Based on the passion engendered with the responses to this question. It appears that the answer is a resounding "Nothing!" or "leave it to plugin developers to handle, WP is already secure enough"...

So I guess I'm way off base with the question? It appears to have stirred a hornet's nest and that was not the intent. Never the less, here's the real world outcome...

I just got an email from one of my customers who had 12 of his sites hacked because an attacker cracked his password. His comments opened my eyes a bit to the possibilities for some very easy options that could be added to the WordPress core in order to help make WP sites less prone to these kinds of attacks.

The simplest thing a user can do is to change the default username. I would guess that over 90% of live WP sites have an "admin" user profile that may or may not be used, but that obviously has full rights and permissions. An attacker's job is already half done!

But WP core could be enhanced with some very simple security options too. How hard would it be to add...

  • Failed login attempts lockout (user defined setting)
  • Regulate the time between failed login attempts (user defined setting in seconds)
  • IP range restriction (set a list of IPs from which logins are accepted)

These are just a few things off the top of my head. I'm sure you guys have some better options too.

And the point of my question is not what "users" should do to enhance security, that's a whole other question. I'm asking what steps WP could take to provide some OPTIONS, nothing mandatory, but things that plugin developers are currently having to fill gaps where stuff should be part of every default WP installation (IMHO).

Are any of these kinds of enhancements planned for near term WP releases?

  • I downvoted because of the question title. I think WordPress is serious about security. – Travis Northcutt Feb 17 '11 at 13:18
  • This question is difficult to answer, because it is speculative about possible future actions of WordPress. It would be better to re-phrase it as "what can I do to improve the security of my WordPress installation?", but I believe we already have such a question. – Jan Fabry Feb 17 '11 at 13:19
  • @Jan: good suggestion. How about "What can WordPress do to enhance security of installations?" – Scott B Feb 17 '11 at 13:46
  • 1
    Downvoted due to the sere obsecurity of it, there is no right answer. Which a few of the things been suggested in the question would just become annoying to the user aswell as barely used. Extra security such as those should be a thing for plugins and httpd configurations. – Backie Feb 17 '11 at 14:07
  • Is there any framework that just says, "Aaah screw security - our community will probably take care of it?" I feel like security is a primary tenant of EVERY noteworthy framework. If the WordPress Core developers identify a security enhancement to be made they make it. I think the title would be better phrased as, "Should Optional Security Measures be Added to Core?" – bosco Dec 31 '13 at 21:46

RE: Username - admin

Since version 3.0 the installer asks the user to provide a username for the main account, you obviously won't get this option if you upgrade from an older version(because it's not a new installation).

You can see an image of this here:

RE: Blocking malicious users

There's no real effective way to do it, because any information you can obtain and hold about a user can be spoofed and changed within moments, you run the risk of blocking legitimate users.

RE: Failed login attempts

This could be useful, but there's always the possibility a malicious user locks out an admin(or another user) from their own installation simply by purposely trying to login to that user's account with invalid login credentials. Regulating the time between login attempts might help but in honestly any smart hacker would automate the procedure anyway and this becomes a moot point to some degree(but yeah sure, it will stop a few).

That's just my opinion on those specific points, take it as you will.. :)

|improve this answer|||||
  • @t3los: most WordPress sites have a single admin user. The admin login is what I'm proposing adding hardening options to. I'm only proposing this as an option, just like changing permalinks. Thanks for offering suggestions. – Scott B Feb 17 '11 at 14:45
  • @Scott B - What would you suggest is done to further secure admin accounts? – t31os Feb 17 '11 at 15:07
  • @t3los: I think the 3 things I've listing in the question would be sufficient as a start. And they would be things I could just "advise" customers to enable. Nothing mandatory. And when I say most sites have a single admin user, that's usually the ONLY user that has access to WP dashboard in my experience. – Scott B Feb 17 '11 at 15:21
  • @t3los: Just to clarify about admin users. I have ~1k customers that all use WP (and over 10k WP installations among those customers). Over 95% of them have exactly 1 user in the Users table, and in almost 100% of those cases, its the admin user. – Scott B Feb 17 '11 at 15:24
  • Yes, but as i said before, there's potential for some measures to have negative impacts on the experience of a legitimate user(and little inconvenience to the savy hacker). Renaming the main account is always worth doing though, as covered in the Hardening WordPress documentation: codex.wordpress.org/Hardening_WordPress , which is a good source of information on securing a server(well it's at least a good place to start anyway). – t31os Feb 17 '11 at 15:45

I assume you had never dealt with considerably large user base of something under tight login security? It's not pretty... :)

Login changes you propose will:

  1. Do little about security, because most of hacks are from outdated versions and poor server security, not bruteforced logins.

  2. Generate more negative feedback from users than security issues ever did and ever will.

The thing is that WordPress only works as part of web server stack. There is only so much it could do about security and blanket measures will do more harm than good in most cases.

WordPress takes care of everything it can and is plugin-driven to add and configure what you specifically need. It is hard to jump higher than this.

|improve this answer|||||
  • In most cases, these are small sites with one admin user. The options I'm proposing are not mandatory and would be user defined as an extra level of security. In the case of my customer, any of the 3 options I suggested would have likely prevented the simple breach of the admin password. I can't say the hacker would have "just moved on", however, it was way too easy. – Scott B Feb 17 '11 at 14:43
  • @Scott B how is enabling non-mandatory option different from installing plugin that does same thing? I understand your point that it could be included in core. But I also understand that this is not something WordPress must do and neither this is something that can't be done already. – Rarst Feb 17 '11 at 15:03
  • it goes to the level of sophistication of the user. Granted, they should know these things, but most take it for granted that WP is already securing their sites against simple password hacking. So if they knew how easy it was, with a default WP install, to crack the admin password, perhaps they would do as you suggest and search for the plugin and install it. Most never know until its too late. – Scott B Feb 17 '11 at 15:07

If your customer had 12 sites get hacked then one of two things needs to happen: either he needs to get a better host, or he needs to stop creating security holes in his sites.

WordPress doesn't need to do any of the things you suggested because they either already have (you can choose your own admin username at install), or the use-case doesn't dictate it. As t31os pointed out, while those things could be useful, they could also be used by hackers as a weapon against the admins.

Not enough people need or want those security measures to even justify them as an option in core.

Technically, they are an option in core:

Go to Plugins --> Add New, search for 'Login Lockdown' and install.

|improve this answer|||||
  • thanks for the suggestion for "Login Lockdown". I will consider recommending it to my users. Although I think it should be built into core as an "Option", setting. – Scott B Feb 17 '11 at 14:48
  • +1 for making a helpful suggestion (forgot to do that on my original comment). – Scott B Feb 17 '11 at 16:18

WordPress is the most popular and widely used blogging platform. It supports every kind of website, from a simple blog to a full-featured business website. Twenty-six percent of all websites globally use WordPress. As a result of this popularity, hackers and spammers have taken keen interest in breaking the security of WordPress operated sites.

In January 2017 alone, WordFence reported an average of 26 million brute force attacks against WordPress websites per day.In the same report they recorded more complex, targeted attacks at an average of 4.7 million per day for the same time frame. That’s a lot of people and bots up to no good. The security of your WordPress website is a big deal, and a good place to start securing it is at the login screen.so let’s get started on making your WordPress site’s login page a little bit more secure.

1. Don’t use admin as a username This is perhaps the easiest baseline step for WordPress security you can take as a WordPress user. It costs you nothing, and the install makes it easy to do. A majority of today’s attacks target your wp-admin / wp-login access points using a combination of admin and some password in what is known as Brute Force attacks. Common sense would dictate that if you remove admin, you’ll also kill the attack outright.

Simply create a new user in WordPress at Users > New User and make that a user with Administrator rights. After that, delete the admin user. Don’t worry about the post or pages the admin user has already created. WordPress will nicely ask you: “What should be done with content owned by this user?” and give you the option to delete all content or assign it to a new user, like the one you have just created.

2.Use a Strong Password

Brute forcing login pages is one of the common form of web attacks that your website is likely to face. If you have an easy to guess password or username, your website will almost certainly be not just a target but eventually a victim.

Play around with the website’s passwords and change them regularly. Improve their strength by adding uppercase and lowercase letters, numbers, and special characters. enforce strong passwords on all your users

3.Limit login attempts This is one incredibly simple technique to stop brute force attacks on your login page right in their tracks. A brute force attack works by attempting to get your username and password right by trying multiple combinations over and over.

If the particular IP which is perpetrating the attack is tracked, then you can block out the repeated brute forcing attempts and keep your site secure. set Limit Login Attempts for prevent brute force attack.

4.Stay up-to-date Very large percentage of the website hacks came from out-of-date, vulnerable, versions of plugins.

Every good software product is supported by its developers and gets updated now and then, but WordPress is updated very frequently. These updates are meant to fix bugs and sometimes have vital security patches.

So update your WordPress, plugin, Thames regularly.

5. Back up your site regularly No matter how secure your website is, there is always room for improvements. But at the end of the day, keeping an off-site backup somewhere is perhaps the best antidote no matter what happens.

If you have a backup, you can always restore your WordPress website to a working state any time you want. There are some plugins that can help you in this respect.

WP All Backup plugin helps you to create Backup and Restore Backup easily on single click.Manual or Automated Backups And also store backup on safe place- dropbox,FTP.

Creates a Backup of your entire website: that’s your Database, current WP Core, all your Themes, Plugins and Uploads.

The WP ALL Backup gives WordPress administrators the ability to migrate, copy or clone a site from one location to another. If you need to move WordPress or backup WordPress this plugin can help simplify the process.

6.Set strong passwords for your database A strong password for the main database user is a must – the one WordPress uses to access the database.

As always, use uppercase, lowercase, numbers, and special characters for the password.

7.Set up website lockdown and ban users A lockdown feature for failed login attempts can solve a huge problem, i.e. no more continuous brute force attempts. Whenever there is a hacking attempt with repetitive wrong passwords, the site gets locked, and you get notified of this unauthorized activity.

WP User WordPress plugin has mechanism for slow down brute force attack, Limit Login Attempts, Notify on lockout, Password Regular Expression, Google reCAPTCHA, Login Log, Approve/Deny User, Auto / Email Approval user.

|improve this answer|||||

Not the answer you're looking for? Browse other questions tagged or ask your own question.