The security of WordPress, currently the most popular content management system, can be significantly improved by tweaking two small settings. This only takes 5 minutes and two lines of code. While the issue can also be addressed with a variety of plugins, I will deliberately limit myself here to plugin-free solutions.
On the one hand, the meta tag reveals
<meta content="WordPress 3.4.1" name="generator" />the current version and can be easily read using scrapers. If a critical security hole has been discovered for a specific version of WordPress, it is easy to track down thousands of websites with exactly that version. Therefore you should remove the information with the following hook:
remove_action('wp_head', 'wp_generator');A second problem is the talkativeness of the dashboard. If you want to log in, information is indirectly provided as to whether the user name exists. The error messages can easily be used with appropriate programs to increase the probability of a hit in brute force attacks. That's why you should take action here too and insert the following hook:
add_filter('login_errors','__return_null');The measures mentioned increase the security of your own blog and are also easy to implement. Although WordPress is considered secure in its standard configuration, its widespread use and popularity often make it a target for potential hackers.