backing up wordpress & basic security presented at wordcamp atlanta, 2013

BACKING UP WORDPRESS&

BASIC SECURITYCarel Bekker - @ClickHOST & @carelbekker

Saturday, March 16, 13

Carel Bekker - @ClickHOST

Who is this guy?

• From South Africa• In US since 1998• 25+ years in technology•Owner of ClickHOST.com

• Loves my wife, 3 children, technology, reading, travel and occasional round of golf.

• linkedin.com/in/cbekker

2


http://www.linkedin.com/in/cbekker

http://www.linkedin.com/in/cbekker


If only...

3



What will we cover?“I’m going to show your where the windows and doors are on

your WordPress house and how to lock them!”

•Basics needed to protect your WordPress website or blog•Very little technical skills are needed• Some definitions•Resource list

• Security Myths• 3 ways to Backup WordPress• 3 security tips that will safe your life, ok, at least your website

4



What is malware?

•Malware = malicious software. •Anything loaded onto your website (or computer) that you didn’t authorize.

• Malware, short for malicious (or malevolent) software, is software used or created by attackers to disrupt computer operation, gather sensitive information, or gain access to private computer systems. It can appear in the form of code, scripts, active content, and other software. 'Malware' is a general term used to refer to a variety of forms of hostile or intrusive software. - wikipedia.org

5


http://en.wikipedia.org/wiki/Portmanteau

http://en.wikipedia.org/wiki/Portmanteau

http://en.wikipedia.org/wiki/Source_code

http://en.wikipedia.org/wiki/Source_code

http://en.wikipedia.org/wiki/Script_(computing)

http://en.wikipedia.org/wiki/Script_(computing)


Other definitions

•SQL Injections: Entering SQL statements into form fields.

•Cross-site contamination: WordPress sites infecting sites in the same hosting account.•Phishing or Spoofing: Email or website

that looks like the real thing•Social engineering, e.g., Wired reporter

story

6


http://en.wikipedia.org/wiki/Sql_injection

http://en.wikipedia.org/wiki/Sql_injection

http://blog.sucuri.net/2012/12/website-malware-reality-of-cross-site-contaminations.html

http://blog.sucuri.net/2012/12/website-malware-reality-of-cross-site-contaminations.html

http://en.wikipedia.org/wiki/Spoofing_attack

http://en.wikipedia.org/wiki/Spoofing_attack

http://www.clickhost.com/





Security Myths•#1: Who would want to hack my website

•#2: I will see when my website is hacked

•#3: My website is 100% secure

•#4: My hosting provider will have a backup for me

•#5: I use strong passwords -- I’m ok7



Backing up WordPress

8



Backup Basics•What is a backup?

•Reliable recent copy of your website.• Should be easy to restore from your backup.

•Why should I backup?

•Bad things happen, especially in the WWW = wild, wild west.•How often & when should I backup?

•Before any major updates to your website•Before updating WordPress, plugins or themes•Daily, Weekly, Monthly. • 1-2 different backup copies.

9



Use a WordPress plugin• Install a plugin to backup your WordPress

website.•Most offer option to backup to: hosting

account, cloud, local or email the backup.•Numerous FREE WordPress backup plugins:•One-click installers like Softaculous

•BackWPup (free and pro versions)•WordPress Backup to Dropbox

• or Paid plugins:•BackupBuddy ($$$)•VaultPress ($$)

10



DIY Backups•Use tools provided by hosting

company•cPanel most common control panel• Select the Database to download.•Only backup the database.•Backup will be downloaded to your

local directory.•You can then upload the database

to restore your WordPress website.

•Paid services: CodeGuard, SiteAutoBackup,

11



Ask your hosting provider

•This is not specific to WordPress.• Some hosting providers provide automatic backups• Full account backups• Some offer free restore services•Others charge a fee to restore a from a backup

•Ask your hosting provider to setup a backup schedule

•Don’t keep too many backups in your hosting account•Download to your local machine

12



Top Tips toSecure WordPress

13



Don’t use ADMIN

•Don’t use admin as your username.•This is the default when installing •Almost as bad as using password for your password :)

•How to fix this!•Create a new administrator user.• Log out, then log in as the new admin user.•Delete the old “admin” user.

14



Update! Update!•New versions/updates include security

fixes and new functionality.•Always keep your WordPress

installation current!• Keep your plugins updated.

• Try to keep your theme current too, however be careful and only upgrade if you are sure that a child theme was used.

•Make a backup BEFORE you update WordPress, plugins or themes.

15



Passwords

•Use strong passwords, not 123456 or Password

•Use Pass-phrases, correcthorsebatterystaple

•Better yet, use a password manager:•Generate very strong passwords•No need to remember 100’s of password• Easy to use with browser addons.

•LastPass.com, 1password.com, RoboForm.

16



Anti-spam techniques• How do I prevent comment spam? Unwanted comments in my blog posts.

• Don’t allow comments. • Also to moderate all comments.

• Use a comment system plugin:• Disqus• Livefyre• Use Facebook Comment system.

• Comment spam control plugins:• Akismet ($5/month)• Growmap Anti Spambot (free)

17



Security plugins•Most include:•One-click hardening• File monitoring• Personal Firewall (IP blocking)

•Security plugins:• Sucuri (w/ membership)•WordFence (free and paid)• IPVenger (beta)• Login LockDown

18



Random security tips

•Make sure you have anti-virus installed on your computer • Even on a Mac (Sophos)

• Email spam filtering

•Only download themes, and plugins from trusted sources.•WordPress and reputable theme/plugin sources

•Delete unused themes, and plugins! (not just de-activate)•Delete unused WordPress installations.

19



Questions??

20



Resources•More great WordCamp presentations:•WordPress End-User Security, Dre Armeda• Building secure WordPress sites, Sakin Shrestha• or goto wordpress.tv and search for security

•WordPress Codex: http://codex.wordpress.org/WordPress_Backups•WordPress Backup options: http://www.clickhost.com/wordpress-backup/• Search clickhost.com/blog for WordPress• How to make your WordPress installation Secure•WordPress Security: 5 Steps To Reduce Your Risk• Three sure fire ways to prevent being hacked!

21


http://wordpress.tv/2011/11/19/dre-armeda-wordpress-end-user-security/

http://wordpress.tv/2011/11/19/dre-armeda-wordpress-end-user-security/

http://wordpress.tv/2013/02/26/sakin-shrestha-building-secure-wordpress-sites/

http://wordpress.tv/2013/02/26/sakin-shrestha-building-secure-wordpress-sites/

http://wordpress.tv/?s=security

http://wordpress.tv/?s=security

http://codex.wordpress.org/WordPress_Backups

http://codex.wordpress.org/WordPress_Backups

http://www.clickhost.com/wordpress-backup/

http://www.clickhost.com/wordpress-backup/

http://www.softaculous.com/blog/how-to-make-your-wordpress-installation-secure/

http://www.softaculous.com/blog/how-to-make-your-wordpress-installation-secure/

http://blog.sucuri.net/2013/01/wordpress-security-5-steps-to-reduce-your-risk.html

http://blog.sucuri.net/2013/01/wordpress-security-5-steps-to-reduce-your-risk.html

http://www.clickhost.com/3-tips-friday-three-sure-fire-ways-to-prevent-hacked/

http://www.clickhost.com/3-tips-friday-three-sure-fire-ways-to-prevent-hacked/


Carel Bekker

President&[email protected]

Twitter : @clickhost, @carelbekker

Tel: 404.220.8110

22

Friends don’t let friends host on Go Daddy!


mailto:[email protected]

mailto:[email protected]

backing up wordpress & basic security presented at wordcamp atlanta, 2013

Technology

carel bekker

hosting provider

strong passwords

admin user

wordpress

computer

clickhost

wordpress