Implementing strong passwords
Video: Implementing strong passwordsImplementing strong passwords provides you with in-depth training on Developer. Taught by Jeff Starr as part of the WordPress 3: Developing Secure Sites
- Next steps
Viewers: in countries Watching now:
This course explains how to secure self-hosted WordPress sites, including site configuration, code modification, and the use of free plug-ins. Beginning with the basics of site security, author Jeff Starr explains how to harden a WordPress site by configuring authentication keys, setting proper file permissions, and removing version numbers. The course shows how to implement a firewall, prevent automated spam, and control proxy access, and concludes with a series of advanced tips and site security best practices.
- Backing up and restoring your site
- Setting up strong passwords
- Choosing trusted plugins and themes
- Protecting the configuration file and the admin directory
- Securing the login page
- Fighting comment spam
- Blocking access and detecting hacks
- Finding and reporting vulnerabilities
Implementing strong passwords
This screencast is all about using strong passwords to improve the security of your WordPress-powered web site. Choosing strong passwords for your users helps to keep the bad guys out. Weak passwords are things like 'password1234' and other easy-to-guess phrases. Conversely, strong passwords contain numbers, upper- and lowercase letters, and in WordPress they can also contain special characters like these. Using a good random mix of upper- and lowercase letters, numbers, and symbols is a great way to create strong passwords.
And doing so is an important part of good security. With WordPress there are three key things to remember: You create your admin password during installation. A password must be created for each new user, and passwords should be changed frequently. During installation, you'll see the setup screen, and right here it asks for your password, twice. There are many ways to pick a strong password, but the easiest is to use an online password generator, like this one at onlinepasswordgenerator.com.
Just click the button, and grab a password, copy, and paste then it into the password fields. Of course you can, and should, change the admin password regularly after installation, but setting a strong password from the get-go is an excellent way to begin your new site. In addition to the primary admin account, you may also need to set up accounts for other users, which is done here in the User Settings page.
Click the Users menu to see a list of your users. For existing users, just click on the User Name and scroll down a bit. There you will see fields for resetting your password, here and here. This should be done on a periodic basis according to your own security policy, and for new users we click Add New and fill out the details, with the username, email, and then choose a strong password, and repeat it.
Notice here on the strength meter that this user's password is strong, which is always the desired setting, and with that, click the Add New user button and you're done. Strong passwords are going to help keep your site secure, and it's a good practice to change them on a regular basis. I like to change my passwords every few months for most sites. Admittedly, it's not always the first thing on the mind, but when I see the opportunity to change password, I will just go ahead and do it.
To help with things like changing passwords and choosing strong passwords, here are plug-ins worth checking out. WordPress Password Cracker is a useful tool for auditing your users' choice of passwords. The WordPress Password Generator is an easy-to-use plug-in the autocompletes the password field that is required for new users. And lastly, Bulk Password Reset makes it easy to update the passwords of all users all at once, and there are way more plug-ins available in the WordPress Plugin directory.
We return to the WordPress admin area, click on the Plugins menu, and then click on Add New, type in the 'password' in the search field, and there you will see many plug-ins available to you, for free, for better password management. In this screencast, we've seen how to create strong passwords and change them for different users. WordPress provides tools for doing this, and there are some great plug-ins to make things even easier.
There are currently no FAQs about WordPress 3: Developing Secure Sites.