WordPress Security – Urgent Update for Blog Owners

There is another simple solution too.

When you upload your plugins, also upload an index.html file to that same plugin folder.

The index.html page can be blank or you can add some redirect code to send visitors back to your home page or elsewhere.

Or you can upload a php redirect file. Just add the following 3 lines (nothing else) to a text file and name it index.php

[?php
Header("Location:http://domain.com");
?]

Replace the [ and ] with or it wont work. Had to do that to display the code here.

You can change the URL, of course.

By adding a file like this into the plugins folder on my computer, the upload process is simple. When I upload my favorite plugins, the index page goes too.

Cheers,
Gary Harvey
http://GetOnGooglePageOne.com

thanks alot, i did the check and there it all was so i made the change.
It was very simple and fast to do and i had never heard of doing it.
Thanks Claire

Very important info, thanks

simple but really good tactic. also nice idea is t osimply put there index.html file that blocks browsing

wow I had no idea thanks for the info on this guys

Another reason to not use software you don’t understand

Great tip. Thanks. I made the change. Thanks to Gary Harvey also. The ‘no indexing’ doesn’t block the search engines from indexing other pages does it?

thiis nice for protection my blog from hecking, thanks
adviser

Sure enough there was a list of my plug-ins, including some I paid for.

But I can’t figure how a thief could use the list. I tried a few, but was unable to find a way to download any of them (FTP access, is password protected).

Attempting to read or download them with my browser results in Apache invoking them to run – whereupon they promptly crash for lack of the parameters, data or return address links that would normally be supplied by the WP routine calling them.

What am I missing here?

Steve

Um, I think you’ll find that if you check the “No Indexing” button, that will ALLOW the files in the index to be displayed.

You actually need to check either the “Standard Indexing” to hide folders with no images or “Fancy Indexing” to hide folders that contain images.

Yeah I know, confusing, but that’s the way it is!

This is an answer to 2 replies.

To Steve1943

Not necessarily, I was doing the tests and downloaded the files. So it really depends.

To Terry Didcott

I did No Indexing and it worked. Try Free Traffic System blog for example.

At the end of my htacces file I use:

Options -Indexes

and that works as well to block out the page. It will give a 404 Not Found error if they try to look at your plugins folder.

Thanks for the tip, I did check before i implemented your suggestion and sure enough i was able to download any plugin that i wished. I must mention however that all of my plugins are freely available from wp.org

Thanks guys

I like the index.php solution. I also could not download the plug-ins when viewing, but having the folder redirect to the main page looks better than a directory dump anyway.

cd :O)

Seems a little confusing with all the responses. Can somebody point out a crisp and clear information?

Lian Vaiphei

Thanks, I changed my blogs now. I did not know about that before… Thank you.

Fortunately, my host already has the WP security holes plugged.

I suppose, however, the same is true of the wp-content/themes directory? Especially important if you’ve paid for a theme or two.

It’s really too bad hackers and spammers seem to think that it’s OK for them to “cheat” others out of their hard earned money. But, such is the entitlement mindset

Great tip, thanks. I was lucky, it came up as page not found.

Richie

I had 2 WP blogs in the past. I haven’t another one right now, only a blogspot blog. I’m setting up a new WP blog to be uploaded soon. I’ll be very aware of the breach you are posting about. Gary Harvey’s post is also very enlightening because he is a known internet marketer and he must have very wide expertise in web design. Thanks.

Jesus M.

Superb stuff there. I checked out a few A-list bloggers who have not cured this mistake.

Thanks man… forgot about that… I hope it doesn’t affect my google rankings

Gee, I didn’t know about this,thanks for the advice!

Answer to Lian Vaiphei

We recommend using what we wrote. Other suggestions are options and we ar happy our users share the best of their experience.

It is absolutely up to you what you choose, but we published our solution in the post.

I usually use the index.php solution to all my blogs and it normally shows a blank page on the screen when browsed.

I’ll check the fix presented by admin here and see if my web host supports it.

Thank you very much for these suggestion. These are very useful steps for protecting your blog.

Signup for your free website builder account

Thanks. Sure enough I had the hole in my site. All fixed now. Your instructions were very easy to follow.

This has nothing to do with wordpress but with your webserver. This is not a wordpress security hole!

Yep, this is a server thing. Otherwise we would not suggest the fixing of server settings as a solution.

Thank you! I have a bunch of WP blogs and they ALL had this problem. Whew! You guys rock.

Do you have specific requirements for plug-ins or SEO in WP for a blog to quality to add to your system?

Do blogs contributed to your system have to be accessible through the root domain or can they be in a directory?

Glad to see you guys are “cracker” sensitive! My WP blog got whacked by a savvy (nasty) cyber cracker a few months ago which cost me a few hundred hours to stop the bleeding. This easy fix gave me some comfort on whether to open the back door to FTS on an ongoing basis.

Were you guys aware your Vids or no mas on Vimeo?

Please advise when your new vids are avail via YT or Viddler or where ever?

Peace

Neil

After having my wordpress blog hacked and having to rebuild I found this post a great help. Thanks!

Hello. Thank you for this great info! Keep up the good job!

Really helpful tip. Thanks for that.
It’s amazing how much there is to learn. I must spend more time looking at cpanel and figuring out some of the options.

Not only is FTS a great service, its pretty obvious the user community are pretty up to snuff in the “how to” area. This was one helpful tip. Much appreciated. I suspect that pretty soon a more real-time feed on these types of tips will be live on my screen now that I have my gWave up and running.

Would like to hear from other FTS users who are in possession of an active gWave account / profile so share tips & tricks.

- Neil

I have been reading your posts lately, just want to say thanks for all informative stuff i have found here, helped me learn alot lately.

Much Regards, Mark