Press "Enter" to skip to content

Hardening your WordPress site (Part 1)

There are several action we should take before publishing our wordpress site.

In this post we will explain how to configure the Apache server in order to block access to restricted resources on our wordpress and hide and integrate ‘wp-login/wp-admin’ panels with Google Authenticator:

+Hardening Apache config:

To block malicious HTTP requests we need to change the config of our Apache server modifying the file “/etc/httpd/conf/httpd.conf”.

NOTE: If we are not the owners of the server, we must create “.htaccess” files on our wordpress directories and write there the directives.

If possible, it is strongly recommended to add the directives in “/etc/httpd/conf/httpd.conf” file instead of creating .htaccess files due to performance issues as Apache developers state on the following link: Apache documentation

So, below are shown several directives to include in the file “/etc/httpd/conf/httpd.conf”:

1- The following lines prevent .htaccess and .htpasswd files from being viewed by Web clients:

2- Inside the directive <Directory “/var/www/html/<WP_INSTALLATION_PATH>”> write the following line in order to avoid directory listing, avoid CGI scripts execution and avoid Server Side Includes (SSI) execution:

3- Restrict files that can be uploaded into “wp-content” directory in order to avoid .php backdoors and malicious binaries:

4- Block the access to “wp-includes” directories in order to avoid alteration of wordpress core files. These lines must be added into the directive <Directory “/var/www/html/<WP_INSTALLATION_PATH>”>:

5- Block author scans in order to avoid that automatic scans can guess our wordpress usernames. These lines must be added to the directive <Directory “/var/www/html/<WP_INSTALLATION_PATH>”>:

 

+Hide wp-admin/wp-login panel:

In order to avoid brute force attacks, it is highly recommended to hide the wp-admin/wp-login panel from the default URL and create our custom URL to access this panel.

1- Save a copy of  “wp-login.php” and “/wp-includes/general-template.php” files of your wordpress installation.

2- Rename your file “wp-login.php” with a name of your choice, for example “custom-login.php”.

3- Open the renamed file and replace all strings “wp-login.php” with the new name “custom-login.php”

4- Open “/wp-includes/general-template.php” and replace the line

with this one:

After that, if you try to access /wp-admin/ or /wp-login.php files you will get a 404 Not Found. Now the URL to access your wp-admin panel will be “https://<your_domain>/custom-login.php”

 

+Install Google Authenticator plugin:

To avoid brute force attacks on your wp-admin panel, you can install this plugin

This way, you will have to enter an additional one time password each time you want enter to the admin console.

After installing and activating the plugin you must to activate this function for each user under the “Users tabs”:

Finally install the app “Google Authenticator” on your phone and enter yout secret key or scan the QR code. Now your wp-login panel should look like this:

 

+ Avoid SPAM on comments:

In order to avoid SPAM comments in your posts you can follow the next steps:

1- Activate the default Akismet WordPress plugin with the free version

2- Install the Google Captcha plugin

3- Delete the website field on comments. This is because when you click on comment author name, that will redirect you to his website which was placed in the website field of comments. Because of this, many bloggers use comments area for getting back links.

Add the followin code to the end of your theme “functions.php”:

 

+ Install Wordfence plugin:

This is one of the most useful WordPress plugins. You can find it here

With this plugin you will have the following features:

  • WAF (Web application firewall)
  • Live traffic logs
  • Automatic malware scans looking for infected files on your wordpress like backdoors, bitcoin miners, etc

With all measures from above you should be protected against most of wordpress attacks. We will continue with more security measures in another post.

And finally, you must always have your WordPress, theme and plugins updated!

One Comment

  1. Moize
    Moize 25 February, 2018

    This information is very useful

Leave a Reply to Moize Cancel reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.