Tobias Gábríél Sörensson
My feedback
25 results found
-
70 votes
-
454 votes
-
708 votes
-
49 votes
These suggestions look quite reasonable. We encourage other WPT users to join and let us know what other security improvements you’d like us to implement in WPT.
—AK
An error occurred while saving the comment -
1,298 votes
Hello Plesk Support Team and Others!
Here are my findings for secureing wordpress
all in .htaccess file
# Block viewing directories from the site
Options All -Indexes
# Block WordPress xmlrpc.php requests
<Files xmlrpc.php>
order deny,allow
deny from all
</Files>
# Blocks access to .htaccess from hackers
<files ~ "^.*\.([Hh][Tt][Aa])">
order allow,deny
deny from all
satisfy all
</files>
# BEGIN block author scans
RewriteEngine On
RewriteBase /
RewriteCond %{QUERY_STRING} (author=\d+) [NC]
RewriteRule .* - [F]
# END block author scans
# Blocks access to wp-config.php
<files wp-config.php>
order allow,deny
deny from all
</files>
And in folder /wp-content/uploads/ add a .htaccess and put in
<Files *.php>
deny from all
</Files>
This denys any .php from running in uploads folder (hackers fav place)
The other .htaccess is self explanetory. blocks access to .htaccess, block author scaning, blocks access to wp-config.php (some plugins can show wp-content.php as a img file with exploits.
blocks access to xmlrpc.php and also disables directory browsing.