suche verständliche und aktuelle Anleitung zum Absichern der WP Version

http://das365tageexperiment.com/150/wordpress-…cess-absichern/

http://www.news-blogging.de/wordpress/word…sichern-koennt/

https://www.youtube.com/watch?v=NWtCkgNzh4g

https://www.youtube.com/watch?v=txJpZYF3rds

[COLOR=#444444][FONT=arial]hey ich habe hierzu einiges zusammengeschrieben allerdings in Engl. sollte aber trotzdem okay sein :)
.. to secure wordpress websites i have following tipps, it saves a lot of trouble and work to secure the blogs[/FONT][/COLOR]
[COLOR=#444444][FONT=arial]if you need help with any of those messures ask me.
onlinemarketing@hatzak.de
Onlinemarketing hatzak[/FONT][/COLOR]
[COLOR=#444444][FONT=arial]

my recoommendations:[/FONT][/COLOR]
[COLOR=#444444][FONT=arial]- Your Wordpress Version should be newest! update!

- Theme Version should be updated

- Protection via robots.txt and .htaccess see below (including codes)
[/FONT][/COLOR]
[COLOR=#444444][FONT=arial]- Prevent access via .htaccess files in the

1. [/FONT][/COLOR].htaccess and .htpasswd in [COLOR=#444444][FONT=arial]root folder to secure the wpconfig

2. [/FONT][/COLOR].htaccess in [COLOR=#444444][FONT=arial]admin folder

3. [/FONT][/COLOR].htaccess in [COLOR=#444444][FONT=arial]content and include folder
[/FONT][/COLOR]
(codes see at the end of the text)

[COLOR=#444444][FONT=arial]- WP Database Prefix (wp_)
If you install Wordpress newly dont choose wp_ as the database prefix. if you already did so change it with the security Plugin[/FONT][/COLOR]
[COLOR=#444444][FONT=arial]"WP Security Scan"[/FONT][/COLOR]
[COLOR=#444444][FONT=arial]
- Admin
always use a different Name!! never admin or Admin ! if you already have the username admin -> create a second administrator
- login with the 2nd account and delete the first "admin" account[/FONT][/COLOR]
[COLOR=#444444][FONT=arial]
Install the WP-Plugins (highly recommended):
- WP Security Scan
- Limit Login Attempts
- Secure WordPress
- timthumb-vulnerability-scanner[/FONT][/COLOR]
[COLOR=#444444][FONT=arial]addional WP Plugins
- BackupPlugin
- antivirus
- Exploit Scanner
[/FONT][/COLOR]
[COLOR=#444444][FONT=arial]3. Malware scanning:
- Use the google webmastertool and register your website to get infos about malware
- http://www.urlvoid.com/
[/FONT][/COLOR]
Use secure passwords like "Aadsdf7123!4!$"

[COLOR=#444444][FONT=arial]Change your passworts of your FTP, E-Mailaccount and Admin Account regularly and use secure long passworts ,e.g: Asdfalk123!?$

infos about robots.txt and .htaccess server defense!

ROBOTS.TXT
put a robots.txt in your main folder of the WP installation via FTP including the codes to deny important information for badass crawlers. Your content with this robots is still available for Google index etc. :
if you have a sitemap.xml add this code too:
Sitemap: http://yoururl/sitemap.xml

--------
User-agent: *
Disallow: /cgi-bin
Disallow: /wp-admin
Disallow: /wp-includes
Disallow: /wp-content/plugins
Disallow: /wp-content/cache
Disallow: /wp-content/themes
Disallow: /trackback
Disallow: /comments
Disallow: /category/*/*
Disallow: */trackback
Disallow: */comments
Disallow: /*?*
Disallow: /wp-*
Disallow: /*?
Allow: /wp-content/uploads
# Google Image
User-agent: Googlebot-Image
Disallow:Allow: /*
# Google AdSense
User-agent: Mediapartners-Google*
Disallow:
Allow: /*
# Internet Archiver Wayback Machine
User-agent: ia_archiver
Disallow: /
# digg mirror
User-agent: duggmirror
Disallow: /

.htaccess files should be in your
1. root folder with a .htpasswd File
2. admin folder
3. Content folder
4. includes folder
Including those codes:

1. root folder with a .htpasswd File

.htaccess in root folder

#protect wpconfig.php
<files wp-config.php>
Order deny,allow
deny from all
</files>
# END protect wpconfig.php
<Files wp-login.php>
AuthName "Admin-Bereich"
AuthType Basic
AuthUserFile /home/HEREGOESYOURSERVERDOMAINADRESS/.htpasswd
require valid-user
</Files>
<FilesMatch "(\.htaccess|\.htpasswd|wp-config\.php|liesmich\.html|readme\.html)">
order deny,allow
deny from all
</FilesMatch>

.htpasswd
should include a encripted user - password kombination
http://www.htaccesstools.com/htpasswd-generator/

2. [/FONT][/COLOR].htaccess[COLOR=#444444][FONT=arial] in [/FONT][/COLOR][COLOR=#444444][FONT=arial]admin folder
AuthUserFile /home/HEREGOESYOURSERVERDOMAINADRESS/.htpasswd
AuthType Basic
AuthName "Admin-Bereich"
Order Deny,Allow
Deny from all
Require valid-user
Satisfy any

3.[/FONT][/COLOR].htaccess[COLOR=#444444][FONT=arial] in [/FONT][/COLOR][COLOR=#444444][FONT=arial] Content folder
Order deny,allow
Deny from all
<Files ~ ".(php|xml|css|jpe?g|png|gif|js)$">
Allow from all
</Files>

4. [/FONT][/COLOR].htaccess[COLOR=#444444][FONT=arial] in [/FONT][/COLOR][COLOR=#444444][FONT=arial]includes folder
Order deny,allow
Deny from all
<Files ~ ".(xml|css|jpe?g|png|gif|js)$">
Allow from all
</Files>

Hope that helps you to make your Homepage saver against attacks!!!
cheerio
Matthias Hatzak
onlinemarketing@hatzak.de
http://hatzak.de

[/FONT][/COLOR]