Three Awesome Wordpress Plugins to Guard Against Hacking

[Greg Borchardt - Web Designer]

Not too long ago, I wrote an article that came about after someone from Russia tried hacking into one of my Wordpress websites. I initially used the Limit Login Attemtsplugin, (I highly recommend this to anyone who has or makes Wordpress websites) which allows me to limit the number of login attempts and eventually locks the person out after reaching the limit. I initially thought, “Great, now that this person has been locked out for 24 hours, he will get frustrated and move on to someone else’s computer.”

I was wrong.

That person kept trying for another couple days. He would get locked out for 24 hours and then try again, day after day. So, I decided to step things up a bit. I found a plugin called VSF Simple Blockthat automatically redirects a selected IP address to another website. So, I started thinking, “Where can I redirect this guy?”

I chose God.com.It is an old website that only has a few basic pages and is not a Wordpress website (I checked).

Not too long ago, I checked the log of this plugin, which showed that he had been redirected to that website about a dozen times for a couple days before giving up.

Or, perhaps, he found God.

Another good plugin I came across to help guard against people from hacking into Wordpress websites is the WebsiteDefender WordPress Security plugin.  It scans and monitors Wordpress websites for security issues, is easy to use and it is free! I ran it on one of my Wordpress websites and it told me that the database table prefixwas still the default "wp-" which is a major no-no for Wordpress users who want to help keep their websites from being hacked.  The best part is that I could choose to let it change the prefixes for me instead of me doing it manually.  That alone is a time-saver!

At any rate, those are some great plugins to use to help guard against hackers.

Thank you to chanpipat/FreeDigitalPhotos.net for the image on this page.

[Michelle Gower-WordPress Mentor]

Greg, that wasn't a person, it was a bot. Bots are scripts that are programmed to go out and crawl websites looking for ways to get in (usually by way of registering itself as a new user or trying to leave a spam comment) and the only 'person' involved is the jackhole who wrote the script.

Limit Login is great, but note it cannot prevent a bot from registering with your site.

IP blocking is wonderful as it can damage your traffic stats if it gets out of control.

Good post!

Gower

[Greg Borchardt - Web Designer]

Yes, I realized that later - this was my first experience with someone (or, thing) trying to hack into one of my Wordpress sites. The script was trying to login with the default "admin" username and likely trying zillions of password combinations. Luckily, I use a unique username.

Greg

[Colleen Gray, The Boomers' VA]

Thanks for the information Greg. That area is definitely not my expertise!! Yours too M!