Author: Chris

WordPress & Security Notes From The St. Louis WordPress Developers Meetup

This week at the The St. Louis WordPress Developers Meetup we discussed tips and tricks on how to ensure your WordPress installations are as secure as possible. I’ve collected my notes below.

For further reading, check out Eric Juden’s notes as well.

Things you can do “Out of the Box”

  • Check the Codex for some general tips on Hardening WordPress.
  • Check your file permissions to make sure they are as secure as possible.
  • Change default “wp_” prefix to something unique. This is used by MySQL injections that search specifically for “wp_” (As Ken Johnson points out in the comments of the WordPress Meetup, this is probably only a good idea on new installations!)
  • Delete Default Admin account. You should never post from admin as it looks dorky and gives away that you’re using WordPress.
  • Use strong passwords! Don’t give clients the same lame password over and over. Be unique.
  • Delete unused themes and plugins. They just take up space and are yet another vector for attacks.
  • Use Akismet for managing comment spam. Not exactly security, but part of decreasing the amount of time you dedicate to meddlesome maintenance.
  • Hide your version number and change the readme.html file to something random. Nefarious people are looking for easy targets, changing things up a bit makes these automated attacks more difficult to pull off.
function remove_wp_version() {
     return '';
}
add_filter('the_generator 'remove_wp_version');

 

  • Change Salts often – you can even use this handy tool to generate new ones – https://api.wordpress.org/secret-key/1.1/salt/
  • Move wp_config.php to the directory above public_html. If they can’t get to it via the web, they can’t see your database username/password or salts.
  • Update your stuff. Here’ a list of security fixes just in 3.5.1 alone!
    • Server-side request forgery (SSRF) and remote port scanning via pingbacks. Fixed by the WordPress security team.
    • Cross-site scripting (XSS) via shortcodes and post content. Discovered by Jon Cave of the WordPress security team.
    • Cross-site scripting (XSS) in the external library Plupload. Plupload 1.5.5 was released to address this issue.
  • Find a good, respectable host! someone who keeps up with new version of PHP, MySQL, etc. – not GoDaddy.
  • When all else fails, having a good backup will be your last line. Test your backup regularly.

 

Extra Things You Can Do

Some useful plugins that can help give a piece of mind or help with managing WordPress.

 

Further Reading

http://www.netmagazine.com/tutorials/protect-your-wordpress-site-htaccess

http://wpsecure.net/secure-wordpress-advanced/

 

Themes Mentioned During the Chat

 

Join Us

If you’re thinking about attending one of the meetings I encourage you to do so. The diversity of knowledge and skill sets almost guarantees that there’s something new to learn. Everyone is approachable and there to share and grow together.

All your Facebook Friends are Photographers and That’s OK

I saw this question/rant on Reddit the other day that perturbed me enough to write a long-ish response.

The gist is that people who buy a DSLR and start taking on paying gigs aren’t photographers. Or at least they rubbed against the grain of the OP (Original Poster).

I disagree, and in fact this kind of rhetoric appears far too frequently in the few photography communities I participate in.

My reply:

The levels of skill in photography are many. I imagine it’s daunting to someone who’s never used a camera (much less a DSLR, in manual mode, editing raw, with multiple lenses, flash/strobe, etc etc.) to understand what goes into taking a good photograph. There’s the obvious technical know how, but also the aesthetic eye for good composition.

Now, that said, to be someone who takes photographs better than 99% of the population takes a small elevation in skill. A very small but noticeable blip. You take a class or two, pick up a few books, buy some nice kit, practice, practice practice. Bam, you’re now able to have a few photos that look better than most people could ever imagine taking. Now you’re better than most people you’ll ever know.

To go from the folks you’re describing to say Ansel Adams or Annie Liebovitz level of quality is many, many blips of improvement.

For most of us here, we’ve got a few blips – gained a few levels. Some more than others. But to most people we’re all lumped in a category of “Are you a wizard ?” when it comes to this stuff. And frankly, it’s hard for a non-photographer to see who’s a newbie starting out and who’s been doing this for 20 years.

You use the word worse, which has negative connotation. In the words of a man with a few more blips than I, True professionals don’t fear amateurs.

Being a professional is more about showing up and doing a job than having the best skills or resources. You can accomplish more with a great work ethic, networking and producingsomething. If these people are getting work, great. If they’re learning, even better! Are they making things ‘worse’? Cheapening the ‘art of photography’? Pfffttttt. They show up, they take photos better than most people could and they get paid.

Everyone has to start somewhere. It’s those that stick with something that improve – themselves, their work, their community, the art form, et al. – that are the folks to admire and encourage. Being frustrated, worrying about the negative potential is useless. It’s a windmill to ignore.

Instead I say help them, encourage them. Be a good mentor (as you mentioned doing) and help elevate anyone willing to show up and put in the work. Not enough people do that, and instead post silly stuff like this, that I feel worsens our collective attitude to those that share a similar interest.

tl:dr; It’s late and I should go to bed.

—-

Since writing that, I have thought more about this.  Anyone can be a professional photographer. As with every skill and industry, there’s always going to be a great gradation in the quality, skill and, proliferation of work. Some people you might find on Facebook or Craigslist – or even people recommended to you! – might totally suck. But not starting, not putting yourself out there? That’s what worries me.

More people should pick up a camera and see what they can do with it1. If they get a paying gig, great! If they do a bad job? Well that would suck. But like I state in my reply, even a low quality photographer is better than most people. And people are willing to pay and admire those with skills they lack.

So what happens to ‘bad’ photographers? I would like to believe that they will get better. We need more bold people to try than people who never try at all.

I encourage you to take a look at the full conversation over on Reddit. There’s some interesting dialog and viewpoints. If you have your own thoughts, please share them.