Wordpress – Page 9 – My technical blog

November 14, 2013

Akismet not working – The key below was previously validated but a connection to akismet.com cannot be established at this time. Plesae check your server configuaration.

Click for larger image

Steps to take:

1) Go to Setttings> discussion and disable comments. That will control further spam.

2) Wait for a day or two. This generally sorts itself out.

November 11, 2013

Remove spam ghost entries using PhpMyAdmin (clears comment metadata)

Run this query on phpmyadmin regularly:

DELETE FROM wp_commentmeta WHERE meta_key

LIKE "%akismet%"

to get rid of excessive commentmetadata

ALSO THIS:

DELETE FROM wp_commentmeta WHERE comment_id

NOT IN (

SELECT comment_id

FROM wp_comments

)

December 3, 2011

WordPress security solution > File permissions for files and directories > An end to hacking

Addendum: This post covers it all, very systematically: 27 Ways to Secure WordPress Website

(Btw, my WP installations – around 20+ in all – have been 100 per cent secure for nearly 6 months now, I think I’m getting the hang of it all, but fingers crossed. 24 Feb 2016)

===MY OLD NOTES==

CHANGE ALL FILE PERMISSIONS ON A SERVER:

find . -type f -exec chmod 644 {} +

CHANGE ALL DIRECTORY PERMISSIONS ON A SERVER. The good thing is it won’t “loosen” files set to tighter permissions

find . -type d -exec chmod 755 {} +

(This second one doesn’t work on my server, so need to go into each directory and implement command)

See this. My latest security steps below:

STEP 1. Backup, Backup and Backup!

With functional backups someone could erase everything and you would be back online in hours. backup daily in at least two different physical locations.

STEP 2: Change The “Admin” User

Malicious person will guess the name of the admin and try thousands of password combinations. If the admin user in your blog is called “admin”, well, you just facilitated things a lot. Change admin username to something REALLY COMPLEX. It is not enough that the admin password be complex. Both should be complex. I’ve used random password generators.

STEP 3: Ensure the right permissions

All files	644 wp-config.php should be 600. (If the server doesn’t work, then try 660. If that doesn’t work, try 664. But never more generous than this.) .htaccess should be 644 ../index.php 755. readme.html 0400 [this file gives away the version of WordPress. Delete that file – it is not necessary] Same with licence.txt
All folders.	755 permission mode. In order to perform write operations to a directory the permission mode can change to 777.
/	root folder ../ 750 all files should be writable only by your user account.
/wp-admin/	The WordPress administration area: all files should be writable only by your user account.
/wp-includes/	The bulk of WordPress application logic: all files should be writable only by your user account.
/wp-content/	User-supplied content: intended to be writable by your user account and the web server process. Within /wp-content/ you will find: /wp-content/themes/ Theme files. If you want to use the built-in theme editor, all files need to be writable by the web server process. If you do not want to use the built-in theme editor, all files can be writable only by your user account. /wp-content/plugins/ Plugin files: all files should be writable only by your user account. Other directories that may be present with /wp-content/ should be documented by whichever plugin or theme requires them. Permissions may vary.