I'm new from wordpress and i want improve security of wordpress multisite by hiding non public resources, eg. wp-admin, wp-config etc.

My setting seem to work, but i don't know if this setting can break something (core features, popular plug-in, etc.)

  1. Are my settings good in general way?
  2. My settings improve real security or i'm wasting my time?

httpd-vhosts.conf (apache)

# Disallow public access php for .htaccess and .htpasswd files
<Files ".ht*">
    Require all denied

# Disallow public access for *.php files in upload directory
<Directory "/htdocs/wp-content/uploads/">
   <Files "*.php">
       deny from all

# Disallow public access for... 
<Files "wp-config.php">
   order allow,deny
   deny from all

<Files "readme.html">
   order allow,deny
   deny from all

<Files "license.html">
   order allow,deny
   deny from all

<Files "license.txt">
   order allow,deny
   deny from all

# Because we do not use any remote connections to publish on WP
<Files "xmlrpc.php">
  order allow,deny
  deny from all


RewriteEngine On
RewriteBase /

# List of ACME company IP Address
SetEnvIf Remote_Addr "^127\.0\.0\."      NETWORK=ACME
SetEnvIf Remote_Addr "^XX\.XX\.XX\.XX$"  NETWORK=ACME
SetEnvIf Remote_Addr "^XX\.XX\.XX\.XX$"  NETWORK=ACME
SetEnvIf Remote_Addr "^XX\.XX\.XX\.XX$"  NETWORK=ACME

# Disallow access to wp-admin and wp-login.php
RewriteCond %{SCRIPT_FILENAME} !^(.*)admin-ajax\.php$ # allow fo admin-ajax.php
RewriteCond %{ENV:NETWORK} !^ACME$ # allow for ACME
RewriteCond %{SCRIPT_FILENAME} ^(.*)?wp-login\.php$ [OR]
RewriteCond %{REQUEST_URI} ^(.*)?wp-admin\/
RewriteRule ^(.*)$ - [R=403,L]

# Block user enumeration
RewriteCond %{REQUEST_URI}  ^/$
RewriteCond %{QUERY_STRING} ^/?author=([0-9]*)
RewriteRule ^(.*)$ / [L,R=301]

# Block the include-only files.
# see: http://codex.wordpress.org/Hardening_WordPress (Securing wp-includes)
RewriteRule ^wp-admin/includes/ - [F,L]
RewriteRule !^wp-includes/ - [S=3]
#RewriteRule ^wp-includes/[^/]+\.php$ - [F,L] # Comment for Multisite
RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
RewriteRule ^wp-includes/theme-compat/ - [F,L]


// Remove unnecessary meta tags
// <meta name="generator" content="WordPress 4.1" />
remove_action('wp_head', 'wp_generator');

// Disable WordPress Login Hints
function no_wordpress_errors(){
    return 'GET OFF MY LAWN !! RIGHT NOW !!';
add_filter( 'login_errors', 'no_wordpress_errors' );


define('DISALLOW_FILE_EDIT', true);
define('DISALLOW_FILE_MODS', true);
  • 3
    if you are new and unsure then check plugins like Sucuri Security,iThemes Security, Wordfence Security... those have multiple options.(It's not that i'm forcing you to use plugins but they have a solid userbase)
    – bravokeyl
    Commented Apr 19, 2016 at 10:04

2 Answers 2


Using remove_action() can be remove unnecessary links for example:

remove_action('wp_head', 'rsd_link'); //removes EditURI/RSD (Really Simple Discovery) link.
remove_action('wp_head', 'wlwmanifest_link'); //removes wlwmanifest (Windows Live Writer) link.
remove_action('wp_head', 'wp_generator'); //removes meta name generator.
remove_action('wp_head', 'wp_shortlink_wp_head'); //removes shortlink.
remove_action( 'wp_head', 'feed_links', 2 ); //removes feed links.
remove_action('wp_head', 'feed_links_extra', 3 );  //removes comments feed. 
  • 1
    Please use code formatting when you are posting code.
    – bravokeyl
    Commented Jun 4, 2016 at 11:13

Are you running your site on cPanel?

If so, explore your control panel and you'll see a few great modules.

  • hotlink protection
  • leech protection

Under Advanced tab, look for indexes. Once you click you can customize and "hide non public" resources very easily.

enter image description here

  • hot linking has nothing to do with security. You can be perfectly secure and allow hot linking and "leeching" Commented May 26, 2016 at 7:17
  • You are incorrect with that statement. I can't believe I got a downvote for posting multiple optimization techniques. (facepalm)
    – Uncle Iroh
    Commented May 26, 2016 at 12:45
  • 1
    it is a facepalm if you do not know the difference between optimization and security :(. Commented May 26, 2016 at 13:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.