Being Hacked

The last article in this WordPress security series was an overview of the program's blogging code. The following tips are some more security measurements that you might want to employ to keep your blog clean and safe.

Utilize strong passwords

One of the first things taught is to ensure all passwords cannot be simply guessed. Despite this fact, far too often administrators will fail to check all accounts. If an account can write to the system it must have a strong password.

A simple web search will uncover a stories telling you the best way to choose strong passwords. Instead of being redundant, let me just suggest that you read these pieces and consider what they say. Additionally, following their rules does not mean copying the choices!

Use SCP instead of FTP

The availability of good FTP programs makes transferring files to and from your hosting server onto your blog simple and convenient. If you can easily move files locally, most FTP programs will work for you. Search online for one that works for you.

The problem with FTP is that your username and password is sent in clear text to your server. To be more secure you should use SCP instead. Here are two programs that I recommend: WinSCP for Windows and Cyberduck for OS X.

It is advisable to activate your server's SSH login and deactivate FTP in order to properly utilize SCP.

Your theme should be write-protected

There appears to be an exploit going around that modifies installed WordPress themes to add spam links or malicious iframes. One way to make this exploit more difficult is to modify the file permissions of your WordPress themes directory to 755 and the files within the directory to 644. The drawback is that you will now have to FTP modified files to your web server each time you want to make changes to your theme.

However, it is rarely possible to protect plugin directories in this manner. Quite often, the software must write directly to the "install directory," requiring some local write permission.

View the HTML source of your site often

View the HTML source of your website often. If you find chunks of JavaScript embedded in IFRAMES or hidden links to websites you are not familiar with, your blog may have been compromised without your knowledge. Viewing the HTML source of your website often; removing chunks of JavaScript; and removing hidden websites allows you to prevent issues before Google does and blacklists you. This also prevents you or any of your readers from getting infected by malicious software.

Read more of Nick Dalton's WordPress security (http://www.TipsTricksToolsTechniques.com/?cat=7) articles on his blog for Internet business owners (http://www.TipsTricksToolsTechniques.com/) and bloggers at TipsTricksToolsTechniques.com.