WordPress 3 Ultimate Security Protect your WordPress site and its network Olly Connelly BIRMINGHAM - MUMBAI WordPress 3 Ultimate Security Copyright © 2011 Packt Publishing All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, without the prior written permission of the publisher, except in the case of brief quotations embedded in critical articles or reviews. Every effort has been made in the preparation of this book to ensure the accuracy of the information presented. However, the information contained in this book is sold without warranty, either express or implied. Neither the author, nor Packt Publishing, and its dealers and distributors will be held liable for any damages caused or alleged to be caused directly or indirectly by this book. Packt Publishing has endeavored to provide trademark information about all of the companies and products mentioned in this book by the appropriate use of capitals. However, Packt Publishing cannot guarantee the accuracy of this information. First published: June 2011 Production Reference: 1070611 Published by Packt Publishing Ltd. 32 Lincoln Road Olton Birmingham, B27 6PA, UK. ISBN 978-1-849512-10-7 www.packtpub.com Cover Image by Duraid Fatouhi ([email protected]) Credits Author Project Coordinator Olly Connelly Vishal Bodwani Reviewers Proofreader John Eckman Joanna McMahon Kevin Kelly Indexers Hari K T Tejal Daruwale Acquisition Editor Monica Ajmera Mehta Usha Iyer Production Coordinator Development Editor Aparna Bhagat Susmita Panda Cover Work Technical Editor Aparna Bhagat Dayan Hyames About the Author Olly Connelly was conceived in the Summer of Love and likes to think that he's the reincarnation of some dude who copped it after a Woodstock head-banger. Born in Windsor, England, he's no relation. Olly lives with Eugenia, just off a beach in Valencia, Spain. His background is broadcasting and satirical journalism and his experience includes serially annoying the BBC, Bloomberg, and MTV. Web-wise, Olly's a freelance content producer, web developer, and system administrator. His site vpsBible.com guides Linux newbies to set up and maintain their own unmanaged VPS boxes. At guvnr.com, meanwhile, he chats up the Web and tries equally to demystify the complex. You can also catch @the_guv on the mighty T where he tweets tech 'n tonics: • vpsBible, Setup Unmanaged VPS 4 Linux Noobs! – http://vpsbible.com • guvnr.com, Make the web, make more of it – http://guvnr.com • on Twitter, Tech 'n tonics – http://twitter.com/the_guv • Olly Connelly, Pop by, say hi J – [email protected] He likes kite-surfing, George Norey's CoasttoCoastam.com, ranting about (what's censored on) the news and, failing all that, a damn fine pint. Acknowledgement Other than thanking Eugenia, a.k.a. she who must be obeyed and without whom this book would still be a tree, there are a great many other people to whom I wish to express my gratitude. The Automattic crew makes a fair start, as does the exceptional WordPress community and, beyond that, the wider open source fellowship, from the tech-headed coder to the pyjamaland blogger, those folks who, day by day, teach and inspire us to make much more than just money. Then there are the unsung heroes of the Web, the white hats who police security, quell the fires, and build the fences that this book merely refers to. Without these guys and gals, we'd all be toast. Ironically perhaps, I'd like to thank Microsoft too, but don't have a cardiac. Thing is, without all the blue screens, I'd never have had my defens-ucation. Like they say in Yorkshire, where there's muck, there's brass. So cheers Bill, and sorry if I knocked a couple of points off the share price. Then there are the lads: Javier who's a bit of a git, but who tagged me with WordPress, Marc for prompting me to search-replace Windows for Tux, Piers for just being Piers. And my late dad and my mum, in case she's feigning interest and reading along, just because they're my parents. Apparently there's been a rumor going around the vpsBible forums that I'd caught a killer virus, else had been run down by a system bus. I'd like to say that, hey, you're a top lot, IOU, and I promise to make it up to you. I've no plans to write another book for at least a couple of weeks. I'd like to thank the decent, patient, and hard-working people at Packt Publishing for cueing me up on this project. In security spiel, you could say, they took a risk with an unknown threat tapping out his first book. I don't know everyone who's worked on this, but would like to thank the crew backstage as well as those folks I've personally dealt with—Sayama Waghu, Usha Iyer, Priya Mukherji, Vishal Bodwani, Susmita Panda, Dayan Hyames and, especially, Patricia Weir ('cos she's in charge of the cheques)—as well as the work's Technical Reviewers John Eckman, Kevin Kelly and Hari K T. Thank you, one and all. You cut me a break. You also nearly killed me. Thank you. I had some great advice before signing up for grey hair; Leon Sterling and Steve White from the LinkedIn-based Certified Professional Writers Association and Rupert Heath from his namesake, London-based literary agency. You were right. Blood and guts! It had to be done. Thank you. Finally, I'd like to thank whoever invented ground coffee, English tea, warm beer, and Scotch whiskey. Writing this last paragraph now, I kid ye not, it sure is time for a wee dram. About the Reviewers John Eckman has more than a decade of experience designing and building web applications for organizations ranging from small non-profit organizations to Fortune 500 enterprises. Currently a senior practice director at Optaros, John works with clients to develop and execute complex revenue-producing web applications. Prior to Optaros, he was director of development at PixelMEDIA, where he was responsible for managing application development, creative services, project management, web development and maintenance teams, as well as providing strategic leadership to teams on key client accounts. Previously, he was a principal consultant in software engineering with Molecular, Inc. He received a Bachelor of Arts from Boston University, a Masters in Information Systems from Northeastern University, and a Ph.D. from the University of Washington, Seattle. John is an active contributor to a number of open source communities, a founding organizer of WordCamp Boston, and the lead developer of the WPBook plugin for WordPress. He blogs at www.openparenthesis.org and tweets as @jeckman. I'd like to thank the broader WordPress community—users and developers—without whom none of this would be possible. Kevin Kelly has been a Web Developer for 5 years. He has produced sites on both the client and server-side. He has worked on sites from national magazine companions to Fortune 500 company internal sites. Along with experience in PHP, ASP and JSP development, he has 2 years of WordPress experience to go with his other years of CMS usage. He has also worked with Sharepoint, Teamsite, and Prism CMS. In his 5 years of experience, he has assisted a variety of companies with their web solutions, such as design firms, financial advisory insitutions, and small multimedia shops. He is also a Program Advisory Committee member of the Web Design and Interactive Media program at Humber Institute of Technology and Advanced Learning and a member of the Digital Arts and Technology Association of Toronto (DATA). Nowadays, he is taking his craft towards the rules of Interface Development. When he is not coding, he is understanding the benefits and deficits of social media. He has also worked on a few chapters for HTML Essentials. I would like to thank Packt Publishing for the opportunity to work on this project. I would like to thank my immediate family for their encouragement. I would also like to thank LinkedIn's development team for giving professionals a chance to connect with like-minded people. Without them, this review wouldn't have been possible. Also, I wanted to give a shout-out to WordPress' core development team for their continuous effort in enhancements on their solid CMS platform. I want to thank my professional twitter followers. And also: Tom Green (the Adobe fellow), James Cullin, Greg Goralski, Jaemeel Robinson, Sheraz Khan, Charles E. Brown, Yoko Reynolds, Deepika Riyat, Sunil Boodram, Ola Fatogun, Paul De La Merced, Michelle Kelly, Joallore Allon (ICE), Chris Jones, Dwight Richards, Al Augustin, and Casey E. Palmer. Hari K T completed his BTech course in Information Technology from Calicut University Institute of Engineering and Technology in the years 2003-07. He is an open source lover and GNU / Linux user working on PHP and web-related technologies for more than 3 years. He loves to share what he has learned with the community, so he used to blog at harikt.com and devzone.zend.com. You can see him on #li3 channel ( http://lithify.me PHP 5.3 RAD framework ) of irc.freenode.net. You can also reach him on Twitter or Identi.ca via @harikt. He has also worked as a technical reviewer of the book PHP5 CMS Framework Development. I would like to thank Packt Publishing and the whole team for giving me an opportunity to review the book, family, friends, and all my well-wishers who supported me. www.PacktPub.com Support files, eBooks, discount offers and more You might want to visit www.PacktPub.com for support files and downloads related to your book.