In this video you'll learn about protecting your Wordpress sites with an additional layer of monitoring
and security settings using plugins.
Will open the live site.
We've been working on in previous chapters and add two different plug ins to manage your options for
security within WordPress including locking down the log in page hiding the admin area and using two
factor authentication which is stronger than usernames and passwords.
By the end of this lesson you'll have added several layers of security to your Wordpress installation
and you'll have several free security plug ins to explore and choose from.
Let's start by opening up our WordPress dashboard and website that we've been working on in the previous
chapter.
Mine is at Greg Davis dot com slash MailChimp.
As you remember we set up the MailChimp bulk and marketing email program with this Web site.
And then we converted it into a womb commerce store.
Go ahead and pause the video now and open up your live Web site in your browser.
The first thing I want to check out with you is how we access the log in page and the administration
area or the dashboard inside of wordpress.
My setup has the default sidebar widgets set up on my sidebar here.
And one of the sidebar widgets called Maira has a log in link right here.
If I roll over that log in link and look at the bottom left hand side of my screen in Firefox I can
see that accessing a page called W.P. dash log in Dot ph.
That's one way to access the log in page and it will redirect us to the slash W.P. admin folder which
is our WordPress dashboard and administration area.
It's common knowledge that WordPress sites generally use the WP log in ph P page and the WP dash admin
folder for their dashboard areas because anyone including hackers and computer based bots can access
these log in pages.
It's important that you keep a very secure password and avoid using the admin username which is the
old default username in wordpress WordPress now allows you to choose a secure password and some of the
security plug ins will be experimenting with can allow you to force secure passwords on your WordPress
users.
Now put yourself in the place of a hacker.
If you came to this site and you wanted to try and guess the log in for someone site you might try that
admin username at first.
But what if you wanted to try and guess someone's username.
You could go to lost your password.
We have a special newcomer's store last password page built into our theme right here in the storefront
theme.
But if I place any kind of a username or email address here and then click reset password I should get
an error message.
Now this error message tells me that that is not a valid username inside of this account.
So if you had a computer based bot that was going to log in pages all over the internet trying the admin
username until they found it to be valid that bot could return to that log in page and try and guess
the password of that website.
So a simple way to tighten up security would be to limit the display of error messages here in the log
in page.
This type of log in credential is called One step authentication or one factor authentication where
the username and password is checking one thing from the user.
It's something that you know the username and the password to step authentication or also known as two
factor authentication checks.
Two out of three possible factors in the user before it allows them in the admin area or dashboard of
the Web site something you are is potentially your voice print DNA retinal scan fingerprints is the
most popular thing which is something you are and the touch ID system on iPhones using your fingerprint
is a something you are authentication method.
If we're going to be setting up two factor authentication for getting into a WordPress site we'd be
setting up two of these three items something you know which has a username and password combined with
something you have which might be your smartphone.
One of the most convenient ways to harden up the security of your log in in wordpress is to use two
factor authentication with something you have which is most likely a smart phone or even an e-mail address
plug ins for two step authentication are freely available in the Wordpress plugin repository.
And one of the free security plug ins will be looking at in this video called word fence offers two
step authentication within their free version.
We'll also be installing clefs a very interesting two factor authentication plug in and experimenting
with how it works.
So let's go back to the log in page of our WordPress dashboard and log in ourselves and we'll start
looking at the free plug ins available to harden the security of our WordPress installation if you're
a plug ins and add new We're going to be searching for a couple of different plug ins the first one
is called I theme's security.
We look at themes security formerly known as better WPA security.
I theme's is a great company that comes out with theme's security plug ins and backup plug ins.
And if you install it seems security and go ahead and activate it we can check out all the features
and the benefits of using a plug in like this.
A good way to start with security is just to go down and click the Settings button here on the plugins
page and they direct you to their first modal window that pops up called the security check.
So if you just click secure site go and look at what is enabled and it will enable the most recommended
parts of theme security.
Now one of the great things about the theme security network is they have this network brute force protection
where they have known IP addresses and country codes that always do brute force attacks and then block
them before they're even able to reach your site and slow it down.
And so I already do have an account with their network Bruce brute force protection with my e-mail address
and I'll just click activate network brute force protection right there.
And then if I close this window now I'm looking at the same security settings page and I can look at
all the different items that they use for security.
Go ahead and follow along with the setup I'm recommending here.
First thing I might do is just close their little notification tab there.
And I like to look at these in a list and I like to look at all of the different different security
items that they have in I theme's security all in a list here and you can see what's enabled where it
says configure settings and what is not what I'll usually do is go through a few of these that I always
use on Web sites and I'll leave the others alone.
The security checks been done.
The global settings let me look at notification e-mail addresses so that if I go into my e-mail you
can see that I'll get a notification message when a certain IP has been locked out of the wordpress
site due to whatever they did that I theme's Security has blocked it makes me comfortable that this
host has now been locked out permanently because they went and they did too many bad things.
And then down here the default is that when they're locked out three times within a certain time they
get locked out permanently.
And what I always said here is that my current IP from my home computer is on the white list so I can't
be locked out myself by forgetting my password or something like that.
So now I click save settings and now when I'm working on my home computer I can never be locked out
of my own site because my IP address is on the white list.
I want to set up 404 detection for a for is just a page not found and I'll enable that.
And then if you look at the configuration of the settings it just gives you a standard looks back if
there's more than 20 errors within a five minute period that it locks out that IP address.
And so that's a good thing to have because you'll have bots coming to your site using up your bandwidth
costing you more money by looking for ways to exploit your Web site.
There's a whole bunch of other settings right here.
I usually set up band users local brute force protection.
You can see that by doing that security check it's already enabled these and then go down and let's
look at Hide the back end.
Now this is a good way for you to offer an easy way for your clients if they're going to be logging
into their WordPress dashboard to remember the log in page.
You can set it up with something like Slash W.P. log in.
Often times I use the word dashboard or access is a good one for people to remember.
And basically it hides the W.P. dash log in and the WP admin areas and so it just makes it harder for
those bots to find those errors.
Sometimes I'll leave this alone until my site keeps getting these notification emails over and over
and over again that I'm getting a constant barrage on my W.P. admin and my W.P. log in page and then
I'll go and hide the backend and that stops these attacks.
So back inside of the themes security settings the last thing I might set up is a strong password enforcement
and then the other things I usually leave the same.
One of the things I'll do under the global settings is make sure that write to files is allowed.
That way I don't have to copy and paste the security rules that I theme's needs to put in my H.T. access
files.
There's a lot to know about internal WordPress security and you can read more at the themes security
plug in page itself where they do have a paid pro features version where you can get a whole lot more.
I usually use the free version for all my client sites.
And let's look at word fence which is a second version of a word press security plug in one of the great
things about word fence is that it does include two factor authentication in the free version and word
fence also has this great WordPress security learning center as a part of their web site.
This is a great thing to keep up with.
For the latest WordPress security news they put out great blog posts and they actually track when certain
plug ins or themes have security holes.
So they really keep up with wordpress security in the modern world.
Lastly let's take a look at a two factor authentication plug in this clef two factor authentication
plug in is really pretty neat and it works very well and it's super easy to use.
Your clients might appreciate logging in with Cliff instead of having to remember their usernames and
passwords.
So let's go back into our website dashboard and let's go to plug ins and add new and let's install the
clef two factor authentication plug in.
So just type clef in the search bar there and here's cleft two factor authentication.
I'm installing it here and now I can activate it.
Great.
Now if I just click Finish setup it will help me to get set up so that I can use my smartphone to log
in to WordPress.
You can see in this little graphic the way that it works you just line up your camera phone on the screen
and it matches the little bar code that's there.
So I'll start out just by authorizing my own phone number and I'll click download and now I'm opening
up my smartphone and it looks like with that beep I've received a text message.
And then here's a link to download the app opens the video.
While I do that and now I've opened clef and I'm just holding my phone's camera and matching up the
little clef wave there my phone beeped and my web site responded and I'll just click Continue to confirm.
And now I just need to click which website address is there in my browser.
All right so it's setting me up says I'm all good and I've successfully connected my account with clef
and I can invite other users if I want to but I can no I don't need to do that at this point.
And there's one thing that I'd recommend you do when using cliff you'd want to set up a separate you
are out just in case you drop your phone in the ocean or something like that and you need to get into
your web site.
So just click got it here and you can see that cliff is giving me a little message down here on the
menu bar needs set up.
Now you can leave it set up this way where you're showing the clefs way of as the primary logon option
but you can then click in with a password in this little link right here on the log in form.
Now more secure is to disable passwords for clef users.
And then you can see down below.
It showed an override Jarrell.
Now it's a good idea to set up this override.
You r l so that in case you lose your phone or something like that you can go to that u r l and log
in with your username and password anyway.
You just keep that you are as safe and secret and then your web site is using two factor authentication
and it's the most secure.
They give you an easy way to generate a secure override you are all just a random code here.
And then they show you how you can take the URL for your store and drag this button up to the bookmarks
toolbar of your web site.
And this is in them another tab on my web site.
But you can see that now that I placed this you r l here in the address bar it gives me the log in username
and password area as well as the clef plug in button.
If I didn't have that override your L there and I went to the log in page.
The only thing that's shown is my clef wave right here and I'm already logged in.
So it's not showing it to me.
I can log into the newcomers store web site just by clicking that button.
But now the great thing is if I walk away from a computer and maybe it's a public computer and I've
been logged in and I forgot to log out I can just open up my phone here go to the clef app.
This is what I'm doing right now as I'm speaking to you and I can click log out.
Now I just hit the log out now button and now the Web site should respond if I hit another button inside
of the website.
You can see that it's logged out and it goes back to the clef logon screen.
In this lesson you set up your live web site with wordpress level security by using a free plug in from
the Wordpress plugin repository.
Themes security is not the only option.
So explore which security systems you like and install them on each of your Wordpress websites.
You also installed a two factor authentication plug in and set it up to strengthen your log in page
security in the next video.
We'll set up automatic backup systems instead of Wordpress so that we can have more than one automatic
backup happening all the time even though your web site hosting company should be keeping backups for
you.
It's important to save your own secondary backup files in a separate location in case you can't access
the hosts files.
For some reason