Watch a Hacker break into a WordPress Website!!! 😱

[@murasakistudio]

There are various steps that can be taken with .htaccess as well. You can even protect the .htaccess file itself.

[@jamiewp]

Great points 👍

[@murasakistudio]

@@jamiewp There is a WP expert I know from Belgium called Brecht Ryckaert. He works with one of the big web hosting providers in a senior role and has written a lot about WP security. He even runs a website that helps to recover hacked WP sites I believe. He wrote an eBook for Blocs on .htaccess, which I purchased and picked up some good tips from him regarding website security. There is a section in the book dedicated to WP and he wrote another book focussed entirely on WP security. It's an important topic and a few small steps can sometimes save a lot of stress.

[@ShellCode-oo2cu]

The .htaccess file is protected by the web server by default. The default configuration of the Apache web server is Require all denied This protects access to all files with a dot (hide) in front from external access.

[@polysteamgaming]

Also keep your wplogin server sided.

[@arkofimagination]

From many videos I've watched, hardening the server is the first thing one must do. Then add necessary security on WordPress.

[@ManosXCount]

If your Administration Password remains admin / bob -- Hardening Server will not do anything

[@aronuchukwuezugo615]

Great video. But from what I hear from other WP security experts: there is more to securing a website than just using a security plugin. In short, they suggest security should be done in layers starting from the server layer down to the application layer. But yea, I get it. For beginners using a strong password and a security plugin should work 90% of the time.

[@jamiewp]

Great points

[@Sonya_Makepeace]

Who in their right mind uses 3 letters for a password? BOB. LOL!. I've got a password breaker and it takes over 24 hours to scan properly, and it still couldn't get my password.

[@jamiewp]

😬 You'd be amazed - i chatted to Ryan for over an hour and some of the stories 🙃

[@naho534]

can you pass me your password cracker?

[@1GiPhoner]

His method is not using a password breaker. Its cross checking with a list of other know weak passwords. Totally different concepts.

[@polysteamgaming]

It generally takes about 3-6 hours to a day with hash cat using 4x 1060 GPU cards. This is 8 characters including special characters adding a 9th makes it take 100 times longer. Then the 10th is another 100x more than that. Bascially if you have an 8 character pass word add one of these $%^ and it will now take 100 times longer which is far too long to bother.

[@user-qo9tm5ni4t]

ty for the video and Would be great to see the v2 of this video. with extra ways and more details.

[@mikestottuk]

I might of missed it, but might be a good video follow up about how to use that wpscan CLI to test your own or client site setups

[@jamiewp]

Great idea 👍

[@charlescat3903]

So what to do if you cannot guess the username and password please?

[@AdamWeeks610]

Great content, Jamie. You are always bringing your A-game.

[@jamiewp]

Thanks Adam 🙏

[@AnonymOus-dp3jj]

First rule ! normally wordpress website don't have admin as the username or user id and also wpscan doesn't work when your add enumerator disabled. .

[@jdccool]

Welp...a little nerve wracking, but very informative, good to know info. TY, Jamie and Ryan.

[@jamiewp]

Thank you 🙏

[@jadens9569]

This is a well put together and informative video. Thank you. I'm glad you popped up in my suggestions. I have liked and subscribed.

[@jamiewp]

Thanks Jaden - good to have you onboard :)

[@paulroos8517]

Thanks Jamie. Just a few remarks: I gonna watch the clip again. From what I've seen the strategy is to find a password. There other methods as well, such as : (1) installing the hacker's own file for index.php/index.html in one of the landing directories. That could be countered by installing a dummy index.php and index.html in each directory (dummies wherever the files are NOT IN USE) and then making all of these files (including the functioning files) write-protected (read-only). (2) The site owner should change the username with admin rights to another name, to make it more difficult for the hacker to log in. I had been thinking about using a child theme with a name not obvious related to the parent theme. Would that be sufficient to hide the parent theme name, from hackers? Security is important for e-commerce websites or any website that displays payment information. I see people use QR-codes with payment information and that makes me think, how possible is it for the hacker to overwrite that with his own information? To check a QR-code takes quite some effort since you cannot just eye-ball them?

[@ShellCode-oo2cu]

If a hacker has managed to place an index.html or index.php on the web server, what should prevent him from naming the file phpshell.php? You cannot make the remaining files for Wordpress read-only, otherwise no update would work, whereby the files must be overwritten. Renaming the admin name is of no use, the user ID remains the same, it would make more sense to create a new admin account with which nothing is posted and to delete the old one, in addition you can assign a high user ID to the new admin user in the database.

[@polysteamgaming]

Plugins are the most comromised I would say. Because of old plugins they can overwrite your SQL database. Basically the do this to deal shaddy ads to your visitors.

[@ConnieNassios]

Yikes - great video and public service announcement!

[@jamiewp]

Yikes indeed!

[@aleksandarjevtimijevic]

It would be great if you could make a video on how to protect wordpress with .htaaces without plugin, with all the necessary codes. There is also code for the wp.config file. In addition, you can create a mu plugin or a custom plugin with codes such as smtp, google analytics, CPT and the like, in short, to reduce everything to code and have everything in one place without additional plugins. I would be happy to watch that video. Thank you.

[@jamiewp]

Interesting idea - thank you 🙏

[@GC_Dante]

Amazing video 🙌 congrats!

[@jamiewp]

thanks, this one was lots of fun to make and it was really great to meet Ryan :)

[@Pyramids19]

Why do “hackers” I’m not sure this person really is. 0:01 only hack easy passwords? It’s like someone showing you how to play snooker and putting all the balls over the pockets

[@stuartmorley6338]

Another great video.

[@jamiewp]

Cheers Stu

[@V78dxa]

He uses last pass?!

[@MbonisiM]

Last pass back then was a bit vul.... I don't know.now

[@mrlilstrom]

You brute forced the password online but what about the majority of websites that gives you a “404” when brute forcing?

[@Trosshack]

Are you getting blacklisted? Too many requests can get you blocked in seconds. Are you using a VPN or proxy chains?

[@tor-bjornfjellner]

Hi Jamie. I'm concerned about your nice kitty getting too fat. Should I avoid liking? :)

[@jamiewp]

Nope, they are a bit skinny atm 😬 Please like

[@Albidcg]

bro hack in mac

[@fernandoz6329]

Nice try 'guessing' the user to hack

[@jamiewp]

👍