In the video I discuss some simple ways to secure your WordPress installation. These tips will help protect your site against most scripted/bot attacks, but likely won’t prevent a real hacker from getting in if he really wants…
The first thing I cover is changing your default admin username. This is pretty easy:
1. Use your MySQL administration tool (phpMyAdmin) to view your WordPress database.
2. Locate and select the wp_users table (or yourprefix_users) and click the browse icon.
3. Find your admin user and click on the edit icon.
4. Find the user_login column and replace “admin” with your desired name and click go.
You will need to use this new login name from now on. This step will protect against most scripted bruteforce attacks on your wp-login page as they will likely only attack admin and will never get in.
The next thing you should check out is AskApache.com’s .htaccess tutorials. These are for advanced users but offer easy ways to secure any Apache server. Every install is different, but these should be compatible with shared hosts as well.
AskApache has also created a very user friendly WordPress plugin that does most of the hard work for you. It’s called AskApache Password Protect but it does a lot more than set up passwords.
Another great resource for .htaccess security is Perishable Press’s Stupid htaccess Tricks. Here you will find tons of advanced tricks to secure your site and boost performance.
Perishable Press also maintains an .htaccess blacklist. This blacklist is WordPress compatible (though I did encounter problems with its default entries and Super Cache. It is updated fairly often and very easy to install. Just drop in and go.
Most of these tips will protect your site against automated attacks and give your average script kiddie a headache. Again, I must stress that these tips won’t prevent the dedicated hacker from getting in. To do that, you need a lot more protection in place, which many of us on shared hosting cannot get.
