Security for Wordpress Websites

[ksigmtsu]

Good advice. I think I will do that today.

I also added Silence is Golden Guard since WF doesnt protect your plugins like it does.
- - - - - - - - - - - - - - - - - -
WARNING!!!!!!!!!!!!

If you install Silence is Golden Guard be VERY careful and backup everything before you do.

It has totally wrecked sc-lifeinsurance plus my other site that is on the same host plan.....

I would not recommend it based on what I am currently going through.

I have even totally deleted the plugin from my server files... its better, but its still f#cked...

Silence is golden guard, don't just haphazardly check all the checkboxes, sort of feel like it's my fault for not going into more detail with it.

The attached jpg shows in red the options you want checked, don't check the top two, they can bork up your system unintentionally.

After that click update.

Always, always always make a backup.

 

[Crabcake Johnny]

Just a FYI, but you should always try out any new plugin in a test environment (site.) It's also good when updates come along.

 

[scagnt83]

Silence is golden guard, don't just haphazardly check all the checkboxes, sort of feel like it's my fault for not going into more detail with it.

The attached jpg shows in red the options you want checked, don't check the top two, they can bork up your system unintentionally.

After that click update.

Always, always always make a backup.

So any suggestion on how to fix it now?
I deleted it from my server files, and I am not getting the excessive redirect message anymore. But it wont take me to my wpadmin login. It just redirects back to the main site.
Plus all of my CSS is gone, and my other site on the same hosting plan is now redirecting to sclife...

 

[Crabcake Johnny]

Some great follow up replies regarding security by Matt. All of his replies are in yellow to make is easy. He also gives his choice for security plugins.

Passwords and Brute Force — Matt Mullenweg

 

[ksigmtsu]

So any suggestion on how to fix it now?
I deleted it from my server files, and I am not getting the excessive redirect message anymore. But it wont take me to my wpadmin login. It just redirects back to the main site.
Plus all of my CSS is gone, and my other site on the same hosting plan is now redirecting to sclife...

First thing I'd suggest is asking your hosting company to restore a backup from 24-48 hours ago or farther if they have one.

Past that, I'd look for the index.php file in the wp-admin directory, and in your other root directory, and see if they're the ones silence is golden puts in and delete them. Once you get in, I'd reinstall the plugin and set the settings like I show in the picture, then run it again and see if it fixes itself.

Does the http://yoursite.com/wp-login.php work, rather than trying to proceed directly to the admin folder?

 

[scagnt83]

First thing I'd suggest is asking your hosting company to restore a backup from 24-48 hours ago or farther if they have one.

Past that, I'd look for the index.php file in the wp-admin directory, and in your other root directory, and see if they're the ones silence is golden puts in and delete them. Once you get in, I'd reinstall the plugin and set the settings like I show in the picture, then run it again and see if it fixes itself.

Does the http://yoursite.com/wp-login.php work, rather than trying to proceed directly to the admin folder?

Thanks for the suggestions. I am just now able to take a look at things again. I am waiting to see if the hosting company can restore it.

I am not able to access my wp-login.php it just redirects me to my homepage.

Hopefully my host can come through. If not I guess I am back to the root directory.

Thanks for the suggestions.

 

[Crabcake Johnny]

Thanks for the suggestions. I am just now able to take a look at things again. I am waiting to see if the hosting company can restore it.

I am not able to access my wp-login.php it just redirects me to my homepage.

Hopefully my host can come through. If not I guess I am back to the root directory.

Thanks for the suggestions.

WordPress › Silence is Golden Guard « WordPress Plugins

and...

There is a very strong recommendation to make full backup of your blog before you activate SIG plugin. If you have development copy of your blog at the same webhost I recommend you to give a SIG plugin first try at the test environment as there are small amount of incidents when with redirection to site root option turned on automatically created empty index.php file caused endless redirect loop and prevents site loading. It could be the case if you use child theme and theme_name-child folder has not its own index.php file and some other cases which are not isolated yet.

 

[scagnt83]

there are small amount of incidents when with redirection to site root option turned on automatically created empty index.php file caused endless redirect loop and prevents site loading.[/B]

That is exactly what it was doing

 

[Yagents]

My wife does websites, told her to read this thread. Her comment to share was:

Suggest that they can scan their website for malware, free at Sucuri Security and their security monitor service is inexpensive ($90/year for 1 website)

 

[somarco]

Security Alert For All WordPress Users

Avoid Being Hacked
Hostgator have reported on this recently and advised you take action as follows:

Learn how to change your WordPress login username.
Change your password
Create full backup of all your files and website content (database)
Install a security plugin which provides limit login attempts or an all in one security plugin like Wordfence which also includes limit login attempts. Probably won’t help much with this botnet but may prevent others. See Note below.
Update all your themes, plugins and core WordPress files.
These are simply 5 of the best ways to secure WordPress and avoid the experience of finding out your site has been hacked and filled with malicious code.

Changing Your WordPress Username

One simple solution to fix this vunerbility is to change your WordPress login username.
Add New User

Login to your Dashboard (admin page)
Go to Users > Add New and create a new user for yourself. Make sure the role is as an Administrator and at least 10 digits long like your password.
Create a new password which is at least 10 digits long. Make it even stronger by using both upper and lower case letters, numbers and symbols like ! ” ? $ % ^ & ).
Delete Your Old Administrator Profile

Once you’ve setup your username on your new admin profile, you’ll receive a password for this user. You can now login and delete your old admin user profile and attribute the posts to your new profile.

Login using your new details and navigate to the Users > All Users screen
Select your old admin user and delete it
Attribute All Posts To New User

The final step you need to take is to make sure all your posts are attributed to your new user profile.

When you delete your old user profile for admin, you be asked “What should be done with posts and links owned by this user?”