0

I need a safe place where I can store data about projects that I am working on. This data includes text and files (pictures, sound and video).

I want to create a private "blog" for this purpouse that is accessible only by myself.

The reason behind this is that I can access the data from anywhere, the solution is platform independent, searching the data should be easy using the Wordpress search bar and metadata can be added to all the uploaded files.

My only concern is security - what are my options in securing the contents of the web repository?

The problems I am still facing: If someone breaks past .htpasswd (by brute forcing it, is there a way to block access to the server for a day after several tries at htpasswd?) all uploaded files (images, sounds and movies) can be accessed if the attacker can guess the direct url for the file.

My vision is to use .htaccess for 80% of the security measures - it is Wordpress independent and should survive software upgrades.

But I am really unsure about all the potential holes that I have to plug in Wordpress.

Can you point out other security issues that I have missed and ,ideally, also a solution for them?

Improve this question
2
  • You can restrict access to users who have an account in your WordPress install: wordpress.org/plugins/wordpress-access-control You can extend upon that with 2 factor authentication.
    – itrogers
    Commented Apr 14, 2014 at 20:56
  • Thanks, but as I said I would like to not use any third party plugins of possible + if I mark the post as private no one has access to the post except me.
    – SkyHiRider
    Commented Apr 14, 2014 at 20:58

2 Answers 2

Reset to default
0

My security solutions so far:

Wordpress

  • Make all new posts private (in Wordpress)
  • Don't use any modules, the more third party software I add the less secure the repo becomes
  • Two factor authentication ( this would break the no third party module rule above)

Apache

  • Force https (in .htaccess)
  • Protect web repository using .htpasswd (in .htpasswd)
  • Two factor authentication (not sure if it can be done on a server level? )
  • Allow access to server only from my country (in .htaccess)
Improve this answer
0

Try adding this to your .htaccess file wherever the install is located.

ErrorDocument 403 /specific_page.html
Order Allow,Deny
Allow from 111.222.333.444

you of course are changing that ip address to your own. if you already have an htaccess file containing info, add it to the top.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.