Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Besides having secure passwords for my blog user and database connections, what should I do to make sure my WordPress installation is secure on my Linux shared server?

share|improve this question
up vote 6 down vote accepted

I think the best suggestions are well explained in the official "Hardening Wordpress" document:

At the end, those are the same suggestions for every application out there:

  • Keep it updated.
  • Use good passwords
  • Reduce what information your are presenting (versions, server info, etc).

If you want to improve security with obscurity (not only thought it, but as an addtional measure), this document gives some ideas:

share|improve this answer

Ensure you haven't set the file permissions to 'chmod 777' as some guides will have you do. Go through and look at anything your web server account or group can write to, and ensure that they are only areas you expect to be dynamically updated (images, attachments, etc).

share|improve this answer
+1 All that and make sure the web server itself is as secure as you can make it. – John Gardeniers Jul 20 '09 at 22:08

Only login over an SSL connection.

If you go into a coffee shop and login at your password is sent in clear text and is easily visible to anyone sniffing the network in the coffee shop and all routers between you and the server.

If you move your blog login page to a secure server and force users to login using SSL at the password will be encrypted as it is sent to the server.

You can either add some PHP code to wordpress something like this

      && $_SERVER['HTTPS']!='ON')

or use a .htaccess file to enforce SSL login which would look something like this:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
share|improve this answer
Very good idea. I have been wanting to do this. Thanks! – Mike Grace Jul 26 '09 at 14:17
Same here - never even realized my wp-admin is not https. – Artem Russakovskii Oct 5 '11 at 17:09
Btw, a much better option for this is described here: Just enable define('FORCE_SSL_ADMIN', true); in the config. – Artem Russakovskii Oct 6 '11 at 6:16

Some people rename pages like wp-admin.php to reduce probing.

share|improve this answer

Secure your /wp-admin/ directory. Lock down /wp-admin/ so that only certain IP addresses can access that directory. You can use an .htaccess file, which you can place directly at /wp-admin/.htaccess . This is what one could look like:

AuthUserFile /dev/null
AuthGroupFile /dev/null
AuthName “Access Control”
AuthType Basic
order deny,allow
deny from all
# whitelist home IP address
allow from
# whitelist work IP address
allow from
allow from
# IP while in Kentucky; delete when back
allow from


share|improve this answer
Very good idea unless I am going to be traveling. Thank you for your good idea. – Mike Grace Jul 26 '09 at 14:18
An equally good idea would be to just secure the same dir with an htpassword. – Artem Russakovskii Oct 5 '11 at 17:09

Make sure that your WordPress installation is up to date. Keep up on the RSS and check up on the updates no less than weekly.

If there's an update, begin the installation process at the earliest possible time for you, obviously without disrupting business, if that's what you are using WP for.

share|improve this answer
Thank you. This is important. – Mike Grace Jul 21 '09 at 3:40

Use a unique username/password for your database connection.

share|improve this answer
there's no problem there since I use 1password to generate my passwords like "xZcHkTfDTu2N4EwDFJom26Pm9G8KLmyXx9Bf7YLA3GD7FzztPd" ; ) – Mike Grace Jul 20 '09 at 22:27
Thats better then 99% of the folks out there. I've seen root so many times it makes me sick – Mark Turner Jul 20 '09 at 23:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.