Comments on: WordPress Login Security http://www.kimwoodbridge.com/wordpress-login-security/ Kim Woodbridge WordPress Consultant Fri, 12 Mar 2010 19:33:28 +0000 http://wordpress.org/?v=2.9.1 hourly 1 By: Kim Woodbridge http://www.kimwoodbridge.com/wordpress-login-security/#comment-7429 Kim Woodbridge Sun, 24 May 2009 22:24:13 +0000 http://www.kimwoodbridge.com/?p=3717#comment-7429 Hi Alwin - Thanks for sharing the article. Login lockdown does seem like a useful plugin for WordPress security. Hi Alwin – Thanks for sharing the article. Login lockdown does seem
like a useful plugin for WordPress security.

]]> By: Alwin Chuah http://www.kimwoodbridge.com/wordpress-login-security/#comment-7422 Alwin Chuah Sun, 24 May 2009 13:53:08 +0000 http://www.kimwoodbridge.com/?p=3717#comment-7422 I have just posted a blog post describing how we can prevent hackers from hacking the IDs <abbr><em>Alwin Chuah´s last blog post - <a href="http://www.globalblogincome.com/blog-security/wordpress-blog-does-not-block-multiple-id-attempts/" rel="nofollow">Wordpress blog does not block multiple ID attempts.</a></abbr></em> I have just posted a blog post describing how we can prevent hackers from hacking the IDs

Alwin Chuah´s last blog post – Wordpress blog does not block multiple ID attempts.

]]> By: Kim Woodbridge http://www.kimwoodbridge.com/wordpress-login-security/#comment-6859 Kim Woodbridge Wed, 29 Apr 2009 22:16:13 +0000 http://www.kimwoodbridge.com/?p=3717#comment-6859 Hi John, Thanks for visiting and commenting. I tend to agree with changing the username but Stratos knows a lot more about security than I do. I think his point about using admin with a really difficult password as opposed to an easy username and password is valid though. And I know I don't change my password often enough. Hi John,

Thanks for visiting and commenting. I tend to agree with changing the username but Stratos knows a lot more about security than I do. I think
his point about using admin with a really difficult password as opposed to an easy username and password is valid though. And I know I don’t change my password often enough.

]]> By: John Hoff - WpBlogHost http://www.kimwoodbridge.com/wordpress-login-security/#comment-6853 John Hoff - WpBlogHost Wed, 29 Apr 2009 20:13:40 +0000 http://www.kimwoodbridge.com/?p=3717#comment-6853 Hi Kim, excellent article - found you through Barbara's blog. I've been preaching to WordPress users for some time about security issues. I do have to say, though, I completely disagree with stratosg in that changing your username is not important. I understand his point, but remember, nothing is full proof. The best we can do is create multiple layers of protection. Can anyone honestly say they know every possible attack out there and that none of them really care what your username is? No, of course not. Also, you never know what new programs to hack your site will pop up next. Right now the easiest way to crack someone's password is to "guess" the username is "admin" and then brute force attack the password. If the right combo is found, they gain access. (actually, the easiest way is to get into your database) These programs are getting better every day. People who use these programs know that difficult passwords are hard to crack. So what do they do? Develop smarter, faster programs. Will you be prepared? Your logic is right on. Create multiple layers of protection. As for maintaining the multiple usernames and passwords, the easiest program I've found out there to use is RoboForm. Really nice and easy program. I also highly recommend the Login Lockdown plugin. Get it and use it. Why not? I don't believe there are any .htaccess codes out there which can mimic it, but who knows. Hi Kim, excellent article – found you through Barbara’s blog. I’ve been preaching to WordPress users for some time about security issues.

I do have to say, though, I completely disagree with stratosg in that changing your username is not important. I understand his point, but remember, nothing is full proof. The best we can do is create multiple layers of protection.

Can anyone honestly say they know every possible attack out there and that none of them really care what your username is? No, of course not.

Also, you never know what new programs to hack your site will pop up next. Right now the easiest way to crack someone’s password is to “guess” the username is “admin” and then brute force attack the password. If the right combo is found, they gain access. (actually, the easiest way is to get into your database)

These programs are getting better every day. People who use these programs know that difficult passwords are hard to crack. So what do they do? Develop smarter, faster programs. Will you be prepared?

Your logic is right on. Create multiple layers of protection.

As for maintaining the multiple usernames and passwords, the easiest program I’ve found out there to use is RoboForm. Really nice and easy program.

I also highly recommend the Login Lockdown plugin. Get it and use it. Why not? I don’t believe there are any .htaccess codes out there which can mimic it, but who knows.

]]> By: (Anti) Social-Lists 4/26/09 | (Anti) Social Development http://www.kimwoodbridge.com/wordpress-login-security/#comment-6739 (Anti) Social-Lists 4/26/09 | (Anti) Social Development Sun, 26 Apr 2009 04:02:29 +0000 http://www.kimwoodbridge.com/?p=3717#comment-6739 [...] 10 WordPress Plugins for Login - After I wrote an article about WordPress Login Security, Raju compiled a great list of WordPress Login plugins. If you are interested in enhancing login [...] [...] 10 WordPress Plugins for Login – After I wrote an article about WordPress Login Security, Raju compiled a great list of WordPress Login plugins. If you are interested in enhancing login [...]

]]> By: Kim Woodbridge http://www.kimwoodbridge.com/wordpress-login-security/#comment-6627 Kim Woodbridge Tue, 21 Apr 2009 14:33:49 +0000 http://www.kimwoodbridge.com/?p=3717#comment-6627 Hi Harsh - I am familiar with Keepass but not xmarks - thanks for the info - I'll look into it. Hi Harsh – I am familiar with Keepass but not xmarks – thanks for the info – I’ll look into it.

]]> By: Kim Woodbridge http://www.kimwoodbridge.com/wordpress-login-security/#comment-6626 Kim Woodbridge Tue, 21 Apr 2009 14:33:06 +0000 http://www.kimwoodbridge.com/?p=3717#comment-6626 Hi Ajith - The place I currently work forces us to change our passwords every three months. It's annoying but it's a good practice. Most people use the same one and then put @ at the end rather than ! Yeah - that's quite a firewall in the photo ;-) Hi Ajith – The place I currently work forces us to change our passwords every three months. It’s annoying but it’s a good practice. Most people use the same one and then put @ at the end rather than !

Yeah – that’s quite a firewall in the photo ;-)

]]> By: Harsh Agrawal http://www.kimwoodbridge.com/wordpress-login-security/#comment-6619 Harsh Agrawal Tue, 21 Apr 2009 13:59:46 +0000 http://www.kimwoodbridge.com/?p=3717#comment-6619 Kim I agree with u..changing your user name is the first thing I will suggest anyone to do for the first time..now coming to password issue, I will suggest use keepass or xmarks Firefox plugin <abbr><em>Harsh Agrawal´s last blog post - <a href="http://feedproxy.google.com/~r/Shoutmeloud/~3/gsrbfhQR02U/step-by-step-guide-to-install-self-hosted-wordpress-blog-on-dreamhost-hosting-service.html" rel="nofollow">Step by step guide to Install self hosted wordpress blog</a></abbr></em> Kim I agree with u..changing your user name is the first thing I will suggest anyone to do for the first time..now coming to password issue, I will suggest use keepass or xmarks Firefox plugin

Harsh Agrawal´s last blog post – Step by step guide to Install self hosted wordpress blog

]]> By: Ajith Edassery http://www.kimwoodbridge.com/wordpress-login-security/#comment-6613 Ajith Edassery Tue, 21 Apr 2009 06:50:29 +0000 http://www.kimwoodbridge.com/?p=3717#comment-6613 I usually never keep 'admin' or something similar to admin as the user name. However, you are right in saying that usually almost all passwords are same :LOL: . Probably, just like the case with the workplace network passwords, they should enforce password changes once in a while. WordPress should incorporate these alerts (another plugin idea?) It's good that you have some tips for your direct clients as well :P And as Jim said, the pic is really funny. <abbr><em>Ajith Edassery´s last blog post - <a href="http://feedproxy.google.com/~r/dollarshower/~3/pxVL880YSgQ/" rel="nofollow">Latest innovation from Google Labs - News Timeline</a></abbr></em> I usually never keep ‘admin’ or something similar to admin as the user name. However, you are right in saying that usually almost all passwords are same :LOL: . Probably, just like the case with the workplace network passwords, they should enforce password changes once in a while. WordPress should incorporate these alerts (another plugin idea?)

It’s good that you have some tips for your direct clients as well :P

And as Jim said, the pic is really funny.

Ajith Edassery´s last blog post – Latest innovation from Google Labs – News Timeline

]]> By: Kim Woodbridge http://www.kimwoodbridge.com/wordpress-login-security/#comment-6582 Kim Woodbridge Mon, 20 Apr 2009 16:52:40 +0000 http://www.kimwoodbridge.com/?p=3717#comment-6582 Hi Nihar - Thanks. And like Stratos recommends it's good practice to change our passwords frequently. Hi Nihar – Thanks. And like Stratos recommends it’s good practice to change our passwords frequently.

]]>