Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Right now I am using bulletproof wordpress security for my websites, but when i am installing W3 Total Cache plugin it gives me some errors related to .htaccess file and bulletproof wordpress security warns me again to proceed with clicking on create .htaccess file again.

NOW, my question is..

Is it okay to use ONLY .htaccess file with complete security measures in it. And use NO security plugin with that.? I have already found some strict measures which i can put in .htaccess file and will enable directory protect in cpanel for wp-admin and wp-login.php

So, am i going right.?

share|improve this question
    
I honestly don't see any need for a security plugin. Their popularity rides on public misconception & paranoia - secure passwords & good hosting will go miles further. –  TheDeadMedic Jun 6 at 13:00
    
Thanx for the prompt reply bro. But i am on shared hosting. What do you think about that.? –  Soeb Safi Jun 6 at 13:22
1  
Nothing will fully protect you as you desire, that's just not how security work, the only complete security measure there is for website protection is to disconnect all network interfaces, but even then... –  Tom J Nowell Jun 6 at 14:37
    
I just want to come onto the stage where i am in terms of security. BUT without the plugins. Now let me tell you what i am doing: 1) Protecting wp-login.php with password from cpanel 2) Protecting wp-admin directory with password from cpanel 3) Protecting wp-config.php 4) Preventing Directory Browsing 5) Disabling any Hotlinking 6) Protecting /wp-content Directory 7) Protecting the .htaccess Itself 8) Choosing STRONG usernames and passwords 9) Removing wordpress version from wp_head section 10) Folder permissions 11) Changing Mysql permissions for wordpress 12) Changing database prefix –  Soeb Safi Jun 6 at 15:01
    
Please edit what you are looking to implement into your question. –  Rarst Jun 14 at 16:03

1 Answer 1

Yes, you can use a htaccess.

In fact, I often recommend htaccess based protections over plugins because they do not depend upon PHP code or WordPress. The use a completely independent system - Apache.

The more important question is:

Do your htaccess rules protect against the threats you with to mitigate?

Some protections may require a plugin simply because the functionality is not available through what Apache offers.

For example, many plugins attempt to block brute force attacks against your WordPress Login.

You can also achieve the same result by using HTTP Authentication.

Similarly, some plugins try to protect against code-injection, but you can also do this with Apache's mod_rewrite.

share|improve this answer
    
you're right.! i have found a very good link to protect wp-login.php and wp-admin directory. I am planing to remove the plugin and add ONLY .htaccess file for my wordpress websites. Please tell me if you know any other aspects of security. –  Soeb Safi Jun 6 at 14:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.