{"id":1896,"date":"2011-03-09T11:15:50","date_gmt":"2011-03-09T10:15:50","guid":{"rendered":"http:\/\/flaven.fr\/?p=1896"},"modified":"2013-09-24T06:16:41","modified_gmt":"2013-09-24T04:16:41","slug":"wordpress-securite-plugin-plugin-pour-controler-la-securite-de-votre-site-sous-wordpress","status":"publish","type":"post","link":"https:\/\/flaven.fr\/2011\/03\/wordpress-securite-plugin-plugin-pour-controler-la-securite-de-votre-site-sous-wordpress\/","title":{"rendered":"WordPress, s\u00e9curit\u00e9, Plugin &#8211; Plugin pour contr\u00f4ler la s\u00e9curit\u00e9 de votre site sous WordPress"},"content":{"rendered":"<p><!--  WordPress, s\u00e9curit\u00e9, Plugin - Plugin pour contr\u00f4ler la s\u00e9curit\u00e9 de votre site sous WordPress --><br \/>\n<!--  WordPress, s\u00e9curit\u00e9, Plugin, faille, SQL, monitoring, PHP, MySQL  --><br \/>\nIl est certain que choisir WordPress comme CMS pour un site professionnel n\u00e9cessite de se pr\u00e9occuper un peu de la s\u00e9curit\u00e9 de votre futur site. <!--more-->Sans tomber dans l&#8217;exc\u00e8s en affirmant qu&#8217;il faut au mieux 100% de s\u00e9curit\u00e9 ce qui on le sait est infaisable quel que soit le CMS choisi, on peut avoir gr\u00e2ce \u00e0 cette s\u00e9lection de plugins une plus grande lisibilit\u00e9 sur les enjeux de s\u00e9curit\u00e9 et une meilleure id\u00e9e sur les quelques mesures pour parer \u00e0 toutes \u00e9ventualit\u00e9s afin de dormir sur vos deux oreilles.<\/p>\n<p><b>Bien \u00e9videmment, il faut autant que faire se peut mettre \u00e0 jour votre WordPress et de ne pas laisser s&#8217;\u00e9couler un temps infini entre les diff\u00e9rentes sorties de WordPress. Pourquoi ? Car chaque nouvelle version livr\u00e9e de WP am\u00e8ne son lot d&#8217;am\u00e9liorations et d&#8217;avanc\u00e9es en terme de s\u00e9curit\u00e9 notamment.<\/b><\/p>\n<h4>1. WP Security Scan<\/h4>\n<p>Ce plugin vous permet de voir l&#8217;\u00e9tat g\u00e9n\u00e9ral de votre WP en terme de s\u00e9curit\u00e9 ainsi que la plate-forme sur laquelle vous faites tourner votre WP. Il est probable que vous puissiez connaitre des rat\u00e9s si vous \u00eates sur une plate-forme d&#8217;h\u00e9bergement mutualis\u00e9e car vous \u00eates susceptibles de ne pas voir tous les droits en lecture et en \u00e9criture sur le serveur notamment.<\/p>\n<p><b>Une des recommandations que fait le plugin est de changer le prefix par d\u00e9faut des tables WP <code>wp_<\/code>. Il vous propose de la faire en conseillant au pr\u00e9alable de faire un backup de votre base de donn\u00e9es, sage pr\u00e9caution !<\/b><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter\" src=\"https:\/\/flaven.fr\/wp-content\/uploads\/2011\/03\/wp_security_scan_1.jpg\" alt=\"Wordpress, s\u00e9curit\u00e9, Plugin - Plugin pour contr\u00f4ler la s\u00e9curit\u00e9 de votre site sous WordPress\" width=\"500\" height=\"265\" \/><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter\" src=\"https:\/\/flaven.fr\/wp-content\/uploads\/2011\/03\/wp_security_scan_2.jpg\" alt=\"Wordpress, s\u00e9curit\u00e9, Plugin - Plugin pour contr\u00f4ler la s\u00e9curit\u00e9 de votre site sous WordPress\" width=\"500\" height=\"265\" \/><\/p>\n<p><b>Le petit r\u00e9sum\u00e9 produit par le plugin <code>WP Security Scan<\/code><\/b><\/p>\n<blockquote>\n<p>\tWordPress version: 3.1     You have the latest stable version of WordPress.<br \/>\n\tYour table prefix should not be wp_. Click here to change it.<br \/>\n\tYour WordPress version is successfully hidden.<br \/>\n\tWordPress DB Errors turned off.<br \/>\n\tWP ID META tag removed form WordPress core<br \/>\n\t&#8220;admin&#8221; user exists.<br \/>\n\tThe file .htaccess does not exist in wp-admin\/.<\/p>\n<\/blockquote>\n<p><i>Source : <a href=\"http:\/\/wordpress.org\/extend\/plugins\/wp-security-scan\/\" target=\"_blank\">http:\/\/wordpress.org\/extend\/plugins\/wp-security-scan\/<\/a><\/i><\/p>\n<h4>2. WordPress Exploit Scanner<\/h4>\n<p>Un plugin qui sans dommage pour les fichiers, le code&#8230;etc. parcourt l&#8217;int\u00e9gralit\u00e9 de votre WP afin d&#8217;en relever toutes les anomalies offrant potentiellement des failles de s\u00e9curit\u00e9. Ces informations pour une plus grande clart\u00e9 et lisibilt\u00e9 sont ensuite class\u00e9es en 3 niveaux de s\u00e9curit\u00e9 :<\/p>\n<ul>\n<li>Level Severe (14 matches)<\/li>\n<li>Level Warning (11 matches)<\/li>\n<li>Level Note (161 matches)<\/li>\n<\/ul>\n<p><b>Int\u00e9ressant et pratique pour notamment mesurer la dangerosit\u00e9 et la faiblesse d&#8217;un th\u00e8me ou d&#8217;un plugin d\u00e9velopp\u00e9 avec les pieds ! Ne pas non plus tomber dans la parano\u00efa car le plugin <code>WordPress Exploit Scanner<\/code> lui-m\u00eame induit ces propres failles de s\u00e9curit\u00e9 mais au moins il vous en informe&#8230;<\/b><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter\" src=\"https:\/\/flaven.fr\/wp-content\/uploads\/2011\/03\/wordpress_exploit_scanner_1.jpg\" alt=\"Wordpress, s\u00e9curit\u00e9, Plugin - Plugin pour contr\u00f4ler la s\u00e9curit\u00e9 de votre site sous WordPress\" width=\"500\" height=\"265\" \/><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter\" src=\"https:\/\/flaven.fr\/wp-content\/uploads\/2011\/03\/wordpress_exploit_scanner_2.jpg\" alt=\"Wordpress, s\u00e9curit\u00e9, Plugin - Plugin pour contr\u00f4ler la s\u00e9curit\u00e9 de votre site sous WordPress\" width=\"500\" height=\"265\" \/><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter\" src=\"https:\/\/flaven.fr\/wp-content\/uploads\/2011\/03\/wordpress_exploit_scanner_3.jpg\" alt=\"Wordpress, s\u00e9curit\u00e9, Plugin - Plugin pour contr\u00f4ler la s\u00e9curit\u00e9 de votre site sous WordPress\" width=\"500\" height=\"265\" \/><\/p>\n<blockquote>\n<table>\n<tr>\n<td>Location \/ Description<\/td>\n<td>What was matched<\/td>\n<\/tr>\n<tr>\n<td>wp-content\/plugins\/wp-security-scan\/simplepie.inc:12488<\/td>\n<td>Used by malicious scripts to decode previously obscured data\/programs\t$data = base64_decode($data);<\/td>\n<\/tr>\n<\/table>\n<\/blockquote>\n<p><i>Source : <a href=\"http:\/\/wordpress.org\/extend\/plugins\/exploit-scanner\/\" target=\"_blank\">http:\/\/wordpress.org\/extend\/plugins\/exploit-scanner\/<\/a><\/i><\/p>\n<h4>3. WordPress File Monitor<\/h4>\n<p>Efficace et peu gourmand, ce plugin de Matt Walters (<a href=\"http:\/\/mattwalters.net\/\">http:\/\/mattwalters.net\/<\/a>) fait bien son boulot et vous informe proprement des ajouts ou des suppressions de fichiers. On peut voir que toutes modifications de fichiers pr\u00e9sents dans votre WordPress vous est automatiquement signal\u00e9s par mail ou dans un fichier de log. Dans le rapport ci-dessous, nous venons de d\u00e9sinstaller 3 plugins et d&#8217;installer le plugin <code>WordPress File Monitor<\/code> en question.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter\" src=\"https:\/\/flaven.fr\/wp-content\/uploads\/2011\/03\/wordpress_file_monitor_1.jpg\" alt=\"Wordpress, s\u00e9curit\u00e9, Plugin - Plugin pour contr\u00f4ler la s\u00e9curit\u00e9 de votre site sous WordPress\" width=\"500\" height=\"265\" \/><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter\" src=\"https:\/\/flaven.fr\/wp-content\/uploads\/2011\/03\/wordpress_file_monitor_2.jpg\" alt=\"Wordpress, s\u00e9curit\u00e9, Plugin - Plugin pour contr\u00f4ler la s\u00e9curit\u00e9 de votre site sous WordPress\" width=\"500\" height=\"265\" \/><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter\" src=\"https:\/\/flaven.fr\/wp-content\/uploads\/2011\/03\/wordpress_file_monitor_3.jpg\" alt=\"Wordpress, s\u00e9curit\u00e9, Plugin - Plugin pour contr\u00f4ler la s\u00e9curit\u00e9 de votre site sous WordPress\" width=\"500\" height=\"265\" \/><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter\" src=\"https:\/\/flaven.fr\/wp-content\/uploads\/2011\/03\/wordpress_file_monitor_4.jpg\" alt=\"Wordpress, s\u00e9curit\u00e9, Plugin - Plugin pour contr\u00f4ler la s\u00e9curit\u00e9 de votre site sous WordPress\" width=\"500\" height=\"265\" \/><\/p>\n<pre lang=\"text\">\r\n\tThis email is to alert you of the following changes to the file system of your website at http:\/\/127.0.0.1\/wordpress_2_9_2_en\/wordpress\r\n\tTimestamp: Wed, 09 Mar 2011 09:35:23 +0000\r\n\r\n\tAdded:\r\n\twp-content\/plugins\/.DS_Store\r\n\twp-content\/plugins\/wordpress-file-monitor\/.DS_Store\r\n\r\n\r\n\tRemoved:\r\n\twp-content\/plugins\/wp-security-scan\/database.php\r\n\twp-content\/plugins\/wp-security-scan\/functions.php\r\n\twp-content\/plugins\/wp-security-scan\/lock.png\r\n\twp-content\/plugins\/wp-security-scan\/password_tools.php\r\n\twp-content\/plugins\/wp-security-scan\/readme.txt\r\n\twp-content\/plugins\/wp-security-scan\/scanner.php\r\n\twp-content\/plugins\/wp-security-scan\/screenshot-1.jpg\r\n\twp-content\/plugins\/wp-security-scan\/screenshot-2.jpg\r\n\twp-content\/plugins\/wp-security-scan\/scripts.js\r\n\twp-content\/plugins\/wp-security-scan\/securityscan.php\r\n\twp-content\/plugins\/wp-security-scan\/simplepie.inc\r\n\twp-content\/plugins\/wp-security-scan\/style.css\r\n\twp-content\/plugins\/wp-security-scan\/support.php\r\n\twp-content\/plugins\/wp-security-scan\/js\/scripts.js\r\n\twp-content\/plugins\/wp-security-scan\/images\/bt.gif\r\n\twp-content\/plugins\/wp-security-scan\/images\/iblogpro.jpg\r\n\twp-content\/plugins\/wp-security-scan\/images\/pagelines.jpg\r\n\twp-content\/plugins\/wp-security-scan\/images\/whitehouse.jpg\r\n\twp-content\/plugins\/wp-fb-fan-box\/readme.txt\r\n\twp-content\/plugins\/wp-fb-fan-box\/screenshot-1.png\r\n\twp-content\/plugins\/wp-fb-fan-box\/screenshot-2.png\r\n\twp-content\/plugins\/wp-fb-fan-box\/wp-fb-fan-box-id_ID.mo\r\n\twp-content\/plugins\/wp-fb-fan-box\/wp-fb-fan-box-id_ID.po\r\n\twp-content\/plugins\/wp-fb-fan-box\/wp-fb-fan-box.mo\r\n\twp-content\/plugins\/wp-fb-fan-box\/wp-fb-fan-box.php\r\n\twp-content\/plugins\/wp-fb-fan-box\/wp-fb-fan-box.po\r\n\twp-content\/plugins\/exploit-scanner\/exploit-scanner.php\r\n\twp-content\/plugins\/exploit-scanner\/hashes-3.0.1.php\r\n\twp-content\/plugins\/exploit-scanner\/hashes-3.0.2.php\r\n\twp-content\/plugins\/exploit-scanner\/hashes-3.0.3.php\r\n\twp-content\/plugins\/exploit-scanner\/hashes-3.0.4.php\r\n\twp-content\/plugins\/exploit-scanner\/hashes-3.0.5.php\r\n\twp-content\/plugins\/exploit-scanner\/hashes-3.0.php\r\n\twp-content\/plugins\/exploit-scanner\/hashes-3.1.php\r\n\twp-content\/plugins\/exploit-scanner\/loader.gif\r\n\twp-content\/plugins\/exploit-scanner\/readme.txt\r\n\r\n\r\n\tChanged:\r\n\t.DS_Store\r\n\twp-content\/.DS_Store\r\n<\/pre>\n<p><i>Source : <a href=\"http:\/\/wordpress.org\/extend\/plugins\/wordpress-file-monitor\/\" target=\"_blank\">http:\/\/wordpress.org\/extend\/plugins\/wordpress-file-monitor\/<\/a><\/i><\/p>\n<h2>En savoir plus<\/h2>\n<li>Le plugin <code>WP Security Scan<\/code><br \/>\n\t<a href=\"http:\/\/wordpress.org\/extend\/plugins\/wp-security-scan\/\" target=\"_blank\">http:\/\/wordpress.org\/extend\/plugins\/wp-security-scan\/<\/a><\/li>\n<li>Le plugin <code>WordPress Exploit Scanner<\/code><br \/>\n\t<a href=\"http:\/\/wordpress.org\/extend\/plugins\/exploit-scanner\/\" target=\"_blank\">http:\/\/wordpress.org\/extend\/plugins\/exploit-scanner\/<\/a><\/li>\n<li>Le plugin <code>WordPress File Monitor<\/code><br \/>\n\t<a href=\"http:\/\/wordpress.org\/extend\/plugins\/wordpress-file-monitor\/\" target=\"_blank\">http:\/\/wordpress.org\/extend\/plugins\/wordpress-file-monitor\/<\/a><\/li>\n<li>Le mot-cl\u00e9 <code>security<\/code> sur la base de plugins WP<br \/>\n\t<a href=\"http:\/\/wordpress.org\/extend\/plugins\/wp-google-fonts\/\" target=\"_blank\">http:\/\/wordpress.org\/extend\/plugins\/tags\/security<\/a><\/li>\n<li>Le mot-cl\u00e9 <code>monitor<\/code> sur la base de plugins WP<br \/>\n\t<a href=\"http:\/\/wordpress.org\/extend\/plugins\/tags\/monitor\" target=\"_blank\">http:\/\/wordpress.org\/extend\/plugins\/tags\/monitor<\/a><\/li>\n<li>Une pr\u00e9sentation sur la s\u00e9curit\u00e9 sous WP<br \/>\n\t<a href=\"http:\/\/www.slideshare.net\/williamsba\/wordpress-security-1709496\" target=\"_blank\">http:\/\/www.slideshare.net\/williamsba\/wordpress-security-1709496<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Il est certain que choisir WordPress comme CMS pour un site professionnel n\u00e9cessite de se pr\u00e9occuper un peu de la s\u00e9curit\u00e9 de votre futur site.<\/p>\n","protected":false},"author":1,"featured_media":9410,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"bf_ai_meta_description":"WordPress, s\u00e9curit\u00e9, Plugin \u2013 Les meilleurs plugins pour s\u00e9curiser votre site WordPress. Analysez les risques et mettez en place des mesures efficaces.","bf_ai_og_title":"WordPress, s\u00e9curit\u00e9, Plugin","footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[3454,3444,3447,3448,3435,3452],"tags":[367,368,2211,20,106,369,370,2223],"class_list":["post-1896","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-journalism-writing","category-programming-databases","category-technology-trends","category-tools-productivity","category-web-development","category-wordpress-cms","tag-faille","tag-monitoring","tag-mysql","tag-php","tag-plugin","tag-securite","tag-sql","tag-wordpress"],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p3Vuhl-uA","jetpack_featured_media_url":"https:\/\/flaven.fr\/wp-content\/uploads\/2011\/12\/wp_logo_generic2_bf.jpg","_links":{"self":[{"href":"https:\/\/flaven.fr\/happy-api\/wp\/v2\/posts\/1896","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/flaven.fr\/happy-api\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/flaven.fr\/happy-api\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/flaven.fr\/happy-api\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/flaven.fr\/happy-api\/wp\/v2\/comments?post=1896"}],"version-history":[{"count":1,"href":"https:\/\/flaven.fr\/happy-api\/wp\/v2\/posts\/1896\/revisions"}],"predecessor-version":[{"id":9426,"href":"https:\/\/flaven.fr\/happy-api\/wp\/v2\/posts\/1896\/revisions\/9426"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/flaven.fr\/happy-api\/wp\/v2\/media\/9410"}],"wp:attachment":[{"href":"https:\/\/flaven.fr\/happy-api\/wp\/v2\/media?parent=1896"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/flaven.fr\/happy-api\/wp\/v2\/categories?post=1896"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/flaven.fr\/happy-api\/wp\/v2\/tags?post=1896"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}