5 Steps To A Secure WordPress Login Page

Protecting your login page cannot be accomplished by any one specific technique, but there are certainly steps you can take to make any attacks far less likely to succeed.

Your site’s login page is certainly one of the more vulnerable pages on your website, so let’s get started on making your WordPress site’s login page a little bit more secure.

#1. Use a Strong Password and A Weird Username

Brute forcing login pages is one of the common form of web attacks that your website is likely to face. If you have an easy to guess password or username, your website will almost certainly be not just a target but eventually a victim.

Splash data compiled a list of frequently used passwords for 2014.

Password by rank in terms of usage.

1. 123456
2. password
3. 12345
4. 12345678
5. qwerty
6. 123456789
7. 1234
8. baseball
9. dragon
10. football

If you use one of those passwords and your website receives any traffic at all, your website will almost certainly be taken down sooner or later.

Use strong passwords and unusual usernames. Previously with WordPress, you had to start out with a default admin username, but that is no longer so. Still, most new web admins use the default username and need to change their username. You can use admin extand to change your admin username.

With security plugins, you can easily enforce strong passwords on all your users. You wouldn’t want someone with an editor level access to use weak passwords now, would you? It compromises your security greatly.

If you have difficulty remembering your passwords, you can use keepass password safe.

#2. Hide The Login Page and Wp-Admin Page

A hacker needs to find your login page, if he or she intends to brute force the login page to gain access. You can prevent this by employing what some call security through obscurity, the idea that hiding your login page will protect you, seeing as the attacker cannot identify a potential point of entry. Your website would be the equivalent of a bank without a door or any other public access point.

Most WordPress websites have the login entry point at yourwebsite.com/login.php.

Try typing webhostingsecretrevealed.net/login.php into your browser’s address bar. Doesn’t work, does it ? Because it doesn’t exist. The login entry for WHSR is located on a different URL. Similarly, you can change the access point on your website to something else. Essentially we change the login page URL.

Similar to the login.php page, there is the wp-admin directory which also needs to be protected. It is fairly easy to do with either of the two plugins – protect your admin.

#3. SSL

SSL or Secure Socket Layer is an extra layer of security which makes any information that you send and receive between your browser and server unreadable. If someone were to intercept the information, they wouldn’t be able to read it and it wouldn’t make any sense.

SSL is always used for financial transaction portals and whenever any sensitive information is shared. Websites store a great deal of information about users and SSL helps keep that information safe. Similarly, SSL operates on Login Pages by making the browser to server communication process a lot more secure.

#3. SSL

SSL or Secure Socket Layer is an extra layer of security which makes any information that you send and receive between your browser and server unreadable. If someone were to intercept the information, they wouldn’t be able to read it and it wouldn’t make any sense.

SSL is always used for financial transaction portals and whenever any sensitive information is shared. Websites store a great deal of information about users and SSL helps keep that information safe. Similarly, SSL operates on Login Pages by making the browser to server communication process a lot more secure.

You will need an SSL certificate which can be purchased from your web host, or sometimes you also get it free with the most basic of shared hosting plans. Really simple SSL and WP Force SSL both help you setup SSL on your website, once you’ve purchased the SSL certificate.

#4. Limiting Number Of Login Attempts

This is one incredibly simple technique to stop brute force attacks on your login page right in their tracks. A brute force attack works by attempting to get your username and password right by trying multiple combinations over and over.

If the particular IP which is perpetrating the attack is tracked, then you can block out the repeated brute forcing attempts and keep your site secure. This is also why global DDOS attacks occur with multiple IP addresses with different origins of attack, to throw hosting services and website security off guard.

Login lock down and login security solution both offer great solutions to protect your website’s login pages. They track IP addresses and limit the number of login attempts to protect your website.

#5. Two Factor Authentication

Google authenticator is a WordPress plugin that operates via an app installed on your Android/iPhone/Blackberry. The plugin generates a QR code which you can scan with your mobile device or you can enter the secret code manually.

Your login will require an authentication code which is generated on your mobile device for login. The plugin can be used on a user by user basis and isn’t recommended for users will less privileges. Given that it is highly unlikely that the hacker has any physical access to your mobile device, your website’s login page will be very secure indeed (assuming there are no other vulnerabilities).

Additional Security

We’ve discussed hiding/renaming the login page and wp-admin directory, enabling SSL on login pages, using two factor authentication, limiting login attempts and using strong passwords and unusual usernames. You should also be aware that some web hosts mandate some of these security practices on their users.

I hope the article was helpful and made your website a bit safer.

Good luck.

Immigrant Community On High Alert, Fearing Donald Trump's 'Deportation Force'

Fear and panic have gripped America's immigrant community as reports circulate that federal agents have become newly aggressive under President Donald Trump, who campaigned for office with a vow to create a "deportation force."

Federal officials insist they have not made fundamental changes in enforcement actions, and they deny stopping people randomly at checkpoints or conducting "sweeps" of locations where undocumented immigrants are common.

But anxiety among immigrants spiked last week after the Immigration and Customs Enforcement (ICE) agency conducted a series of enforcement actions in large metropolitan areas, detaining hundreds of people in Chicago, Los Angeles, New York, Atlanta and other cities.

Amnesty International USA released a statement Saturday saying reports of the enforcement actions "raise grave human rights concerns." Members of the Congressional Hispanic Congress demanded an immediate meeting with Thomas Homan, the acting head of ICE.

"These raids have struck fear in the hearts of the immigrant community as many fear that President Trump's promised 'deportation force' is now in full-swing," the lawmakers wrote in a letter to Homan.

What's certain is that even if ICE and other officials say this is business as usual, many immigrants find more persuasive the words and actions of President Trump, whose political rise was propelled by anti-immigrant rhetoric, a vow to build a wall on the Mexican border and the promise to deport 3 million criminal aliens.
On Jan. 25, five days after taking the oath of office, he issued an executive order titled "Enhancing Public Safety in the Interior of the United States." Media attention focused on Trump's call for an end to federal funds for "sanctuary cities," which do not automatically hand over illegal immigrants who come to the attention of local law enforcement.

But the order also expanded the list of deportation priorities to include any noncitizen who is charged with a criminal offense of any kind, or who is suspected of committing criminal acts or being dishonest with immigration officials. The order gives broader leeway to ICE officers in deciding whether someone poses "a risk to public safety."

For immigrant rights activists, the rules of engagement have clearly changed.

"Donald Trump has effectively created a way to deport individuals who have been accused, charged or convicted of anything from murder to jaywalking," said Angelica Salas, executive director of the Coalition for Humane Immigrant Rights of Los Angeles (CHIRLA).

Fear of being detained or deported could lead many people to avoid going to work, school or to public places in coming days, said Salas. She noted that one person detained by ICE last week had been at his job in a Target store.

"ICE wants us to believe they have removed a bunch of felons who were just plotting their next crime," said Salas. "We know that ICE picked up some collaterals, people who happened to be nearby when officers arrived looking for someone else, and we think what we've just witnessed is how an emboldened ICE will operate."

Several undocumented Los Angeles residents told The Washington Post that they did not want to be identified because they fear the Trump administration could use newspaper coverage to craft a list of deportation targets.

Under policies crafted during President Barack Obama's second term, priority deportees included people who had been convicted of murder and other violent crimes as well as certain drug offenses and gang involvement. Obama's policies called on ICE officials to avoid detaining, whenever possible, nursing mothers and those with serious medical conditions.

ICE last week has put out messages on social media suggesting that the enforcement actions were not part of a major crackdown ordered by Trump. "ICE immigration enforcement actions target specific individuals according to the laws passed by Congress," reads a tweet posted Thursday by ICE.
ICE spokeswoman Sarah Rodriguez wrote in an email to The Washington Post: "ICE does not use checkpoints, nor do we use sweeping raids. We use targeted enforcement actions against specific individuals to make these arrests."

Immigration rights activists are hoping to call attention to the actions of ICE while at the same time preventing full-scale panic among people who may be avoiding going to work or riding buses out of fear of being detained.

"We're not trying to sow hysteria here, so we're not reporting rumors," said Elizabeth Alex, a regional field director in Baltimore County for CASA, an immigrant advocacy group. "But it is fair to say we are seeing new tactics across the county."

She said ICE agents detained a handful of people after they exited the county courthouse in Towson, Maryland. In one incident, on Monday, an undocumented immigrant who had gone to the courthouse to pay a ticket for driving on a suspended license was taken into custody by federal agents as he left, she said.

She added that CASA has documented cases of illegal immigrants being taken into custody in recent weeks after they showed up for check-in meetings with parole and probation officers in the county.

In Montgomery County, considered a sanctuary jurisdiction, lawmakers and dozens of advocates for the state's immigrant population fanned out Friday evening and Saturday morning after unfounded rumors circulated on Facebook that a public bus had been raided by federal immigration officers. As the rumor went, officers boarded a bus in the Wheaton area, home to a sizable chunk of the Washington area's Salvadoran community, and began removing riders who could not produce identification.

Rodriguez denied that, and local officials said they found no evidence to back up the rumor either. Similar unfounded rumors popped up elsewhere in the country, including Portland, Oregon, and Austin.

The epicenter for the enforcement actions in the Washington region last week appeared to be a maze of garden apartments tucked inside the beltway in Annandale, Va., where more than a thousand Hispanic residents live in apartments starting at $1,200 a month. Immigration attorneys said federal officers had staked out the Fairmont Gardens apartment complex at least twice last week, arresting men as they left for work Tuesday and Thursday morning.

"I fear we're going back to the bad days under [former President George W.] Bush - or worse - when immigration officers were given quotas for arrests and whether they found their person or not, they filled up the van to meet the quota," said Simon Sandoval-Moshenberg, legal director for the Legal Aid Justice Center's Immigrant Advocacy Program.

Virginia state Sen. Scott Surovell, D-Fairfax, held a town hall meeting Saturday morning in Mount Vernon where more than 200 constituents showed up. Surovell discussed pictures he'd been sent of federal immigration officers on Friday detaining a man about two miles away in the parking lot of an Aldi grocery store along Route 1.

He said he's heard that the surge in enforcement is scaring schoolchildren, who may avoid going to school on Monday. "They don't know if their parents are going to be taken away," he said.

Dozens of community organizers held a telephone conference Saturday afternoon to discuss strategy, with one lawyer saying in Spanish that immigrants need to take steps to protect themselves.

"Do not open the door to your home without seeing a warrant," he said. "Do not drive a car with broken lights, and do not drive at all at night."

The Pakistan Cricket Board has provisionally suspended two players — Sharjeel Khan and Khalid Latif — under its Anti-Corruption Code

The Pakistan Cricket Board has provisionally suspended two players — Sharjeel Khan and Khalid Latif — under its Anti-Corruption Code as part of an ongoing investigation into an international syndicate which is believed to be attempting to corrupt the Pakistan Super League (PSL).

“Sharjeel Khan and Khalid Latif have been suspended and the rigorous and wide-ranging investigation by the PCB supported by the ICC will continue as part of collective efforts to protect the integrity of the sport,” read a statement issued by the PCB on Friday.

"It would not be appropriate to comment on the specifics of the case, however, this investigation is a clear demonstration of our determination to drive corruption out of our sport, said PSL Chairman Najam Sethi.

We will not tolerate any form of corrupt activity and as this investigation proceeds we will not hesitate to take further decisive action as appropriate, Sethi was quoted as saying.

Both Latif and Khan were part of the Islamabad United team in the ongoing second edition of the PSL.

“The investigation of the PCB Anti-Corruption Unit backed by the ICC ACU has been effective in dealing with this case to date and we will continue to work in the closest collaboration as the investigation proceeds. We are all absolutely committed to relentlessly pursuing anyone who would seek to damage the integrity of our sport,” read the statement issued by PCB.

While commenting on the matter. PCB Chairman Shaharyar Khan said, “I must remind all players of their responsibilities in the fight against corruption. They must understand that if they even think they may have been the subject of a suspicious approach, it is their obligation under the PCB Anti-Corruption Code to report it to an appropriate anti-corruption official as a matter of urgency.”

“Under no circumstances will the PCB condone actions of a few individuals to bring disrepute to the game of cricket or taint the image of Pakistan,” he said.

The PCB and the ICC will not make any further comment in respect of ongoing investigation, the statement concluded.

The PCB chairman, while talking to media after returning to Pakistan, said: “I am disgusted and saddened that these two players did this despite everything done for them by the board.”It would not be appropriate to comment on the specifics of the case, however, this investigation is a clear demonstration of our determination to drive corruption out of our sport, said PSL Chairman Najam Sethi.

We will not tolerate any form of corrupt activity and as this investigation proceeds we will not hesitate to take further decisive action as appropriate, Sethi was quoted as saying.

Both Latif and Khan were part of the Islamabad United team in the ongoing second edition of the PSL.

“The investigation of the PCB Anti-Corruption Unit backed by the ICC ACU has been effective in dealing with this case to date and we will continue to work in the closest collaboration as the investigation proceeds. We are all absolutely committed to relentlessly pursuing anyone who would seek to damage the integrity of our sport,” read the statement issued by PCB.

While commenting on the matter. PCB Chairman Shaharyar Khan said, “I must remind all players of their responsibilities in the fight against corruption. They must understand that if they even think they may have been the subject of a suspicious approach, it is their obligation under the PCB Anti-Corruption Code to report it to an appropriate anti-corruption official as a matter of urgency.”

“Under no circumstances will the PCB condone actions of a few individuals to bring disrepute to the game of cricket or taint the image of Pakistan,” he said.

The PCB and the ICC will not make any further comment in respect of ongoing investigation, the statement concluded.

The PCB chairman, while talking to media after returning to Pakistan, said: “I am disgusted and saddened that these two players did this despite everything done for them by the board.”

‘Islamabad United disappointed’

“We are understandably disappointed at this development but emphasise on our commitment to a zero-tolerance policy towards any violations of the rules or stated guidelines, said a statement issued by the team’s media manager.

“We will be looking to find replacements for the squad as soon as possible,” it added.

As per the PCB's policy and guidelines, we will have no further comment on this issue, it concluded.

‘Islamabad United disappointed’

“We are understandably disappointed at this development but emphasise on our commitment to a zero-tolerance policy towards any violations of the rules or stated guidelines, said a statement issued by the team’s media manager.

“We will be looking to find replacements for the squad as soon as possible,” it added.

As per the PCB's policy and guidelines, we will have no further comment on this issue, it concluded.

May Allah i wish both players clear anti corruption code from the ICC and PCB.