Simple Tip To Secure Your WordPress Website

Introduction

Each automated or manual cyber attack starts with gathering as much information about the targeted website or server as possible. Usually, the first step would be the “poc scanning”, which aims to locate and identify an execution environment setup. Website owners tend to neglect the protection of such information and probably not aware of the risk accompanied. In this post, you will learn a simple technique that you can use to improve your website security.

Content Management Version Parameter & Cyber Attack Planning

In most cases, a vulnerability exploit is classified by a targeted application (CMS like WordPress, Joomla, Drupal and so on) and its version. It is enough for a hacker just to identify these two parameters to come up with an appropriate set of known security vulnerability exploits to attack and penetrate the system.

Let's take WordPress as an example since it is most popular open source Content Management System today.

For example, CVE-2017-6818, CVE-2017-6817, CVE-2017-6816, CVE-2017-6815, CVE-2017-6814 description starts with words "In WordPress before 4.7.3" which means that every WordPress setup with the earlier version is vulnerable to such attack.

As you can see, an application or software version is playing a significant role in the attack preparation and once such information is hidden you lower the risk of becoming a target.

If you look at the WordPress 4.7.5 (and almost all older versions), it keeps WordPress version information in version.php file:

version.php:7 $wp_version = '4.7.5';

Further, this global parameter is propagated to general-template.php file:

general-template.php:3659:    $gen = '<meta name="generator" content="WordPress ' . get_bloginfo( 'version' ) . '">';

and here is the actual function that generates the version string:

general-template.php:646: function get_bloginfo( $show = '', $filter = 'raw' ){
  ...
  707         case 'version':
  708             global $wp_version;
  709             $output = $wp_version;
  710             break;
  ....
 

How To Hide WordPress Version From Hackers?

Since all data comes from the single source, it is enough to just change the value of $wp_version. For example:

version.php:7 $wp_version = 'NO-VERSION';

Summary

Unfortunately, version.php is WordPress core file, and it updates every time a new version is released, and thus the before-mentioned “fix” should be done after every WordPress core files update. However, it is worth to add this process to your usual maintenance routine to avoid hacking of your website.

Is your website flagged for malware, blocked by the search engines or disabled by the host?

Our experts are here to clean up any malware from your sites and remove false-positives, blacklisting and other kinds of alerts by any security vendor and search engines. Just select appropriate ThreatSign! Anti-Malware plan and get back online.

For other issues and help: Quttera help-desk