Just this week, popular free classifieds site, sulit.com.ph, was hacked and was maliciously redirected to Sedo. As the security breach happened over the weekend, it took quite a while for the site admin to address the issue. For a heavily-trafficked site like Sulit, I think considerable financial losses were incurred as a result of the breach.

After learning about the incident, I googled about how secure Wordpress blogs are against malicious attacks considering that I just made the leap from blogger.

As it turns out, unsecured Wordpress blogs are also common and easy targets for the maliciously-inclined. Apparently, security holes or vulnerabilities abound in obsolete or poorly written plugins which is exploited by those who have too much time in their hands. One common exploit that hackers use is browsing through a target blog’s plugin directory and checking for outdated or vulnerable plugins. They then attack the site using the vulnerable plugin.

Check if your blog’s plugin directory is viewable to others by typing the following on your browser:

www.yourblogurlhere.com/wp-content/plugins/

If your plugin directory shows up, you need to secure it. Leaving it open is like letting thieves peek through your house through a glass window. It gives them a better and easier opportunity to find a way in.

A simple way to secure your blog installation directories is to add this piece of code to your host’s .htaccess file:

Options All -Indexes

What this code does is it disables directory browsing and redirects anyone trying to browse your installation directory to your standard 404 error pages.

Although this measure will not completely protect your self-hosted blog from attackers, it is still an added layer of protection. So, be sure to secure your blog with this simple line of code before it’s too late.