Dark Shadow
New member
I've just discovered Wordpress as a great tool for building Websites. I always thought it was just for blogging, but one can build a static Website and cash in on all of the plugins as well.
Wordpress as a Website Building Tool
- Thread starter Dark Shadow
- Start date
Same here. Look at www.igdesigner.co.uk whole website made with wordpress. This is an amazing tool for the front-end developers.
Sander k
New member
Look at http://CNN.com , its wordpress too.
weilrich
New member
Dark Shadow said:
Wordpress is very popular and has many features to recommend it. That is also an open invitation to hackers, some of whom seek out new Wordpress websites (and blogs) simply to hack them. Wordpress can be made relatively secure, but it is a constant effort to make sure it uses the latest security updates and plug-ins.
Agreed Weilrich. For every plus there is usually an offsetting negative. Security issues definitely are major ones. One probably should study those first, particularly how to "bullet proof" the site, before one launches a Word Press site.
Here are some tips for securing a Wordpress site by Kim Crawley:
10 Simple Ways to Secure your Wordpress Site
Here are some tips for securing a Wordpress site by Kim Crawley:
10 Simple Ways to Secure your Wordpress Site
1. Audit overall workstation security2. Keep WordPress updated
The next step is to make sure you always have the most recent version of WordPress installed. Updating WordPress is relatively quick and easy, and can be done through the WordPress panel in your web browser. If the most recent version of WordPress is incompatible with the versions of PHP and mySQL installed in your web server or web host, I strongly recommend you go through the effort to upgrade those to ensure your version of WordPress is up to date. Obsolete versions of WordPress will no longer get security patches, much the same way that older OSes see support expiring.
3. Report bugs and Report bugs and vulnerabilities
If you ever discover security vulnerabilities on your own, do the community a favour by sending a detailed email to security@wordpress.org. If the vulnerability is in a plug-in instead, email plugins@wordpress.org. You would want other web developers to report loopholes that may affect your website, so treat others as you would like to be treated! Just avoid writing about those newly discovered vulnerabilities on the web or on social networking sites, so that information doesn't fall into the wrong hands.
4. Check for exploits
Every so often, run the Exploit Scanner plug-in to check for indications of malicious activity. Exploit Scanner doesn't directly repair any issues, but it will leave you a detailed log to troubleshoot with. If you ever suspect cracking, that's the time to run that plug-in, as well.
5. Disable custom HTML when possible
WordPress can use custom HTML for various functions. If that isn't absolutely necessary for the form and function of your website, you may want to disable unfiltered HTML by adding the following to your wp-config.php file:
define( 'DISALLOW_UNFILTERED_HTML', true );
6. Don't look brand new7. Hide indexes
Be sure to disable public access to indexes whenever possible. If people can find the files in your site's wp-content/plugins/ directory without being authenticated, it's a lot easier to crack into your site through plug-in vulnerbilities. If your web server runs Apache or another OS that uses .htacess files, it's simple to do. Find the .htaccess configuration file in your site's main directory. That's the directory that contains index.php. Insert the text Options -Indexes anywhere in the file. Alternatively, if you can't alter a .htaccess file, upload an index.html file into your main directory. You could make that web page have a similar look to your site's PHP web pages and insert a hyperlink to your index.php file if you'd like. But obviously, in a site that uses WordPress as a CMS, visitors won't see your index.html file unless they type a specific path to it in their web browser address bar. Alternatively, you could make your index.html file a 0 byte placeholder.
In case your web server ever has problems computing PHP files, it's crucial to block directories that are only accessed by your server. If the PHP source code is ever displayed in a visitor's web browser rather than the web page it's supposed to render, they may find database credentials or in depth information about the PHP/mySQL programming of your site. Your site's wp-includes/ directory is the most important one to block. Find the .htaccess file there and insert:
RewriteRule ^(wp-includes)\/.*$ ./ [NC,R=301,L]
If there are or will be subdirectories of wp-includes/, insert the following code for each one in the same .htaccess configuration file:
RewriteRule ^(wp-includes|subdirectory-name-here)\/.*$ ./ [NC,R=301,L]
8. Back it up!
WP-DB Manager is excellent for backing up your entire WordPress site, but it'll also alert you to mySQL vulnerabilities and let you know when parts of your database are publicly accessible.
Always be sure to properly back up the content of your site. In a worst-case scenario, at least keeping backups will allow you to easily restore your site. With WP-DB Manager, you could also use Online Backup for WordPress. The back up the plug-in creates can be stored in your email inbox or on your PC, or you can use the 100MB of free storage space on developer Backup Technology's own secure servers.
9. Install security plug-ins
I previously mentioned the Exploit Scanner plug-in, which you should run on your site every so often to check for vulnerabilities and cracking attempts. There are a number of other WordPress plug-ins that I recommend you install and use. When used properly, they can harden your WordPress site very effectively.
With Exploit Scanner, you can also use WP Security Scan. Not only will the plug-in look for vulnerabilities, but it'll also give you specific advice for blocking them.
To prevent man-in-the-middle cracks to find your login credentials, be sure to encrypt your login packets with Login Encryption. That plug-in uses both DEA and RSA algorithms for enhanced security.
Installing plug-ins from the admin panel
[*]Configure the Limit Login Attempts plug-in to prevent brute-force attacks. With the plug-in, you can set a maximum number of login attempts, and also set the duration of lockouts in between.[/list]
[*]The User Locker plug-in works in a similar way. With it, you can set a maximum number of invalid authentication attempts before the account is locked.[/list]
[*]There's also an excellent plug-in for securing your entire admin panel. Try Admin SSL Secure Plugin to encrypt your panel with SSL.[/list]
[*]Another strong plug-in for securing your site's login is Chap Secure Login. By using that, all of your login credentials, except for usernames, will be encrypted with the Chap protocol and SHA-256 algorithm.[/list]
[*]As mentioned before, it's an excellent idea to change as many WordPress defaults as possible. With Stealth Login, you can create custom URLs for logging in and out of your site.[/list]
[*]Block Bad Queries will try to block malicious queries made to your site. It looks for eval( or "base64" in request URIs, and also looks for request strings that are suspiciously long.
[*]An anti-malware shield can be applied to your entire site with the AntiVirus plug-in. It looks for viruses, worms, rootkits, and other forms of malware. Be sure to keep it updated!
And remember: when you choose and install plug-ins on your site, also be sure to only install plug-ins offered through your admin panel or under the plug-in directory at WordPress.org. Outside plug-ins may be secure, but it's best to mitigate the risk. Officially released plug-ins are audited for security and scanned for malware.
10. Install other useful plug-ins
WordPress sites are frequently targeted by spambots. I have to spend a lot of time going through comments on my site, and the majority of my pending comments have to be marked as spam. Imagine what those spambots can do to your site, beyond giving you a lot of tedious extra work! For that reason, I recommend installing Bad Behavior on your site. By logging your site's HTTP requests, you can better troubleshoot spambot issues. Furthermore, the plugin will limit access to your site when a bot hits it.
With Bad Behavior, you can also use User Spam Remover. It will remove unused user accounts on your site. You can set an age threshold to those settings and you can also configure a whitelist.
Putting everything together
Keeping your WordPress site hardened for security is an ongoing responsibility, just like all other areas of IT and development security. You can't just configure a number of settings or programs and then forget about it. Your WordPress site should be on a schedule for malware and vulnerability scanning, and logs should be kept and analysed.
i make plugin to remove wordpress meta generator tag. its also remove trailing wp version in js and css url
save this code as anythinkyouwant.php then upload to plugin folder and activated from wp admin
save this code as anythinkyouwant.php then upload to plugin folder and activated from wp admin
PHP:
<?php
/*
Plugin Name: Remove WP Generator Header
Description: Remove wordpress generator tag and trailing wp version URL
Version: 1.0
Author: Ogah
Author URI: http://www.ddlgen.net/
*/
remove_action('wp_head', 'wp_generator');
function remove_version_info() {
return '';
}
add_filter('the_generator', 'remove_version_info');
function remove_script_version($src) {
if (strpos($src, 'ver='))
$src = remove_query_arg('ver', $src);
return $src;
}
add_filter('style_loader_src', 'remove_script_version', 9999);
add_filter('script_loader_src', 'remove_script_version', 9999);sbalamuruganmscit
New member
I'm using wordpress for editing existing themes. Completely open source. We have to pay for some third party plugins. Very nice content management tool to build own blog.
gonzoateafly
New member
The main reason I use wordpress is simply because there are so many thousands of pre-designed templates I can purchase or even get for free. For all my coding wizardry skills, I am just terrible at front end design. I wish I was better, I'd actually have a skill to market then... but wordpress covers some of that at least!
Lycos
New member
I'd say one could do about any kind of Website with WordPress nowadays including commercial Websites. Looks as though one can seamlessly integrate WordPress with blogs as well these days. Must say however that there are so many people on the WordPress bandwagon that some of the Websites are so much of the same it can get boring.
