Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I need a safe place where I can store data about projects that I am working on. This data includes text and files (pictures, sound and video).

I want to create a private "blog" for this purpouse that is accessible only by myself.

The reason behind this is that I can access the data from anywhere, the solution is platform independent, searching the data should be easy using the Wordpress search bar and metadata can be added to all the uploaded files.

My only concern is security - what are my options in securing the contents of the web repository?

The problems I am still facing: If someone breaks past .htpasswd (by brute forcing it, is there a way to block access to the server for a day after several tries at htpasswd?) all uploaded files (images, sounds and movies) can be accessed if the attacker can guess the direct url for the file.

My vision is to use .htaccess for 80% of the security measures - it is Wordpress independent and should survive software upgrades.

But I am really unsure about all the potential holes that I have to plug in Wordpress.

Can you point out other security issues that I have missed and ,ideally, also a solution for them?

share|improve this question
    
You can restrict access to users who have an account in your WordPress install: wordpress.org/plugins/wordpress-access-control You can extend upon that with 2 factor authentication. –  itrogers Apr 14 at 20:56
    
Thanks, but as I said I would like to not use any third party plugins of possible + if I mark the post as private no one has access to the post except me. –  SkyHiRider Apr 14 at 20:58

1 Answer 1

My security solutions so far:

Wordpress

  • Make all new posts private (in Wordpress)
  • Don't use any modules, the more third party software I add the less secure the repo becomes
  • Two factor authentication ( this would break the no third party module rule above)

Apache

  • Force https (in .htaccess)
  • Protect web repository using .htpasswd (in .htpasswd)
  • Two factor authentication (not sure if it can be done on a server level? )
  • Allow access to server only from my country (in .htaccess)
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.