WordPress Security – Part 1

Name: WordPress Security – Part 1
Rating: 4.8 (12 reviews)

Manual Security: How to secure your web server, securely access your database and keep WordPress secure

Created byChristian Ruehringer, Wilhelm Laubach

Last updated 2/2023

English

English [Auto],

What you'll learn

Using publickeys instead of passwords logging in to a Linux system using SSH
Instead of using phpmyadmin, learning how to use DBeaver to connect to a MySQL server over an SSH tunnel
Configure nginx and Apache to serve WordPress using best practices
Fundamentals of keeping a WordPress installation secure

Course content

4 sections • 16 lectures • 33m total length

Why WordPress is perceived insecure0:40
Understand why WordPress is perceived insecure, recognize common attack vectors, and learn recovery after a hack using fundamental security principles.
Dangers of a hacked WordPress2:07
Explore the dangers of a hacked WordPress site, including hidden backlinks to sites like online casinos, altered ads, spam outbreaks, malware redirects, and command-and-control attacks that threaten rankings and liability.
Different attack vectors3:28
Upgrade WordPress server OS to a long-term supported version and keep PHP current. Defend against credential stuffing, enforce HTTPS, and use VPN on public Wi-Fi to prevent man-in-the-middle attacks.

The right hosting provider1:49
Choose the right hosting provider by assessing reputation, features, and automated DDoS protection, then verify ISO 2701 certification, audit history, and lessons from post-mortems.
Quick overview of the fundamentals1:12
Strengthen your WordPress security fundamentals by keeping the operating system up to date, automating updates, configuring a firewall, securing database access, hardening PHP execution, and implementing reliable backups.
Automate installation of security patches1:22
Set up automatic security patches across Linux distributions, with Debian/Ubuntu offering unattended upgrades and AlmaLinux, CentOS, and Red Hat requiring more setup, plus reminders for end-of-life dates.
Restrict access to SSH and SFTP4:12
Restrict ssh and sftp access with firewall controls in WordPress deployments, consider managed firewall options, and adopt public key authentication to prevent password vulnerabilities.
Configuring different kinds of firewalls6:21
Configure the Vultr firewall by creating a WordPress servers group, whitelisting your IP, and allowing http and https for both IPv4 and IPv6, then apply it to your Wiltshire instance.

Using DBeaver and SSH tunnels2:58
securely access your WordPress database by binding MySQL to localhost and using an ssh tunnel from your local machine; use DBeaver as the client and avoid phpMyAdmin.
Configuring your web server specific to WordPress2:59
Configure your web server to execute only WordPress PHP files and disable xml-rpc and directory listing. Block hotlinking, disable framing with same-origin frame options, and apply WordPress config changes immediately.
Fundamental WordPress security principles1:36
Master WordPress security principles by keeping core, themes, and plugins up to date, using unique usernames, strong random passwords with a password manager, and snapshotting your server for quick recovery.
Stay on top of things0:44
Establish a maintenance routine to secure WordPress by checking updates and server OS before end of life. Regularly review users, disable departed access, and enforce password changes every three months.

Make a backup after each change1:02
Always create a backup after every change to safeguard your WordPress site, and use snapshots for fast recovery before potentially breaking changes.
Configure regular snapshot taking1:07
Configure automatic backups and maintain manual backups to stay up to date after changes and with user-generated content, and avoid relying solely on automated backups.
Restore from a snapshot1:16
Select backup—automatic for recent hacks or the last known good standing/manual backup for older breaches—then lock down access with an external firewall, patch systems, change passwords, and create a backup.
Conclusion1:02
Secure connections with https everywhere, and deploy firewalls and vpn. Use a password manager, educate colleagues, enforce routines for updates and access control, revoke former members, and prepare worst-case scenarios.

Requirements

Basic understanding of Linux
Be comfortable with using the terminal
Know what WordPress is, installed it at least once before

Description

Get ready for a thrilling journey into the world of WordPress security! In this course, you'll gain a deep understanding of the most common attack vectors and how to protect your website from malicious actors.

You'll learn the crucial importance of applying fundamental security principles, as well as the steps to take if your site is ever hacked.

Discover why investing in security measures for WordPress is vital, including what to look out for during installation, the significance of long-term support, and the difference between weak and strong authentication mechanisms.

Explore the must-have features of a hosting provider, the power of backups as part of your security strategy, and the importance of automating security updates.

Take your security to the next level by restricting SSH, using firewalls, public key authentication, and connecting over an SSH tunnel using DBeaver.

Finally, you'll learn how to strengthen your web server configuration for maximum protection. Don't miss this opportunity to enhance your WordPress security knowledge and defend your website from cyber threats!

In short, in this couse we will highlight the following things:

Popularity of WordPress and common types of hacks
What to watch out for when installation a Linux system
The meaning of long-term support (LTS)
Weak credentials vs. strong authentication mechanisms
Why backups have to be a part of your security strategy
What features a hosting provider must have
Automation of security updates
Restricting SSH, using firewalls and public key authentication
How to use DBeaver to connect over an SSH tunnel
Strengthen your web server configuration

Who this course is for:

Aspiring systems administrators and jack of all trades WordPress developers

WordPress Security – Part 1

What you'll learn

Explore related topics

Course content

Common attack vectors explained3 lectures • 6min

Fundamental security principles on your hosting5 lectures • 15min

Applying fundamental security principles4 lectures • 8min

How to recover from a hack successfully4 lectures • 4min

Requirements

Description

Who this course is for: