{"id":410,"date":"2014-07-14T12:10:22","date_gmt":"2014-07-14T12:10:22","guid":{"rendered":"http:\/\/blog.law.gmu.edu\/webservices\/?p=410"},"modified":"2014-07-14T12:10:22","modified_gmt":"2014-07-14T12:10:22","slug":"simple-steps-to-secure-wordpress-site","status":"publish","type":"post","link":"https:\/\/sls.gmu.edu\/web\/2014\/07\/14\/simple-steps-to-secure-wordpress-site\/","title":{"rendered":"Simple Steps to Secure WordPress Site"},"content":{"rendered":"
    \n
  1. Keep WordPress updated<\/li>\n
  2. Keep plugins updated<\/li>\n
  3. Only use trusted plugins<\/li>\n
  4. Only use trusted themes<\/li>\n
  5. Choose a secure password<\/li>\n
  6. No “admin” username<\/li>\n
  7. Decent hosting<\/li>\n
  8. Keep regular backups<\/li>\n
  9. Restrict login attempts (use iThemes Security<\/a>)<\/li>\n
  10. Switch on SSL encryption<\/li>\n
  11. Change database prefix<\/li>\n
  12. Two-factor authentication (use Google Authenticator<\/a>)<\/li>\n
  13. Monitor what’s happening<\/li>\n
  14. Block access to system files\n

    # protect files<\/strong>
    \n<files wp-config.php>
    \nOrder deny,allow
    \nDeny from all
    \n<\/files>
    \n<files readme.html>
    \nOrder allow,deny
    \nDeny from all
    \n<\/files>
    \n<files license.txt>
    \nOrder allow,deny
    \nDeny from all
    \n<\/files>
    \n<files install.php>
    \nOrder allow,deny
    \nDeny from all
    \n<\/files>
    \n<files error_log>
    \nOrder allow,deny
    \nDeny from all
    \n<\/files><\/p>\n

    # Block the include-only files.<\/strong>
    \n<IfModule mod_rewrite.c>
    \nRewriteEngine On
    \nRewriteBase \/
    \nRewriteRule ^wp-admin\/includes\/ - [F,L]
    \nRewriteRule !^wp-includes\/ - [S=3]
    \nRewriteRule ^wp-includes\/[^\/]+\\.php$ - [F,L]
    \nRewriteRule ^wp-includes\/js\/tinymce\/langs\/.+\\.php - [F,L]
    \nRewriteRule ^wp-includes\/theme-compat\/ - [F,L]
    \n<\/IfModule><\/code><\/li>\n

  15. Build your own firewall<\/li>\n
  16. Hide .htaccess file
    \n\t# STRONG HTACCESS PROTECTION<\/strong>
    \n<Files ~ \"^.*\\.([Hh][Tt][Aa])\">
    \norder allow, deny
    \ndeny from all
    \nsatisfy all
    \n<\/Files><\/code>\n<\/li>\n
  17. Protect WP-Admin area<\/li>\n
  18. Block PHP in uploads folder
    \n<Files *.php> Deny from All <\/Files><\/code>\n<\/li>\n
  19. Tighten PHP configuration
    \n; Disable allow_url_fopen in php.ini for security reasons
    \nallow_url_fopen = Off
    \n; Disable allow_url_include in php.ini for security reasons
    \nallow_url_include = Off
    \n; Disable display_errors in php.ini for security reasons
    \ndisplay_errors = Off
    \nlog_errors = On<\/code>\n<\/li>\n
  20. Create your own encryption keys<\/a><\/li>\n
  21. Folder permissions<\/li>\n<\/ol>\n

    Source: Primary Image<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

    Keep WordPress updated Keep plugins updated Only use trusted plugins Only use trusted themes Choose a secure password No “admin” username Decent hosting Keep regular backups Restrict login attempts (use iThemes Security) Switch on SSL encryption Change database prefix Two-factor authentication (use Google Authenticator) Monitor what’s happening Block access to system files # protect files … Continue reading “Simple Steps to Secure WordPress Site”<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[9],"tags":[34],"class_list":["post-410","post","type-post","status-publish","format-standard","hentry","category-security","tag-wordpress"],"_links":{"self":[{"href":"https:\/\/sls.gmu.edu\/web\/wp-json\/wp\/v2\/posts\/410","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sls.gmu.edu\/web\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sls.gmu.edu\/web\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sls.gmu.edu\/web\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/sls.gmu.edu\/web\/wp-json\/wp\/v2\/comments?post=410"}],"version-history":[{"count":0,"href":"https:\/\/sls.gmu.edu\/web\/wp-json\/wp\/v2\/posts\/410\/revisions"}],"wp:attachment":[{"href":"https:\/\/sls.gmu.edu\/web\/wp-json\/wp\/v2\/media?parent=410"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sls.gmu.edu\/web\/wp-json\/wp\/v2\/categories?post=410"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sls.gmu.edu\/web\/wp-json\/wp\/v2\/tags?post=410"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}