I will certainly be implementing your security tips on my main wordpress blog

I should have mentioned it before, generally it’s regarded that for good computer security your access control should be based on “something you have and something you know”. There are a variety of hardware devices you can use for authenticating yourself. One of the cheapest and easiest is the Yubikey which emulates a USB keyboard and requires no special device driver support and no transcribing long numbers.

http://etbe.coker.com.au/2010/03/15/yubikey/

I’ve written about some of the technical aspects of the Yubikey at the above URL.

But if someone was trying to attack a high value blog like Scoblizer then they wouldn’t be stopped by such things. Among other things an attacker who has a trojan installed (a pre-requisite for running a software keylogger) can hijack the session. One thing they could do is hijack the logout button to simulate closing the session but allow the attacker to continue using the session. If the session in question had administrative rights then the attacker could add new accounts.

One protection against trojans is to have multiple backups stored on removable media – and to hope that the attacker doesn’t encrypt all files and hide the key (as some viruses have done in the past).

But really anything you do on a compromised platform is going to result in you losing if it’s worth enough to an attacker. It’s best to just use a reliable system.

You could consider having one computer dedicated to doing nothing but blog administration (computers are cheap). When viewing links from blog comments and reading other people’s blogs use a different computer. A Windows box that does nothing but talk to your blog server should be safe enough.

http://etbe.coker.com.au/2010/03/08/designing-secure-linux/

Or you could use an OS that doesn’t tend to be prone to keylogger attacks, such as Linux. The above URL has a post I recently wrote with some design ideas for a particularly secure Linux system. Linux security is reasonably good but we can improve it.

http://wordpress.org/extend/plugins/secure-wordpress/

I have this installed on my blog along with a highly customized .htaccess and mod_security installed and configured.

@Ami, take out the Deny from all in .htaccess, and replace it with this:

# BEGIN WordPress

RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]

# END WordPress

That should get you started again.

I recommend doing backups at the database level if possible. I run a mysqldump on the database server and then scp the files to another system. So even if something was going wrong with my blog it wouldn’t affect the backups unless it had changed the database.

Make sure that your backups are under your control. Emailing them to a gmail account etc is not good enough! The data must end up on physical media that you personally own, preferably multiple pieces of media. My blog backups are transferred daily to a RAID-1 array on my home server and I periodically back them up to removable drives.

Kind Regards,
Sam
X

When I updated to a newer version of WordPress, one theme crashed completely.