3 Top Security Plugins for WordPress

3 Top Security Plugins for WordPress

Jan 17, 2018 | WordPress Security, General

Overall WordPress is secure and is our number one resource recommendations for content management systems. With all of the WordPress updates, we feel it is most secure to use. However, the ongoing threats of hacking into WordPress sites is a constant threat. WordPress developers keep up with this task with updates on an ongoing basis. Kudos and appreciation for keeping up with what most people do not know what goes on behind the scenes when keeping your WordPress site secure.

Over the years we have used and tried several different approaches to security for WordPress sites. From the ones we have tried, these are our top three picks of security plugins for WordPress sites.

Wordfence

Wordfence

Wordfence Security is 100% free and open-source security software supported by a large team dedicated exclusively to WordPress security. A deep set of features makes Wordfence the most comprehensive WordPress security solution available:

  • Firewall blocks complex and brute force attacks
  • Security Scan alerts you quickly in the event of a security issue
  • Threat Defense Feed keeps Wordfence up to date with the latest security data
  • Robust login security features
  • Configurable security alerts
  • Gain insight into traffic and hack attempts
  • Security incident recovery tools

Wordfence details of services and features

Wordfence Download on WordPress.org

Sucuri 

Sucuri Inc. is a globally recognized authority in all matters related to website security, with specialization in WordPress Security.

The Sucuri Security WordPress plugin is free to all WordPress users. It is a security suite meant to complement your existing security posture. It offers its users a set of security features for their website, each designed to have a positive effect on their security posture:

  • Security Activity Auditing
  • File Integrity Monitoring
  • Remote Malware Scanning
  • Blacklist Monitoring
  • Effective Security Hardening
  • Post-Hack Security Actions
  • Security Notifications
  • Website Firewall (premium)

See More about Sucuri and the features for WordPress Security

Sucuri Download from WordPress.org

All In One WP Security and Firewall

The All In One WordPress Security plugin will take your website security to a whole new level.

This plugin is designed and written by experts and is easy to use and understand.

It reduces security risk by checking for vulnerabilities, and by implementing and enforcing the latest recommended WordPress security practices and techniques.

All In One WP Security also uses an unprecedented security points grading system to measure how well you are protecting your site based on the security features you have activated.

Our security and firewall rules are categorized into “basic”, “intermediate” and “advanced”. This way you can apply the firewall rules progressively without breaking your site’s functionality.

The All In One WordPress Security plugin doesn’t slow down your site and it is 100% free.

Visit the WordPress Security Plugin page for more details.

Below is a list of the security and firewall features offered in this plugin:

User Accounts Security

  • Detect if there is a user account which has the default “admin” username and easily change the username to a value of your choice.
  • The plugin will also detect if you have any WordPress user accounts which have identical login and display names. Having account’s where display name is identical to login name is bad security practice because
    you are making it 50% easier for hackers because they already know the login name.
  • Password strength tool to allow you to create very strong passwords.
  • Stop user enumeration. So users/bots cannot discover user info via author permalink.

User Login Security

  • Protect against “Brute Force Login Attack” with the Login Lockdown feature. Users with a certain IP address or range will be locked out of the system for a predetermined amount of time-based on the configuration settings and you can also choose to be notified
    via email whenever somebody gets locked out due to too many login attempts.
  • As the administrator, you can view a list of all locked out users which are displayed in an easily readable and navigable table which also allows you to unlock individual or bulk IP addresses at the click of a button.
  • Force logout of all users after a configurable time period
  • Monitor/View failed login attempts which show the user’s IP address, User ID/Username and Date/Time of the failed login attempt
  • Monitor/View the account activity of all user accounts on your system by keeping track of the username, IP address, login date/time, and logout date/time.
  • Ability to automatically lockout IP address ranges which attempt to login with an invalid username.
  • Ability to see a list of all the users who are currently logged into your site.
  • Allows you to specify one or more IP addresses in a special whitelist. The whitelisted IP addresses will have access to your WP login page.
  • Add captcha to WordPress Login form.
  • Add captcha to the forgot password form of your WP Login system.

User Registration Security

  • Enable manual approval of WordPress user accounts. If your site allows people to create their own accounts via the WordPress registration form, then you can minimize SPAM or bogus registrations by manually approving each registration.
  • Ability to add captcha to the WordPress’s user registration page to protect you from spam user registration.
  • Ability to add Honeypot to the WordPress’s user registration form to reduce registration attempts by robots.

Database Security

  • Easily set the default WP prefix to a value of your choice with the click of a button.
  • Schedule automatic backups and email notifications or make an instant DB backup whenever you want with one click.

File System Security

  • Identify files or folders which have permission settings which are not secure and set the permissions to the recommend secure values with click of a button.
  • Protect your PHP code by disabling file editing from the WordPress administration area.
  • Easily view and monitor all host system logs from a single menu page and stay informed of any issues or problems occurring on your server so you can address them quickly.
  • Prevent people from accessing the readme.html, license.txt and wp-config-sample.php files of your WordPress site.

htaccess and wp-config.php File Backup and Restore

  • Easily backup your original .htaccess and wp-config.php files in case you will need to use them to restore broken functionality.
  • Modify the contents of the currently active .htaccess or wp-config.php files from the admin dashboard with only a few clicks

Blacklist Functionality

  • Ban users by specifying IP addresses or use a wildcard to specify IP ranges.
  • Ban users by specifying user agents.

Firewall Functionality

This plugin allows you to easily add a lot of firewall protection to your site via htaccess file. An htaccess file is processed by your web server before any other code on your site.
So these firewall rules will stop malicious script(s) before it gets a chance to reach the WordPress code on your site.

  • Access control facility.
  • Instantly activate a selection of firewall settings ranging from basic, intermediate and advanced.
  • Enable the famous “5G Blacklist” Firewall rules courtesy of Perishable Press
  • Forbid proxy comment posting.
  • Block access to debug log file.
  • Disable trace and track.
  • Deny bad or malicious query strings.
  • Protect against Cross Site Scripting (XSS) by activating the comprehensive advanced character string filter.
    or malicious bots who do not have a special cookie in their browser. You (the site admin) will know how to set this special cookie and be able to log into your site.
  • WordPress PingBack Vulnerability Protection feature. This firewall feature allows the user to prohibit access to the xmlrpc.php file in order to protect against certain vulnerabilities in the pingback functionality. This is also helpful to block bots from constantly accessing the xmlrpc.php file and wasting your server resource.
  • Ability to block fake Googlebots from crawling your site.
  • Ability to prevent image hotlinking. Use this to prevent others from hotlinking your images.
  • Ability to log all 404 events on your site. You can also choose to automatically block IP addresses that are hitting too many 404s.
  • Ability to add custom rules to block access to various resources of your site.

Brute force login attack prevention

  • Instantly block Brute Force Login Attacks via our special Cookie-Based Brute Force Login Prevention feature. This firewall functionality will block all login attempts from people and bots.
  • Ability to add a simple math captcha to the WordPress login form to fight against brute force login attacks.
  • Ability to hide admin login page. Rename your WordPress login page URL so that bots and hackers cannot access your real WordPress login URL. This feature allows you to change the default login page (wp-login.php) to something you configure.
  • Ability to use Login Honeypot which will helps reduce brute force login attempts by robots.

WhoIs Lookup

  • Perform a WhoIs lookup of a suspicious host or IP address and get full details.

Security Scanner

  • The file change detection scanner can alert you if any files have changed in your WordPress system. You can then investigate and see if that was a legitimate change or some bad code was injected.
  • Database scanner feature can be used to scan your database tables. It will look for any common suspicious-looking strings, javascript and html code in some of the WordPress core tables.

Comment SPAM Security

  • Monitor the most active IP addresses which persistently produce the most SPAM comments and instantly block them with the click of a button.
  • Prevent comments from being submitted if it doesn’t originate from your domain (this should reduce some SPAM bot comment posting on your site).
  • Add a captcha to your wordpress comment form to add security against comment spam.
  • Automatically and permanently block IP addresses which have exceeded a certain number of comments labeled as SPAM.

Front-end Text Copy Protection

  • Ability to disable the right click, text selection and copy option for your front-end.

Regular updates and additions of new security features

  • WordPress Security is something that evolves over time. We will be updating the All In One WP Security plugin with new security features (and fixes if required) on a regular basis so you can rest assured that your site will be on the cutting edge of security protection techniques.

Works with Most Popular WordPress Plugins

  • It should work smoothly with most popular WordPress plugins.

Additional Features

  • Ability to remove the WordPress Generator Meta information from the HTML source of your site.
  • Ability to remove the WordPress Version information from the JS and CSS file includes of your site.
  • Ability to prevent people from accessing the readme.html, license.txt and wp-config-sample.php files
  • Ability to temporarily lock down the front end of your site from general visitors while you do various backend tasks (investigate security attacks, perform site upgrades, do maintenance work etc.)
  • Ability to export/import the security settings.
  • Prevent other sites from displaying your content via a frame or iframe.

Plugin Support

  • If you have a question or problem with the All In One Security plugin, post it on the support forum and we will help you.

Developers

  • If you are a developer and you need some extra hooks or filters for this plugin then let us know.
  • Github repository – https://github.com/Arsenal21/all-in-one-wordpress-security

Translations

  • All In One WP Security plugin can be translated to any language.

 

Learn more about the All In One Security and Firewall for WordPress and Download

Download the All In One Security and Firewall on WordPress.org

 

If you ever need to find resources for WordPress or website security, they will be listed on the Secure Hosting WP Resources

51 Amazing Facts You Probably Don’t Know About WordPress

Jan 12, 2018 | General

Throughout the years, WordPress has evolved from a simple blogging platform into a versatile content management system. Today, this open source software tool enables you to create anything between a simple blog and a fully functional website.

The popularity of WordPress has been constantly increasing, as it’s flexible, easy to use, and has many powerful features. Many leading companies, including Forbes, eBay, and The New York Times, have chosen WordPress to power their websites, making it the most used CMS worldwide.

Take a look at this Website Builder infographic to learn some amazing facts that you probably didn’t know about WordPress.

 

Source: 51 Amazing Facts You Probably Don’t Know About WordPress

 

Keep your WordPress secure with Secure Hosting WP

8 Reasons Why Cybercrime Had a Banner Year – The LastPass Blog

8 Reasons Why Cybercrime Had a Banner Year – The LastPass Blog

Jan 12, 2018 | General, Web Site Security Plan

The security industry has a habit of using terms like “ever-advancing” and “always-evolving” in relation to security threats like malware. After a while those terms seem more like throwaways considering the frequency of use.

But then 2017 happened, and those descriptive words became more relevant.

We’ve seen more victims and breached records, more attack vectors, and a lot more money being extorted. Equifax lost 143 million consumer records in a single data breach, all because they weren’t patching software on a regular basis. The number of records breached at Yahoo! alone may hit 3 billion when it is all sorted out.

In other words, cybercriminals had a banner year in 2017 – financially and otherwise – and it doesn’t look like there’s a bust for this boom anywhere on the horizon.

Case in point, according to Cybersecurity Ventures’, the financial damage caused by cybercrime may hit $6 trillion by 2021. If you think that number is staggering, consider the fact that the estimate has doubled since just last year. On the flip side, according to Gartner, cybersecurity technology spending will hit $86.4 billion this year while Cybersecurity Ventures predicts a cumulative spending of $1 trillion from 2017-2021.

Putting this all into perspective, here’s a list of events and evolving trends that made 2017 stand out from the pack, for better or for worse:

1. Cybercrime is Great for the Job Market
Sometimes a very bad thing can bring about a good opportunity. More cybercrime and ever-advancing (see?) attack vectors mean more IT and security personnel will be needed to defend against it all. It’s already hard enough to find security pros to fill open posts, and the growing need will only serve to triple the number of unfilled jobs in security – rising to 3.5 million by 2021, according to Cybersecurity Ventures.

Cybersecurity has never been a bad career move, especially given that this particular segment of the job market has a zero percent unemployment rate.

2. The Growth of the Human Attack Surface
More people on the Internet means more opportunity for cybercriminals. According to TNW magazine, by the end of 2017 more than half (51%) of the world’s 7 billion people will be Internet users. That’s up nearly 100% in two years.

Cybersecurity Ventures goes on to predict that 75% of the world’s population will be Internet users in just four years, with 90% predicted to be online by 2030. In other words, the human attack surface is growing.

3. Cybersecurity Officially Becomes a U.S. Government Entity
Just this week the U.S. House of Representatives passed legislation that will change the designation of the Department of Homeland Security’s National Protection and Programs Directorate (NPPD) as the Cybersecurity and Infrastructure Security Agency (CISA).

The legislation assures that the agency will be “headed by a Director of National Cybersecurity and Infrastructure Security to lead national efforts to protect and enhance the security and resilience of US cyber-security, emergency communications, and critical infrastructure.”

These changes go beyond the U.S., as the European Union announced their own regulation around data protection in 2016 (GDPR) that is fast approaching the enforcement date of May 2018.

4. Governments Move to Ban Suspicious Security Software
Earlier this week the U.S. also passed legislation that officially bans the use of security software produced by Moscow-based Kaspersky Labs within civilian and military agencies. This follows concerns back in September that the technology has fallen under questionable influence by the Russian government.

In early December, the U.K. government started to make similar moves to ban Kaspersky software. It will be interesting to see if other security vendors will fall into this no-fly-zone in 2018.

5. Ransomware Goes Big
It’s well known by now that ransomware largely represents the biggest advance in cybercrime this year. Perhaps not the coding itself, but more through the scope and depth of its damage. Cybersecurity Ventures predicts the financial costs of global ransomware in 2017 will exceed $15 billion. Two years ago it was merely one-fifteenth of that amount.

Healthcare organizations have seen some of the biggest impact and it may only get worse. The numbers are high, but they are not hard to believe if you consider Danish shipping company Maersk will pay about $350 million to fix the damage caused by the NotPetya malware attack in late June.

6. Passwords Can Only Protect When They are Used
According to Verizon’s DBIR, a full 81 percent of confirmed breaches are due to weak, reused or stolen passwords. In our own research on the psychology of passwords, 91 percent of respondents understood the risk of reusing a password, yet 61 percent of them still do. It seems like the fear or forgetting a password outweighs what might seem like a remote chance of getting hacked.

These stats ring true when you read about New York’s Stewart International Airport whose backup systems were discovered to have no password protection. Exposed server data showed that airport staff, over an unknown period of time, did not have access to the TSA’s “No Fly” list. Ouch.

Another example involves Data analytics firm Deep Root Analytics that was hired by the Republican National Committee to gather political information about U.S. voters. A cyber analyst discovered that personal data representing nearly 200 million American citizens was kept on an Amazon cloud server without password protection for nearly two weeks.

Deloitte, HBO, Mandiant and several others had a particularly bad year when it came to password security hygiene. Perhaps a better password management system would have helped brace these firms against these breaches.

7. System Not Responding
An anonymous hacker successfully yanked down one-fifth of the dark web in February after he hacked Freedom Hosting, the company that hosts thousands of dark web domains. This gave me great satisfaction to know that cybercriminals around the world were dealing with a whole lot of 404 error messages while their sites went boom.

8. Bitcoin Valuation Cuts Both Ways
We’re ending the year on a different note. The super-fast increase in Bitcoin valuation (now about $16,500 per coin) presents both a plus and a minus for cybercriminals. For those who have already had a good run, collecting bitcoins along the way as ransom or just to run their businesses, it’s a big win.

For those who use Bitcoin as a means to pay ransom for data held hostage, they are going to have to adjust their approach or else paying ransom is going to be too expensive for almost everyone, and not just the modestly-sized school system or hospital.

 

Read the full article here at the Source: 8 Reasons Why Cybercrime Had a Banner Year – The LastPass Blog

Pin It on Pinterest