Skip to content

How To Stop An Ethical Hacker Breaking Into Your WordPress Site

In this month’s .net magazine (known as Practical Web Design in the US) there was an interesting article where an ethical hacker showed how he would break into your site — and what you can do to stop him. In this post we’ll look past “X Plugins To Save Your Blog” and see what effective steps you can take to stop a real life hacker.

Hiding WordPress

One of the first things our “ethical hacker” did was to find out what software the site was running on. That means in order to stop him you’ll have to hide any indication that you’re using WordPress. Which is slightly harder than it appears at first.

If I look at a site to me it’s pretty obvious if it’s running WordPress. Let’s take a look at DesignInformer’s head tag:

We’ll come to wp-content in a sec, but first to RSS feeds. I don’t know how other CMSes do feeds, but to me when I see /feed/ and /comments/feed/ immediately I think WordPress. You can get around this by using something like Feedburner for your RSS feeds.

If you’re using plugins which are leaving their mark, quite literally, then the best thing to do is to manually edit the plugin to get rid of the comment. All you need to do is click ‘Plugins’, ‘Editor’, select the offending plugin and then search for the comment. Delete it and save. It’s gone! It will get overwritten if you update though, so just make sure you repeat the process with each upgrade.

Remove ‘Stuff’ WordPress Spits Out Into wp_head

As Jeff explains, WordPres spits out a load of quite useless stuff into wp_head, all of which you can easily remove with this code in your functions.php:

// remove junk from head
remove_action('wp_head', 'rsd_link');
remove_action('wp_head', 'wp_generator');
remove_action('wp_head', 'feed_links', 2);
remove_action('wp_head', 'index_rel_link');
remove_action('wp_head', 'wlwmanifest_link');
remove_action('wp_head', 'feed_links_extra', 3);
remove_action('wp_head', 'start_post_rel_link', 10, 0);
remove_action('wp_head', 'parent_post_rel_link', 10, 0);
remove_action('wp_head', 'adjacent_posts_rel_link', 10, 0);

With all that removed, there’s no immediate indication you’re running WordPress.

Hiding wp-content

This one’s a bit more difficult, but it’s still doable, as the codex explains:

Set WP_CONTENT_DIR to the full local path of this directory (no trailing slash), e.g.

define( 'WP_CONTENT_DIR', $_SERVER['DOCUMENT_ROOT'] . '/blog/wp-content' );

Set WP_CONTENT_URL to the full URI of this directory (no trailing slash), e.g.

define( 'WP_CONTENT_URL', 'http://example/blog/wp-content');

Hiding wp-admin

Even if you’ve moved everything from the head, going to /wp-admin/ will tell me immediately whether you’re running WordPress or not. It’s actually surprisingly easy to move the entire wp-admin folder, Michi explains – you just need some .htaccess code to redirect the whole lot to another folder. You could be sneaky and redirect it to /administrator to fool any hacker 😉

Powered by…

Pretty obvious,  but worth a mention – don’t forget to remove ‘Powered by WordPress’ from your theme!

Stopping the hacker gaining access

In the article the hacker just goes through the different software used on the site, listing out of date software with vulnerabilities. That means it’s imperative to keep your site updated. That doesn’t necessarily mean the latest version though. Sites like Mashable stay a version number behind at the latest stable version in order to protect themselves from new vulnerabilities – quite a clever way of staying secure.

The article specifically mentions blocking access to the backend by IP is a good idea — the following code will do the trick:

order deny,allow
allow from a.b.c.d # This is your static IP
deny from all

Rounding up

And that’s it. Hopefully this post has been helpful to you and shown you how a real world hacker would hack your very real world site – yours. Don’t be too scared; be prepared instead!

Alex Denning

13 Comments
Most Voted
Newest Oldest
Inline Feedbacks
View all comments
Umer
November 7, 2011 4:56 pm

what the hell. you didnt tell that where to put thiese codes?

Mr Honeyfoot
November 8, 2010 11:27 am

This no longer works in new versions wordpress.

Yields the following

Fatal Error: Call to undefined function remove_action()

Thoughts?

jazzsequence :: arcane palette :: Keeping your website safe
May 6, 2010 5:26 am

[…] You may also want to consider hiding your site as a WordPress site.  While obfuscation is not necessarily a means of securing your site — especially if that’s the only thing you’re doing — it might not hurt.  A hacker who knows how to get into WordPress could be diverted if, for example, your wp-login.php page was moved to a different address.  Alex Denning of WPShout has some great suggestions of ways to confound potential hackers. […]

Arcane Palette Creative Design » Blog Archive » Keeping your website safe :: creative web design
May 4, 2010 10:46 pm

[…] You may also want to consider hiding your site as a WordPress site.  While obfuscation is not necessarily a means of securing your site — especially if that’s the only thing you’re doing — it might not hurt.  A hacker who knows how to get into WordPress could be diverted if, for example, your wp-login.php page was moved to a different address.  Alex Denning of WPShout has some great suggestions of ways to confound potential hackers. […]

TuniLame
April 8, 2010 9:25 pm

Hi!
Thanks for your valuable infos…

But you forget to specify to remove the file “readme.html” from the root of WordPress.

BadCat
April 8, 2010 4:26 pm

Also might be worth noting, even if one had invested the time and masked all the above directories etc. – it appears fairly obvious that by peeking into a site’s CSS and finding something like:

/*
Template name: template
*/

could also be a giveaway.

Kevin Muldoon
April 9, 2010 1:15 am
Reply to  BadCat

Yes I agree. Image locations can give it away too.

BadCat
April 8, 2010 4:12 pm

All good points – however, how does a WP upgrade via the Admin fair after you’ve rerouted all the folders? Which directories , if any, does WP, or possibly a plugin or even a theme, assume to be in a specific location even after you’ve made functions mods etc.

Or start the conversation in our Facebook group for WordPress professionals. Find answers, share tips, and get help from other WordPress experts. Join now (it’s free)!

Most Searched Articles

Best JavaScript Libraries and Frameworks: Try These 14 in 2024

In this post, we look at the best JavaScript libraries and frameworks to try out this year. Why? Well, with JavaScript being available in every web browser, this makes it the most accessible programming language of ...

25 Best Free WordPress Themes (Responsive, Mobile-Ready, Beautiful)

If you're looking for only the best free WordPress themes in the market for this year, then you're in the right place. We have more than enough such themes for you right ...

12 Best WordPress Hosting Providers of 2024 Compared and Tested

Looking for the best WordPress hosting that you can actually afford? We did the testing for you. Here are 10+ best hosts on the market ...

Handpicked Articles

How to Make a WordPress Website: Ultimate Guide for All Users – Beginners, Intermediate, Advanced

Many people wonder how to make a WordPress website. They’ve heard about WordPress, its incredible popularity, excellent features and designs, and now they want to join the pack and build a WordPress website of their own. So, where does one get ...

How to Start an Ecommerce Business: Ultimate Guide for 2024

Is this going to be the year you learn how to start an eCommerce business from scratch? You’re certainly in the right place! This guide will give you a roadmap to getting from 0 to a fully functional eCommerce business. ...