Powerful Blog Security for dummies

Our host today is Alicia Mendez. If you're interested in getting in front of the readers of Site Sketch 101, check out our guest posting invitation here.

Blogs are windows that allow us to display whatever we want to the world. However, not all the visitors are friendly visitors and not all of them are happy with just a look, some of them may try to break the glass and play around with your files -wich can result in your site being replaced with a bad picture of an angry lama or in the lost of all your valuable information-.

Break-ins can happen to any of us, but no need to panic! Here are some easy tricks to prevent your blog becoming an easy target:

1. Choose a good web host.

Having a good secure host is the first step to have a secure site. Be sure that they know what to do in case of a break in and that you can count on them 24/4.

2. Use the latest version of your blog software.

Each new version of your blog software has less bugs and security holes than the last one. So keep it updated!

3. … and hide it!

The less you let know about your blog, the more secure it´ll be.

If using WordPress you can hide wich version you use putting this code into the functions.php file:

function hide_wp_vers()

{

return ”;

}

add_filter(‘the_generator’,'hide_wp_vers’)

Also, delete the readme files that come with your WordPress package and themes.

4. Get rid of your admin account!

If you use WordPress, you know that “admin” is the default user name for the administrator account – so does hackers. So go to your “Users” menu and create a new one with an administrator role. Then loging with your new account and delete the “admin” user (WP gives you the option to change the author of all your published posts, so don´t worry, they won´t be lost).

Also, delete any inactive account you may have in it.

5.Choose a bullet proof password.

A good passwords is easy for you to remember, but hard for others to guess it. Use more than one word and numbers, don´t use your blog´s name, your name, 123456 nor password.

Also, don´t tell anyone about it! Passwords are supposed to be s-e-c-r-e-t.

6. Get Security Plugins (for WordPress)

This is my Top 3 in Security Plugins -remember that having too many can slow down your site or create conflicts- but there are more than 20 available according to your needs:

WP Security Scan: This plugin checks your site´s files and directories permissions and passwords in order to find security holes and recommends how to fix them. It also removes the WordPress version information and offers database security.

http://wordpress.org/extend/plugins/wp-security-scan/

Login LockDown: If someone is trying to get in your blog by trying different passwords/user names Lock Down will record the IP adress and disable the login function for that IP. You can manage the times allowed to try to login in the control panel.

http://wordpress.org/extend/plugins/login-lockdown/

Secure WordPress: The thing I like the most of this plugin is that adds a fake index.html page for intruders to get it instead of your actual files. Besides it removes Error information on login page and removes the WordPress version, except in admin area.

http://wordpress.org/extend/plugins/secure-wordpress/

7. And make regular Backups.

Despite all, stuff happens, so make regular backups of your files in case you need to restore your blog – I hope you don´t have to, but better be safe-.