0

Right now I am using bulletproof wordpress security for my websites, but when i am installing W3 Total Cache plugin it gives me some errors related to .htaccess file and bulletproof wordpress security warns me again to proceed with clicking on create .htaccess file again.

NOW, my question is..

Is it okay to use ONLY .htaccess file with complete security measures in it. And use NO security plugin with that.? I have already found some strict measures which i can put in .htaccess file and will enable directory protect in cpanel for wp-admin and wp-login.php

So, am i going right.?

Improve this question
5
  • I honestly don't see any need for a security plugin. Their popularity rides on public misconception & paranoia - secure passwords & good hosting will go miles further.
    – TheDeadMedic
    Jun 6, 2014 at 13:00
  • Thanx for the prompt reply bro. But i am on shared hosting. What do you think about that.?
    – Soeb Safi
    Jun 6, 2014 at 13:22
  • 1
    Nothing will fully protect you as you desire, that's just not how security work, the only complete security measure there is for website protection is to disconnect all network interfaces, but even then...
    – Tom J Nowell ♦
    Jun 6, 2014 at 14:37
  • I just want to come onto the stage where i am in terms of security. BUT without the plugins. Now let me tell you what i am doing: 1) Protecting wp-login.php with password from cpanel 2) Protecting wp-admin directory with password from cpanel 3) Protecting wp-config.php 4) Preventing Directory Browsing 5) Disabling any Hotlinking 6) Protecting /wp-content Directory 7) Protecting the .htaccess Itself 8) Choosing STRONG usernames and passwords 9) Removing wordpress version from wp_head section 10) Folder permissions 11) Changing Mysql permissions for wordpress 12) Changing database prefix
    – Soeb Safi
    Jun 6, 2014 at 15:01
  • Please edit what you are looking to implement into your question.
    – Rarst
    Jun 14, 2014 at 16:03

1 Answer 1

Reset to default
0

Yes, you can use a htaccess.

In fact, I often recommend htaccess based protections over plugins because they do not depend upon PHP code or WordPress. The use a completely independent system - Apache.

The more important question is:

Do your htaccess rules protect against the threats you with to mitigate?

Some protections may require a plugin simply because the functionality is not available through what Apache offers.

For example, many plugins attempt to block brute force attacks against your WordPress Login.

You can also achieve the same result by using HTTP Authentication.

Similarly, some plugins try to protect against code-injection, but you can also do this with Apache's mod_rewrite.

Improve this answer
1
  • you're right.! i have found a very good link to protect wp-login.php and wp-admin directory. I am planing to remove the plugin and add ONLY .htaccess file for my wordpress websites. Please tell me if you know any other aspects of security.
    – Soeb Safi
    Jun 6, 2014 at 14:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.