D.K. Smith – WordPress Security Handbook: Facts & Fiction

Layer Three: Guard Your Network!

Passwords must be 14 characters in length and contain symbols, numbers, upper & lower case characters.
  • Bad:  mydaughtersname
  • Good:  Mi^dwtz-na*Ym2
  • use "All Characters" at SafePassWD - SafePassWD.com

FTP sends data as plain text or simple hash.
  • DO NOT store passwords in FTP app
    • Login Type: Ask for password
  • connect via SFTP or SSH only!
  • buy an SSL certificate... very effective, cheap insurance
  • force WP admin onto SSL by adding this to wp-config.php
    • define('FORCE_SSL_ADMIN', true);

DO NOT email passwords & usernames!
  • use PassPack - PassPack.com, or similar service
  • when possible, call client and give passwords