9

I'm new from wordpress and i want improve security of wordpress multisite by hiding non public resources, eg. wp-admin, wp-config etc.

My setting seem to work, but i don't know if this setting can break something (core features, popular plug-in, etc.)

  1. Are my settings good in general way?
  2. My settings improve real security or i'm wasting my time?

httpd-vhosts.conf (apache)

# Disallow public access php for .htaccess and .htpasswd files
<Files ".ht*">
    Require all denied
</Files>

# Disallow public access for *.php files in upload directory
<Directory "/htdocs/wp-content/uploads/">
   <Files "*.php">
       deny from all
   </Files>
</Directory>

# Disallow public access for... 
<Files "wp-config.php">
   order allow,deny
   deny from all
</Files>

<Files "readme.html">
   order allow,deny
   deny from all
</Files>

<Files "license.html">
   order allow,deny
   deny from all
</Files>

<Files "license.txt">
   order allow,deny
   deny from all
</Files>

# Because we do not use any remote connections to publish on WP
<Files "xmlrpc.php">
  order allow,deny
  deny from all
</Files>

.htaccess

RewriteEngine On
RewriteBase /

# List of ACME company IP Address
SetEnvIf Remote_Addr "^127\.0\.0\."      NETWORK=ACME
SetEnvIf Remote_Addr "^XX\.XX\.XX\.XX$"  NETWORK=ACME
SetEnvIf Remote_Addr "^XX\.XX\.XX\.XX$"  NETWORK=ACME
SetEnvIf Remote_Addr "^XX\.XX\.XX\.XX$"  NETWORK=ACME

# Disallow access to wp-admin and wp-login.php
RewriteCond %{SCRIPT_FILENAME} !^(.*)admin-ajax\.php$ # allow fo admin-ajax.php
RewriteCond %{ENV:NETWORK} !^ACME$ # allow for ACME
RewriteCond %{SCRIPT_FILENAME} ^(.*)?wp-login\.php$ [OR]
RewriteCond %{REQUEST_URI} ^(.*)?wp-admin\/
RewriteRule ^(.*)$ - [R=403,L]

# Block user enumeration
RewriteCond %{REQUEST_URI}  ^/$
RewriteCond %{QUERY_STRING} ^/?author=([0-9]*)
RewriteRule ^(.*)$ / [L,R=301]

# Block the include-only files.
# see: http://codex.wordpress.org/Hardening_WordPress (Securing wp-includes)
RewriteRule ^wp-admin/includes/ - [F,L]
RewriteRule !^wp-includes/ - [S=3]
#RewriteRule ^wp-includes/[^/]+\.php$ - [F,L] # Comment for Multisite
RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
RewriteRule ^wp-includes/theme-compat/ - [F,L]

function.php

<?php
// Remove unnecessary meta tags
// <meta name="generator" content="WordPress 4.1" />
remove_action('wp_head', 'wp_generator');

// Disable WordPress Login Hints
function no_wordpress_errors(){
    return 'GET OFF MY LAWN !! RIGHT NOW !!';
}
add_filter( 'login_errors', 'no_wordpress_errors' );

wp-config.php

<?php
define('DISALLOW_FILE_EDIT', true);
define('DISALLOW_FILE_MODS', true);
  • 3
    if you are new and unsure then check plugins like Sucuri Security,iThemes Security, Wordfence Security... those have multiple options.(It's not that i'm forcing you to use plugins but they have a solid userbase) – bravokeyl Apr 19 '16 at 10:04
1

Using remove_action() can be remove unnecessary links for example:

remove_action('wp_head', 'rsd_link'); //removes EditURI/RSD (Really Simple Discovery) link.
remove_action('wp_head', 'wlwmanifest_link'); //removes wlwmanifest (Windows Live Writer) link.
remove_action('wp_head', 'wp_generator'); //removes meta name generator.
remove_action('wp_head', 'wp_shortlink_wp_head'); //removes shortlink.
remove_action( 'wp_head', 'feed_links', 2 ); //removes feed links.
remove_action('wp_head', 'feed_links_extra', 3 );  //removes comments feed. 
  • 1
    Please use code formatting when you are posting code. – bravokeyl Jun 4 '16 at 11:13
-1

Are you running your site on cPanel?

If so, explore your control panel and you'll see a few great modules.

  • hotlink protection
  • leech protection

Under Advanced tab, look for indexes. Once you click you can customize and "hide non public" resources very easily.

enter image description here

  • hot linking has nothing to do with security. You can be perfectly secure and allow hot linking and "leeching" – Mark Kaplun May 26 '16 at 7:17
  • You are incorrect with that statement. I can't believe I got a downvote for posting multiple optimization techniques. (facepalm) – Uncle Iroh May 26 '16 at 12:45
  • 1
    it is a facepalm if you do not know the difference between optimization and security :(. – Mark Kaplun May 26 '16 at 13:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.