Tell me more ×
WordPress Answers is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.
up vote -3 down vote favorite

Based on the passion engendered with the responses to this question. It appears that the answer is a resounding "Nothing!" or "leave it to plugin developers to handle, WP is already secure enough"...

So I guess I'm way off base with the question? It appears to have stirred a hornet's nest and that was not the intent. Never the less, here's the real world outcome...

I just got an email from one of my customers who had 12 of his sites hacked because an attacker cracked his password. His comments opened my eyes a bit to the possibilities for some very easy options that could be added to the WordPress core in order to help make WP sites less prone to these kinds of attacks.

The simplest thing a user can do is to change the default username. I would guess that over 90% of live WP sites have an "admin" user profile that may or may not be used, but that obviously has full rights and permissions. An attacker's job is already half done!

But WP core could be enhanced with some very simple security options too. How hard would it be to add...

  • Failed login attempts lockout (user defined setting)
  • Regulate the time between failed login attempts (user defined setting in seconds)
  • IP range restriction (set a list of IPs from which logins are accepted)

These are just a few things off the top of my head. I'm sure you guys have some better options too.

And the point of my question is not what "users" should do to enhance security, that's a whole other question. I'm asking what steps WP could take to provide some OPTIONS, nothing mandatory, but things that plugin developers are currently having to fill gaps where stuff should be part of every default WP installation (IMHO).

Are any of these kinds of enhancements planned for near term WP releases?

share|improve this question
I downvoted because of the question title. I think WordPress is serious about security. – tnorthcutt Feb 17 '11 at 13:18
This question is difficult to answer, because it is speculative about possible future actions of WordPress. It would be better to re-phrase it as "what can I do to improve the security of my WordPress installation?", but I believe we already have such a question. – Jan Fabry Feb 17 '11 at 13:19
@Jan: good suggestion. How about "What can WordPress do to enhance security of installations?" – Scott B Feb 17 '11 at 13:46
Downvoted due to the sere obsecurity of it, there is no right answer. Which a few of the things been suggested in the question would just become annoying to the user aswell as barely used. Extra security such as those should be a thing for plugins and httpd configurations. – Backie Feb 17 '11 at 14:07

3 Answers

up vote 3 down vote accepted

RE: Username - admin

Since version 3.0 the installer asks the user to provide a username for the main account, you obviously won't get this option if you upgrade from an older version(because it's not a new installation).

You can see an image of this here:
http://codex.wordpress.org/Installing_WordPress#Step_5:_Run_the_Install_Script

RE: Blocking malicious users

There's no real effective way to do it, because any information you can obtain and hold about a user can be spoofed and changed within moments, you run the risk of blocking legitimate users.

RE: Failed login attempts

This could be useful, but there's always the possibility a malicious user locks out an admin(or another user) from their own installation simply by purposely trying to login to that user's account with invalid login credentials. Regulating the time between login attempts might help but in honestly any smart hacker would automate the procedure anyway and this becomes a moot point to some degree(but yeah sure, it will stop a few).

That's just my opinion on those specific points, take it as you will.. :)

share|improve this answer
@t3los: most WordPress sites have a single admin user. The admin login is what I'm proposing adding hardening options to. I'm only proposing this as an option, just like changing permalinks. Thanks for offering suggestions. – Scott B Feb 17 '11 at 14:45
@Scott B - What would you suggest is done to further secure admin accounts? – t31os Feb 17 '11 at 15:07
@t3los: I think the 3 things I've listing in the question would be sufficient as a start. And they would be things I could just "advise" customers to enable. Nothing mandatory. And when I say most sites have a single admin user, that's usually the ONLY user that has access to WP dashboard in my experience. – Scott B Feb 17 '11 at 15:21
@t3los: Just to clarify about admin users. I have ~1k customers that all use WP (and over 10k WP installations among those customers). Over 95% of them have exactly 1 user in the Users table, and in almost 100% of those cases, its the admin user. – Scott B Feb 17 '11 at 15:24
Yes, but as i said before, there's potential for some measures to have negative impacts on the experience of a legitimate user(and little inconvenience to the savy hacker). Renaming the main account is always worth doing though, as covered in the Hardening WordPress documentation: codex.wordpress.org/Hardening_WordPress , which is a good source of information on securing a server(well it's at least a good place to start anyway). – t31os Feb 17 '11 at 15:45
show 2 more comments
up vote 2 down vote

I assume you had never dealt with considerably large user base of something under tight login security? It's not pretty... :)

Login changes you propose will:

  1. Do little about security, because most of hacks are from outdated versions and poor server security, not bruteforced logins.

  2. Generate more negative feedback from users than security issues ever did and ever will.

The thing is that WordPress only works as part of web server stack. There is only so much it could do about security and blanket measures will do more harm than good in most cases.

WordPress takes care of everything it can and is plugin-driven to add and configure what you specifically need. It is hard to jump higher than this.

share|improve this answer
In most cases, these are small sites with one admin user. The options I'm proposing are not mandatory and would be user defined as an extra level of security. In the case of my customer, any of the 3 options I suggested would have likely prevented the simple breach of the admin password. I can't say the hacker would have "just moved on", however, it was way too easy. – Scott B Feb 17 '11 at 14:43
@Scott B how is enabling non-mandatory option different from installing plugin that does same thing? I understand your point that it could be included in core. But I also understand that this is not something WordPress must do and neither this is something that can't be done already. – Rarst♦ Feb 17 '11 at 15:03
it goes to the level of sophistication of the user. Granted, they should know these things, but most take it for granted that WP is already securing their sites against simple password hacking. So if they knew how easy it was, with a default WP install, to crack the admin password, perhaps they would do as you suggest and search for the plugin and install it. Most never know until its too late. – Scott B Feb 17 '11 at 15:07
up vote 2 down vote

If your customer had 12 sites get hacked then one of two things needs to happen: either he needs to get a better host, or he needs to stop creating security holes in his sites.

WordPress doesn't need to do any of the things you suggested because they either already have (you can choose your own admin username at install), or the use-case doesn't dictate it. As t31os pointed out, while those things could be useful, they could also be used by hackers as a weapon against the admins.

Not enough people need or want those security measures to even justify them as an option in core.

Technically, they are an option in core:

Go to Plugins --> Add New, search for 'Login Lockdown' and install.

share|improve this answer
thanks for the suggestion for "Login Lockdown". I will consider recommending it to my users. Although I think it should be built into core as an "Option", setting. – Scott B Feb 17 '11 at 14:48
+1 for making a helpful suggestion (forgot to do that on my original comment). – Scott B Feb 17 '11 at 16:18

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.