Hello EagleArts,
I haven’t heard about WP Padlock before, and from my first research I have to agree with AITpro, it does look quite dubious. I’m almost willing to pay the $$$ USD and download just to see what it really does ??
As to BulletProof Security, it is a solid security plugin that aims at preventing certain attacks by providing a strict set of .htaccess files, which can be quite restrictive. These strict settings may interfere with some plugins and need tweaking to become compatible.
As with all security plugins it is crucial to understand exactly what they do well and what they don’t do well in order to avoid a false sense of security which can be very dangerous.
For example BPS is good at preventing some forms of hacking attacks, but only if the attack is made over a GET request, so attacks that come over POST requests will be successful.
You can install BPS to add additional security to your websites, but I would not rely on it as the one-stop solution that protects you from everything.
Unfortunately, if you are looking for a plugin that keeps you protected after you install it, without any manual effort, you will be disappointed, because there is no such thing. Honestly, every plugin that claims that it provides 100% security by just installing it, should not be taken seriously.
Most of the successful attacks against WordPress are a result of:
1.) Insecure configuration of WordPress, the web server or PHP settings, and/or
2.) An outdated WordPress or outdated plugins and themes that contain publicly disclosed vulnerabilities.
For more information on point 2 see page 76 and 77 of the IBM X-Force Report.
Our company has just released a plugin this week called MVIS Security Center that addresses both points.
1.) It has been designed to clearly show any security problems in your website and provide you with all the information you need to eliminate the identified weaknesses.
The plugin identifies most of the problems as described in the WordPress Security Codex and has many additional checks for your web server and PHP settings. For example it tells you if you are not using HTTPs to login to your WordPress backend or if you are use common usernames and weak passwords.
The plugin does not automatically eliminate the identified problems for you, but it really helps you in securing your websites according to recognised security best practices, by showing you what the problems for your specific website are and how to get rid of them.
You can use BPS to address some of the identified problems.
2.) This is truly unique, from within the plugin you can subscribe to MVIS PROtection, which is a service that monitors your WordPress version and which plugins and themes are installed and sends alerts to your e-mail address as soon as vulnerabilities have been publicly disclosed that affect one of your installed components. This is especially good if you are responsible for more than one website, because you don’t even have to login to the admin interface, but conveniently receive the alerts in your inbox and are able to take the required actions immediately.
The plugin is free and because we are currently in the beta phase, the subscription is free for the next three months.
Give it a try and let me know how you like it and if there is anything else you would like to see covered by it.
Cheers,
Stefan
