Keeping Your WordPress Blog Page Safe - Four More Security Tips

The last article in this WordPress security series was an overview of the program's blogging code. The following tips are some more security measurements that you might want to employ to keep your blog clean and safe.

Use strong passwords

This is an overlooked but great security habit. Check and verify that all your passwords are tough: the ftp account, your admin account, and any other WordPress accounts that might have control.

There are many online articles about how to select good passwords, so there's no need to repeat that here. Just ensure that you adhere to the advice contained in these articles and refrain from copying the passwords they list.

Use SCP instead of FTP

Do you use FTP when you transfer files to and from the server that hosts your blog? This is convenient mostly because there are so many good FTP programs available that make as easy to transfer files to a server as moving and copying them locally.

The problem with FTP is that your username and password is sent in clear text to your server. To be more secure you should use SCP instead. Here are two programs that I recommend: WinSCP for Windows and Cyberduck for OS X.

SCP implements file transfers connecting to the host using SSH therefore SSH login should be enabled on the server. Replaced FTP can be disabled at this point.

Your theme should be write-protected

It looks as if there is an exploit circulating that alters existing WordPress themes and adds links to spam or even pernicious iframes. There is a way around this: just change any permission files on your WordPress themes folder to 755 and all files within that folder to 644. The only downside is the fact that whenever you want to make any theme changes, you'll have to send any such file to your web server via file transfer protocol.

Most plugins write their data to the directory where they are installed. This makes write protection of the plugins directories impossible.

View the HTML source of your site often

View the HTML source of your website often. If you find chunks of JavaScript embedded in IFRAMES or hidden links to websites you are not familiar with, your blog may have been compromised without your knowledge. Viewing the HTML source of your website often; removing chunks of JavaScript; and removing hidden websites allows you to prevent issues before Google does and blacklists you. This also prevents you or any of your readers from getting infected by malicious software.

WordPress security (http://www.TipsTricksToolsTechniques.com/?cat=7) is an ongoing effort. Stay up to date with tips from Nick Dalton at TipsTricksToolsTechniques.com. You should also read his acclaimed report: The Digital Security Report (http://www.DigitalSecurityReport.com/) for in depth advice on protecting your digital products.