While on the topic of WordPress, I thought I’d share 2 simple and quick tips to help secure your WordPress blog installation.

Security Task 1
The first tip is one you should have done when you installed WordPress, but is easy to skip over and not do. This task is to remove the install program. If not, you run the risk of someone trying to reinstall your blog or what is more likely using it to get information about your account and server to hack your database. To remove the install program do the following steps:

1. Log into your hosting account control panel
2. Open the file manager and traverse to your blog/wp-admin directory
3. Find the install.php file and delete it. If you wish you can download it to your computer first if you are paranoid about having a copy.

Security Task 2
The second task involves your blogs database security. WordPress, along with many other web programs, place their database settings in the configuration file that resides within the web directory. For WordPress, that file is wp-config.php and it resides in the root blog directory.

In most instances nothing will ever come of this although it is a major security risk. What can happen is that for some reason your blog does not work and displays the actual php code, you just exposed your database settings to a potential hacker. They can use this to delete or edit your content very simply. To fix this, do the following:

1. Log into your hosting account control panel
2. Open the file manager and traverse to your blog root directory
3. Edit your wp-config.php file
4. Find the lines of code that contain your MySQL settings. They’ll look similar to the following example code. Leave this window open for later use.
   

   // ** MySQL settings ** //
   define(‘DB_NAME’, ‘putyourdbnamehere’); // The name of the database
   define(‘DB_USER’, ‘usernamehere’); // Your MySQL username
   define(‘DB_PASSWORD’, ‘yourpasswordhere’); // …and password
   define(‘DB_HOST’, ‘localhost’); // 99% chance you won’t need to change this value

5. Copy these MySQL setting lines so you can put then into a new file outside of your web root directory. For example, your account directory when you log into your file manager is /home/youraccount. The web root would most likely be /home/youraccount/www or /home/youraccount/public_html.
6. Create a new file in /home/youraccount directory. You can name the file whatever you wish, just make sure it ends in .php as shown in the example. For this example the name to use is blog.database.php
7. Open blog.database.php and insert the lines copied in step 4 above as follows:
   

   <?php
   // ** MySQL settings ** //
   define(‘DB_NAME’, ‘putyourdbnamehere’); // The name of the database
   define(‘DB_USER’, ‘usernamehere’); // Your MySQL username
   define(‘DB_PASSWORD’, ‘yourpasswordhere’); // …and password
   define(‘DB_HOST’, ‘localhost’); // 99% chance you won’t need to change this value
   ?>

   Notice the 2 additional lines, 1 at the beginning and 1 at the end. This tells the web server to run this file as PHP code. If you don’t put these lines in the file, you will again have your database information shown in plain text in the browser. An additional tip here, DO NOT leave a blank line after the final ?>. If you do, you will have unexplained issues in your WordPress Control Panel, particularly in the Presentation and Plug-In screens (and yes, I found that out the hard way).

8. Go back to your wp-config.php window and remove the MySQL setting lines now and replace them with the following:
   

   require_once( ‘/home/youraccount/blog.database.php’ );

9. Test your blog to make sure everything still works. If it does not, retrace the steps here to make sure you don’t have any misspellings and everything is correct before trying again. Linux is case sensitive, so also ensure the capitalization is correct. I would suggest going all lowercase anyway for simplicity.

These steps are simple, but effective in protecting your blog. Of course these won’t protect against every attack, but they go along way in protecting you. In addition, in case of a disaster you still have the backup that you can restore. Hopefully , you’ll never need any of these tips. However, it is better to be prepared just in case.