Next, I’d like to say that I’ve been extremely happy running Mobile One Time Passwords on my cell phone: http://motp.sourceforge.net/ and mod_authn_otp: http://code.google.com/p/mod-authn-otp/ on the web server.

Coupled with a .htaccess file in wp-admin, and fail2ban to firewall repeated password failures, means that nobody is getting in unless they have both your cell phone and your PIN.

This is world-class security for zero cost. Both projects are covered by the GPL and are completely free.

I didn’t think my little blog would get noticed either. My front page was changed. Took me 30 minutes to get it changed back. Am going to implement security on all my blogs now.

Great blog for all of us who really didn’t understand about hackers. I shall return!

I’d add another security tip to this excellent list – change passwords regularly and make sure they are strong ones. There’s no such thing as 100% secure passwords and the longer an admin password sticks around, the more opportunities hackers have to decrypt them. Using a tool such as KeePass (http://keepass.info/ makes changing passwords a piece of cake. Use something like that to generate a very strong password (say, around 20 or so characters) enhances the security of the salted password. If the salt is, say 64 characters, and your password is, say 22 characters, that makes for an 86 character password that hackers would have to decrypt, unscrabble and try. It can be done, but it takes time and a hacker would have to be really determined to get in if they were going to be bothered trying.

Interestingly, yesterday I installed wp 3.0.1 on a new site and I noticed that all the 8 salts were automatically filled in during the installation process.

I also like to use htpasswd to 2x password protect my admin panel.

Also, while I 100% agree you shouldn’t use the admin account it sucks that any use of author archives or author feeds use the username and not some different slug. So if you do use a different name and delete admin it is not hard to apply a dictionary attack from scraping the username from an rss feed.