In this month’s .net magazine (known as Practical Web Design in the US) there was an interesting article where an ethical hacker showed how he would break into your site — and what you can do to stop him. In this post we’ll look past “X Plugins To Save Your Blog” and see what effective steps you can take to stop a real life hacker.
Hiding WordPress
One of the first things our “ethical hacker” did was to find out what software the site was running on. That means in order to stop him you’ll have to hide any indication that you’re using WordPress. Which is slightly harder than it appears at first.
If I look at a site to me it’s pretty obvious if it’s running WordPress. Let’s take a look at DesignInformer’s head tag:
We’ll come to wp-content in a sec, but first to RSS feeds. I don’t know how other CMSes do feeds, but to me when I see /feed/ and /comments/feed/ immediately I think WordPress. You can get around this by using something like Feedburner for your RSS feeds.
what the hell. you didnt tell that where to put thiese codes?
This no longer works in new versions wordpress.
Yields the following
Fatal Error: Call to undefined function remove_action()
Thoughts?
[…] You may also want to consider hiding your site as a WordPress site. While obfuscation is not necessarily a means of securing your site — especially if that’s the only thing you’re doing — it might not hurt. A hacker who knows how to get into WordPress could be diverted if, for example, your wp-login.php page was moved to a different address. Alex Denning of WPShout has some great suggestions of ways to confound potential hackers. […]
[…] You may also want to consider hiding your site as a WordPress site. While obfuscation is not necessarily a means of securing your site — especially if that’s the only thing you’re doing — it might not hurt. A hacker who knows how to get into WordPress could be diverted if, for example, your wp-login.php page was moved to a different address. Alex Denning of WPShout has some great suggestions of ways to confound potential hackers. […]
True, but I did mention that 😉
The hacker I mentioned throughout the post is a real life hacker and he was showing how he’d get into a real life site, so it would seem obscurity is a pretty good form of security, no?
Hi!
Thanks for your valuable infos…
But you forget to specify to remove the file “readme.html” from the root of WordPress.
Good point! Hadn’t thought of that one.
Also might be worth noting, even if one had invested the time and masked all the above directories etc. – it appears fairly obvious that by peeking into a site’s CSS and finding something like:
/*
Template name: template
*/
could also be a giveaway.
Yes I agree. Image locations can give it away too.
Yep. That’s why we moved the wp-content directory 🙂
Yeah, that’s a tough one to hide although just because you’ve got a template name, doesn’t necessarily mean it’s WordPress does it?
All good points – however, how does a WP upgrade via the Admin fair after you’ve rerouted all the folders? Which directories , if any, does WP, or possibly a plugin or even a theme, assume to be in a specific location even after you’ve made functions mods etc.
I don’t know, to be honest! I think you’d probably be wise to upgrade manually as that’d allow you to get around the problem.
Plugins and themes should still work fine.