WordPress login protection Archives - Complete WordPress Backup Service

November 7, 2016 by Ruby Paulson

Password Management for WordPress Users

Strong passwords can be difficult to remember… sometimes even impossible to remember (and passwords that are easy to remember are often weak). So what’s the way out of this conundrum? Storing passwords, of course! But which storage option is safe?

We’ve seen earlier that strong passwords are actually harder to remember than weak ones. And it’s not surprising… A strong password contains 15 or more characters. Enforcing a strong password for every site you log in to, might require some exceptional memory skills, or just a few handy hacks.

So how do you store strong passwords?

Well if memory-enhancing techniques don’t work, you could write them down, store them in a password-protected text file on your computer, or use a password manager.

How do you store your passwords?

Let’s look at the pros and cons of each of these password-storage techniques.

1. Writing down your passwords on paper

This is the old-school way that some people endorse thoroughly.

Pros

Your passwords can’t be stolen by hackers on the internet.

Cons

The book/paper you write your passwords in could be:

Stolen: Hackers might not be able to steal your credentials, but other people might. If anyone knew that you carried around your banking credentials in a little notebook, why wouldn’t they want to steal it? Sure, your FTP and phpMyAdmin passwords might not look as valuable as your banking credentials, but anyone could use your website to gain anything, even to steal your customers’ or investors’ information and sell it on the net.
Read by someone other than you: Of course to prevent this, you could write them down in a way that only you could understand, but then again, it would be almost impossible for this information to be passed down to anyone else without you explicitly explaining how to read the document. Besides, what would happen if you forgot how to read it?
Misplaced: What if you forgot where you put the important little booklet? You would have lost every single password to your website, and would have to reset them all, in which case, you’d have to have an alternative way to store them.

2. Storing your passwords in a password-protected file

This file could be kept on your computer, or on a portable storage device, such as a USB drive, or an external hard-drive.

Pros

Your passwords are less prone to being read by someone else, or lost.

Cons

You could forget the password protecting the file.
Hackers could use keylogging malware to know exactly what your password is.
Malware could corrupt the file so it’s not readable or retrievable, or so that the file keeps crashing.

3. Using a password manager

Password managers are programs or software that store all your passwords in a single place, in an encrypted form. It’s like having a password-protected file to store your passwords in that you need a very strong ‘master password’ to log into the Password Manager. However, password managers encrypt all your passwords before storing them either on your local computer, or on the cloud. This storage destination depends on the type of password manager you use.

There are three types of password managers. Firstly, there password managers that are offered as a bonus feature with a security product or another software (like extensions to antivirus software, or to browsers. Secondly, there are standalone password managing products which store your encrypted password on your computer (an example of this would be KeePass). Finally there are web-based password managers, which store your encrypted passwords in a location known to them, and hence provide the functionality of auto-filling up your password fields and even forms.

Password managers too have their own pros and cons.

Pros

This is the most obvious one: they allow you to use strong passwords without forgetting/losing them. Some password managers even generate strong, random passwords for you, and store them.
All your details and passwords are encrypted with high-level encryption. This means hackers who might even try to steal your passwords will have to use high levels of decryption before they can use them.
Good password managers do not store or encrypt your information on their servers.
Depending on type of password manager, you can choose to save your encrypted data locally or on cloud-based servers.
They’re compatible with all major browsers, so you can auto-fill online login forms with a click.
Depending on password manager choice, premium features include:
- Access of passwords across different devices.
- An audit of all passwords, and generation of random, secure passwords to keep credentials strong.
- Two Factor Authentication for extra security.

Cons

Password managers that store passwords on their own server, or perform encryption on their server aren’t safe. Unfortunately, even some of the topmost password managers do this. LastPass was hacked twice in July 2016, fortunately by white hat hackers who disclosed the vulnerabilities responsibly.
Storing the password on your computer has its risks. For example, a hacker could performs a keylogging attack to determine what your master password is.
The entire structure of a password manager depends on the user’s Master Password. This means if you forget or lose your master password, you lose access to all your passwords– there is no ‘forgot password’ link. Moreover, if your master password isn’t strong enough, all of your credentials could be hacked.

Just as there is no such thing as a completely safe website, there are no completely safe ways to store your passwords. Whichever method you choose to use, the safety of your passwords depends on how cautious and proficient you are in using the storage method.

October 28, 2016 by Ruby Paulson

How to Choose a Strong Password That’s Easy to Remember

Having a strong password for your WordPress site is one of the basic steps to maintaining good security posture and hygiene. Strong passwords, however, are a pain to create, and to remember… unless you have a few handy tips and tricks.

Strong password

Passwords are by no means the perfect way to authenticate users. This is why methods like Captcha and two-factor authentication exist. However, most of the time, they’re used as secondary authentication methods . This is because passwords are familiar to us as they have been used for a while (remember ‘Open Sesame’?). As a result, we programmed computers to process them easily too. What needs to be noted, however, is that the same things which make passwords easy to process and cross-check by computers, also makes them ‘bot-crackable’.

Brute Force and Dictionary attacks are automated, so bots don’t even need hackers’ intervention to break into your WordPress site. Using a weak and common password is as good as giving your password to the hacker. This is why it’s important to choose strong passwords.

WordPress has; since version 4.3, included an option for users to generate strong, random passwords, but they’re almost impossible to remember. This is the problem with passwords– if they’re easy to remember, they’re also easy to guess; on the other hand if they are overly complex or random it is very hard to remember them.

The real problem occurs when users concoct a supposed random string because we have all been told that we need to use strong passwords. And just as the popular comic strip from xkcd shows, such passwords may make it harder for us to remember them without making it much harder for bots to crack them.

To understand what a strong password looks like, you have to understand how passwords are cracked. Passwords are usually guessed by bots during Brute Force or Dictionary attacks. While Brute Force attack bots try every different combination of characters to try and crack a password, bots performing Dictionary attacks enter a set of commonly used passwords to see if there’s a match.

Guidelines for Setting a Strong Password/Passphrase for Your WordPress Site:

1. Longer passwords are stronger passwords

With every character added to your password, it gets stronger against Brute Force attacks. In general, passwords that exceed 8-10 characters are not typically crackable via Brute Force bots. However, with the advancement in technology, the computational ability of these bots also increases. The safest bet is to have a passphrase, of 15 characters in length or more.

2. Strong passwords don’t have common replacements

Strong passwords do not use common common number-for-letter replacements (1337speak). This is because bots performing Brute Force attacks try every possible combination of characters.

3. Strong passwords contain uncommon words

Even when you use a ‘passphrase’, common words and common passwords are easily crackable by Dictionary attack bots. This means the more commonly used words your password contains, the weaker it is. According to an infographic by Splashdata, the top 25 most commonly used passwords are:

Numbers in order: From ‘12345’ to ‘1234567890’, the numbers in order made up for 7 out of 15 top passwords used.
Letters in order: These are a commonly used password too. ‘qwerty’ has been one of the world’s most common passwords since 2014. ‘abc123’ is another common password too.
Based on common sports and interests: This is the category that ‘football’, ‘baseball’, and Star Wars-related passwords like ‘solo’, ‘princess’ and ‘starwars’ fall under.

4. Strong passwords don’t contain your publicly known details

Ensuring that they do not contain personal, yet well known details about the user. Suppose you blog frequently about your favourite band, it would be unwise to use the band’s name as your WordPress site’s password. If targeting your site, hackers could use social engineering to guess your password.

5. Strong passwords use a combination of uppercase, lowercase, and special characters

Every character of a different type can be guessed only when the set (that the character belongs to), is checked. ‘p’ belongs to a set of lowercase letters consisting of 26 letters, while ‘P’ belongs to a set of uppercase letters consisting of 26 letters. If your password/passphrase contains letters of both cases, bots will have to try both sets. Most bots use a general formula when cracking passwords:

(characters of a certain type in the password) number of characters of that type

(characters of a different type in the password) number of characters of that type

So, for example, even if your password were as simple (and weak) as ‘password85’, the number of attempts a bot has to make to crack password would be (26)8 * (10)2 attempts.

Just using ‘P’ instead of ‘p’ would mean that the bots would need (26*2)8 * (10)2 attempts. However, while this looks like it’s a difficult password to crack, good bots try a few million passwords every second. Having letters and characters mixed up makes the password more unpredictable, and hence makes the bot’s job more difficult. A good password could take years to crack.

Enforcing a strong password is essential to keeping your WordPress site safe, but it doesn’t have to be a difficult task, or something that is impossible to remember. Choosing a passphrase wisely is key to reducing the risk to your WordPress site’s security.

There is no such thing as a completely secure website though, so the wise thing to do, would be to use a WordPress firewall to keep attacks at bay, in conjunction with enforcing a strong passphrase. Investing in an accurate, intelligent malware scanner and cleaner helps remove any malicious code that may have made it to your WordPress site.

October 28, 2016October 28, 2016 by Ruby Paulson

Why and How to Protect Your WordPress Login Page

We rarely need to be convinced to harden our WordPress site security. But, how useful is protecting you login page? And, are you doing it right?

Is your WordPress login page really secure?

WordPress is a popular CMS, and the fastest-growing platform to build websites. This is why hackers target it; they gain more out of every attack.

Your WordPress login page is what keeps you and other users out of your WordPress dashboard. It’s no surprise, therefore, that the login page is one of the most attacked areas of your WordPress site. Hackers program bots to barrage your WordPress login page with possible username and password combinations, so that once there’s a match, they have unlimited, legitimate access. ‘Guessing attacks’, as they’re known could have bots entering every single possible combination of letters, numbers and characters, or enter a set of probable credentials.

This is why enforcing login protection is an important way to harden your WordPress site against hacks.

What is login protection?

There are six ways that security blogs recommend using to protect your WordPress login:

Using a unique username: Having a unique username can make guessing attacks on your WordPress site (such as Brute Force and Dictionary attacks) harder to perform. This is because the bots would have to guess the username too, along with the password.
Using strong passwords: This is paramount to any WordPress site’s security. Choosing a strong password makes it difficult for any hacker trying to log in to your site via Brute Force and Dictionary attacks.
Using two-factor authentication: Two means/factors (such as the entry of user credentials and an alphanumeric code) are used to identify the user of the site. Anyone who wants access to the site needs more than just the user credentials; they will need a second token too that is send to them via SMS, email, a phone call, or an app on their phone.
Using Captcha: It’s an alphanumeric picture-based challenge to users to determine if they’re bots or not. Captchas, on an average, take about 10 seconds to read and type out.
Setting a time-period within which the login page will expire: This means anyone who wants to login beyond that point will have to refresh the page and start all over again
Limiting login attempts: This means every user who needs to sign in to your site would be locked out and prevented from accessing it after entering wrong credentials for a specific number of times.

1. Using a unique username

The default username of WordPress is ‘admin’, and a number of WordPress site owners choose to leave it as such. However, this gives hackerbots one thing less to guess. In fact, since the login page only requires the username and password, it reduces the effort and time bots require, by 50%. Hackers using bots and guessing attacks to attack your site generally do not know your site personally, so having a unique username is better for your site’s security. However, if it’s a subscriber who wants to attack your site, they would already know your username. This is why it’s always important to complement having a unique username with other security measures, such as the others on this list.

2. Enforcing a strong password

Having a strong password is one of the key ways to protect your WordPress site from attacks launched on your WordPress login page. Strong passwords are about (or more than) 15 characters in length, use a variety of characters, and do not use very common number-letter replacements. The only troublesome aspect of enforcing strong passwords, is the fact that they’re difficult to remember. This is why it’s important to find good ways to store them.

3. Using two-factor authentication

Two-factor authentication is widely used by financial websites. The two factors are usually what you know– login credentials (username & password) and what you receive on something you have/own– eg: a token (or a graph, as in the instance of Clef), on your mobile phone. Access is granted only when both factors are input correctly.

Most websites use time-based tokens, or One Time Passwords. So once you input your login credentials, the OTP is sent to your registered mobile number. This also ensures that bots are prevented from successfully logging in, since the token is sent via SMS, email or a phone call, and must be entered within a maximum of 15 minutes. A token can’t be used more than once, (or after the time period) and is hence called a One-Time Password (OTP). A couple of plugins that allow you to set up 2FA with WordPress are Google Authenticator and iThemes Pro.

A drawback of this method is that while setting up, the user can set up secondary means of communication (an alternate phone number, or an alternate email address) that the OTP can be sent to. So if a hacker gains access to one of these means, there is a high chance of the website being compromised.

This is why 2FA apps like Clef (which does not require a password as a secondary means of authentication), are deemed to be more secure than the OTP-based 2FA methods. If you’re trying to log in with Clef, you have to match the graph on the WordPress site’s login page with the one that the Clef app on your phone generates.

The trouble here is only when you lose your phone, or when it’s not with you when you want to log in.

4. Using Captcha

A very effective way to protect your login on WordPress, would be to use a Captcha tool, which generates an image with warped alphanumeric text on it. Users are required to read the garbled text, and type it out in the text box below the image. The image expires after a certain amount of time, and must be refreshed after expiry. This makes it a great tool to protect against Brute Force attacks.

The reason this is also a useful tool to differentiate between bots and human is because humans can easily:

Recognize different shapes and sizes of letters, despite a variation in fonts.
Recognize the space between letters and if they’re separated.
Understand the difference between letters based on context (eg: if a letter is an ‘m’ or a combination of ‘n’ and ‘u’).

While the first two forms of recognition come to humans naturally, they are separate tasks for computers, and it requires a lot of time and effort to train bots to perform all three tasks well, and fast.

The only disadvantage of this type of authentication is that sometimes the image can be difficult to read, and those with special needs have a hard time performing the task.

An easy way to add Captcha to your WordPress site, is with plugins like Captcha by BestWebSoft.

5. Setting an expiry-time for your login page

This is a good security measure to use against two types of attacks: Brute Force attacks, and Distributed Denial of Service attack. This is because the page will expire, and any request that tries to access the login page from that IP address, will be blocked. Requests to the login page will only be taken from the said IP address after the login page is refreshed. A plugin that allows you to do this is Login Security Solution.

You could also set up the expiry time for your login page by using the following code in your WordPress theme:

{

add_filter( ‘auth_cookie_expiration’, ‘keep_me_logged_in_for_30_minutes’ );

function keep_me_logged_in_for_30_minutes( $expirein ) {

return 1800; // 30 minutes in seconds

}

Some security measures, such as NinjaFirewall, WordFence, and iThemes take this step a little further by blocking suspicious login requests from an IP for a period of time that you, as an admin of the site, can set. This means even if the login page is refreshed, any request made from the particular IP to the site in question, will be blocked for the set period of time.

6. Limiting login attempts

Limiting login attempts is a great way to protect your login page from bots or hackers trying a number of username-password combinations to log in to your site. You could use plugins like WP Limit Login Attempts or iThemes security to do this, or use code to modify your .htaccess file, but we recommend using plugins. WordPress firewalls such as NinjaFirewall have this feature inbuilt too. The one downside with this method, is that if you enter the wrong credentials to your site more than the specified trial attempts, you could be locked out too.

Getting access back into your site would require you to follow a series of steps, depending on whether you choose to access the site via FTP and then delete the responsible plugin; or unblock your IP address manually (with code) via phpMyAdmin.

Of course, with security plugins like iThemes and NinjaFirewall, you could use settings to prevent your IP address from getting blocked in the first place.

Misleading recommendations to protect your WordPress login page

While it’s important to protect your login page, it’s also important to be careful about the changes you make to your WordPress site.

A number of recommended practices do not protect your WordPress login page as they are claimed to. One of the main reasons behind this is because they include changes that are complex, might harm your site, and are difficult to undo. Another reason, is that they advocate security through obscurity.

A few of these recommended practices include:

1. Hiding your login page by moving it to a custom URL

This is another useless security measure that involves moving it to a custom URL. Those who recommend this step, do so with the idea that this would prevent those visiting your site from knowing if it was a WordPress site. Another advantage of using a tool to do this, security experts say, is that it would also help protect against Brute Force attacks, since most hacks are automated, and having the login page at a different URL makes it a little harder to find. However, this step doesn’t necessarily protect your WordPress site in any way. If you’re using a tool such as iThemes to change your login URL to a default address that the tool gives you, chances are, every website used by iThemes has a similar URL format for the login page. This means if a hacker (or his bots) know the format, your site will still be hacked if you don’t have a good username and password combination.

Another case in which this measure would be useless, is if a hacker is actually determined to hack your site (which admittedly is a rare occurrence).

Moreover, suddenly changing your login URL without prior information, might prove to be inconvenient to your site’s users, who might need to login to complete certain actions. On the flip-side of the same scenario, even if you send an email notification about the change to your users and the hacker happens to already have a credible user account, you wouldn’t be protecting your site.

2. Modifying your user enumeration and hiding your WordPress username

These practices involve completely different procedures, but both require changes to be made to your WordPress site’s database or your .htaccess file. These changes, are complex and could affect your site negatively… and are never recommended before having a reliable, recent WordPress backup of your site. Moreover, WordPress doesn’t recommend making such changes because it also spoils the user experience for your site’s subscribers and contributors.

Instead of such practices, just having good login credentials, like a unique username, and a strong password, could protect your site better.

Hardening your WordPress site isn’t difficult, but knowing which measures to use and how to use them is paramount to not falling prey to hackers. No matter whether you choose to implement security measures manually or you choose a plugin to secure your WordPress site, it’s always safer to have a reliable backup solution like BlogVault, in case any of the measures cause your site to crash.

October 26, 2016 by Ruby Paulson

Why and How To Change the Default Username on WordPress

Your WordPress login credentials are the first line of defense for your site against hackers. Using the default username ‘admin’, is harmful to your site. Do you know how to change your WordPress username?

Your username is important

How many hackers does it take to break into your site?

Well… Zero.

Most hacks are automated, and performed by hackers’ bots. So just as a search engine’s bots crawl the internet for content, hackers’ bots crawl for vulnerabilities that they can exploit. Unfortunately, one of the most common vulnerabilities (and the most common mistakes WordPress site owners make), can be found on the WordPress login page– in the form of weak credentials.

Why hackers attack the login page

Your WordPress site’s login page is what grants access to your site. If hackers can successfully exploit your login, then they can access your site like a seemingly ‘legitimate’ user; and can use your site to do anything they have in mind.

In the hacker’s eyes, attacking the login page is the easiest hack, especially when they have bots programmed to try commonly used username-password combinations. Attacks like Brute Force or Dictionary attacks have bots entering combinations till they crack the right one, so they’re called ‘guessing attacks’.

Why change your username?

With every character added to your login credentials, the guesses/attempts that bots have to make to gain access to your site is increases. Most people think that this only applies to the password and its strength, but they forget that the username is also part of your login credentials. Anyone trying to log in to your site must get both the username and the password right in order to gain access to your WordPress site. Using the default username (admin), therefore, makes sure that the bots have to only get the password right, in order to gain access to your site. Keeping the default username reduces the time the time taken by the bots to crack your credentials, by 50%.

Choosing anything other than the default username makes your site a little more secure, and as an extension to this, choosing a unique username is the most basic step to protecting your site.

A few factors that must be taken into consideration when choosing a username are:

The username should be unique, but must also be a name by which you would like to be known, since it’s not going to be hidden. This would help, especially in instances where subscribers to your website will be able to see your username, or you have to moderate a discussion on your website. Hackers in general perform noncommittal attacks, meaning that they don’t personally know your site, your username, or your role on the site. As mentioned, in these cases, they usually use guessing attacks to attack your login page. Targeted attacks however, will need the hackers to observe your site for a while, so they might know your username. This isn’t a bad thing though (we’ll tell you why at the end of this article.)
When you change your username, you won’t lose your rights as the Administrator of the site, or lose any of your content on the site.

How to change the username on WordPress

Now that we’ve established how important it is to change your WordPress username from ‘admin’, you should know how to make the change.

There are three ways you could go about changing your username on WordPress:

From your WordPress site’s dashboard
Using a plugin
By making changes to your site from phpMyAdmin

1. From your WordPress site’s dashboard

Changing the username on WordPress by this method is a little weird. You have to create a new user with a new username, and attribute this new user with admin rights, as well as all the content you’d put up on the site. This means that you will not be missing anything from the original account. However, this method has one drawback: you have to use a different email address from the one used for the ‘admin’ username.

How to change your username from your WordPress site’s dashboard:

Step 1: Click on the Users tab on your WordPress site, and check out the email address attached to the ‘admin’, under Your Profile.

Step 2: Click on ‘Add New’ under the ‘Users’ tab.

Add New User from the WordPress dashboard

Step 3: Fill out the details. Make sure to use a different email address, and password from the one used for the username ‘admin’.

Fill up all the details required, and set up their post as 'Admin'.

Step 4: Logout, and then log back in with the new username and password.

Step 5: Go back to the ‘All Users’ tab, and select ‘Delete Users’. Make sure to attribute all your content to the new user you’ve created before hitting ‘Confirm Deletion’.

Deleting users

That’s it! You now have a new username that is more difficult to guess.

2. Using a plugin

This is significantly easier than creating a new user from scratch from the WordPress dashboard. To illustrate this, we’re going to be using the Username Changer plugin.

Step 1: Install and activate the Username Changer plugin.

Step 2: Click on the ‘Users’ tab on your site. You should be able to see ‘Username Changer’ right below the ‘Your Profile’ tab.

Using the Username Changer plugin

Step 3: Once you click on ‘Username Changer’, you can select which user’s details you’d like to change (in this case ‘admin’), and save the changes. You can then log out, and log back in again with the same password that you used for ‘admin’.

Select which user you'd like to change the name of, with the Username Changer plugin.

Congratulations! You now have a new username.

The best part about this method, is that you could use the plugin just for this purpose, and delete it once the username is changed. Doing so will not undo any changes made to the username, or affect your site negatively.

3. From phpMyAdmin

This process is a little more difficult, and requires changes to be made to your WordPress site’s database, which we don’t recommend. But if you’ve forgotten the email address you used to create your WordPress admin account, or your username, this option might come in handy. Before you follow these steps, please make sure that you have a reliable backup solution to depend on, such as BlogVault.

Step 1: Login to your cPanel, and click on phpMyAdmin (we used a site of ours hosted on HostGator for this demo).

phpMyAdmin on HostGator's cPanel

Step 2: Select the admin database of your WordPress site.

Selecting databases

Step 3: Click on the ‘wp_users’ table. If you’ve changed the name of this table, you might have to remember and locate it.

wp_admin database in phpMyAdmin

Step 4: Locate the username you want to edit, and click ‘Edit’.

Editing the admin entry

Step 5: Type in the new username as the ‘Value’ for ‘userID’.

Editing the username value

Note: Once you type the new username, the field will turn red. Don’t get alarmed. This is just phpMyAdmin alerting you of a change.

Step 6: Scroll to the bottom, and click on ‘Go’ for ‘Save’.

Final step of editing username on phpMyAdmin

You now have a new username.

Be careful of the ways you use to ‘protect’ the login page.

While changing the username and using it in conjunction with a strong password is an essential step, there are a number of other practices that are highly recommended. However, not all of them are useful.

One of the inefficient ways to protecting your WordPress login includes the practice of ‘hiding’ the WordPress username. WordPress doesn’t recommend this measure since having a visible username not actually a vulnerability.

It is important to not follow useless, more complex procedures that might harm your site; and to focus on the real measures essential to hardening your site against hackers’ attacks. Your login credentials are the first line of defence to your WordPress site, so it’s essential for you to have strong ones.

While enforcing a strong password is critical to having a safe login page, having a unique username does its part too, in protecting against guessing attacks.

Investing in a security measure like a WordPress firewall, would help you avert hackers’ attacks even more. However, since there is no such thing as a secure website, it is important to also have an accurate, intelligent malware scanner and hack cleaner, like MalCare to deal with malicious code on your site, in case a hacker has already penetrated your WordPress site.

Sign In

Sign Up

BLOG

Be upto date on Wordpress Security

1. Writing down your passwords on paper

Pros

Cons

2. Storing your passwords in a password-protected file

Pros

Cons

3. Using a password manager

Pros

Cons

Guidelines for Setting a Strong Password/Passphrase for Your WordPress Site:

1. Longer passwords are stronger passwords

2. Strong passwords don’t have common replacements

3. Strong passwords contain uncommon words

4. Strong passwords don’t contain your publicly known details

5. Strong passwords use a combination of uppercase, lowercase, and special characters

What is login protection?

1. Using a unique username

2. Enforcing a strong password

3. Using two-factor authentication

4. Using Captcha

5. Setting an expiry-time for your login page

6. Limiting login attempts

Misleading recommendations to protect your WordPress login page

1. Hiding your login page by moving it to a custom URL

2. Modifying your user enumeration and hiding your WordPress username

Why hackers attack the login page

Why change your username?

How to change the username on WordPress

1. From your WordPress site’s dashboard

2. Using a plugin

3. From phpMyAdmin

Be careful of the ways you use to ‘protect’ the login page.