Website Security: WordPress Safety Tips

Bonus WordPress Website Security Measures

Editing WordPress Files

Editing WordPress files for security purposes should be approached with caution and is generally discouraged unless you have a good understanding of what you’re doing.

While WordPress provides a solid foundation, certain files within its system may pose risks to website security, potentially creating backdoors for undesired intrusions.

By incorporating these additional steps, you can reinforce your website security, ensuring that you’ve gone the extra mile to safeguard against potential threats and enhance overall strength.

Edit WP-Config File

The wp-config.php file, often referred to as the “WP-Config file,” is a crucial configuration file in WordPress installations.

The WP-Config file is the initial point of access for any web user connecting to your database, ensuring the proper functioning of WordPress.

There are several measures we can take to enhance and fortify the WP-Config file for improved security. Upon opening the WP-Config file, you’ll come across salt keys and authentication keys.

When you open this file for the first time you will be able to find the salt keys and authentication keys

It is a good idea to change these two different unique phrases. you can generate these phrases using the following link: https://api.wordpress.org/secret-key/1.1/salt

“Don’t forget to save a full backup of your website (both database and files) before making any changes. This way, if anything goes wrong, you can go back to how your website was before the changes.”

Go to your web hosting dashboard > C-Panel > File Manager > public_HTML file > wp-config.php.

Once you have located the wp-config.php file, right-click on it and choose “edit”

scroll down a little to find the salt keys (see below)

From the link above, generate new unique salt keys, copy them, and paste them to replace the existing salt key.

This is especially valuable if you suspect a security breach on your WordPress site. Altering security keys will log out all users currently logged in, compelling them to log in again for an added layer of security.

By default, WordPress assigns the ‘wp_’ prefix to all its tables. It’s advisable to change this prefix to something random for added security.

Doing so makes it tougher for hackers to predict your table names, offering protection against common SQL injection attacks.

After you made the changes click “Save Changes”

Try your website and make sure all is working as it should.

Disabling XML-RPC

XML-RPC is a protocol that facilitates remote communication between systems by allowing the execution of procedures on a server.

It is characterized by its simplicity, use of XML for data exchange, and widespread applicability in web development.

However, due to security considerations, some platforms may choose to restrict or disable XML-RPC functionality.

To disable XML-RPC: install the free plugin WPCode, upon activation, go to your WordPress dashboard, Code Snippets > Add Snippet > Library, and search for “XML” select disable XML-RPC and click the blue button (Use Snippet)

Then you need to switch the “Active” toggle to the “On” position.

Lastly, be sure to click the ‘Update’ button to activate the snippet on your site and deactivate the XML-RPC API.

Another way (advanced) to disable XTM-RPC on WordPress, is from the .htaccess file:

To disable XML-RPC on WordPress using the .htaccess file, you can add the following code:

# Block XML-RPC requests

<Files xmlrpc.php>

order deny,allow deny from all

</Files>

This code uses Apache directives to block access to the (xmlrpc.php) file, effectively disabling XML-RPC functionality. Here’s a breakdown of what each line does:

• <Files xmlrpc.php> This specifies that the directives enclosed within apply specifically to the xmlrpc.php file.
• order deny,allow: This sets the order in which the deny and allow directives are processed. In this case, it denies access by default.
• deny from all: This denies access to the xmlrpc.php file for all users.

Place this code in your .htaccess file, typically located in the root directory of your WordPress installation. Be cautious while editing .htaccess, and make sure to back it up before making any changes.

Keep in mind that disabling XML-RPC may impact certain functionalities, such as remote publishing and some plugins that rely on XML-RPC.

Before implementing this, ensure that it aligns with your website’s requirements and functionalities.

Disabling PHP Execution

Disabling PHP execution in certain directories or files is a security measure that helps protect websites from potential vulnerabilities and malicious activities. Here’s how it improves website security:

1. Mitigation of Code Injection Attacks:
   • PHP execution is at the core of many web applications, including WordPress. However, in some cases, attackers may attempt to inject malicious PHP code into vulnerable files. By disabling PHP execution in directories where it’s not necessary, you reduce the risk of code injection attacks.
2. Prevention of Unauthorized Access:
   • Certain directories or files, such as those containing sensitive information or configuration files, don’t need PHP execution. Disabling PHP in these locations prevents unauthorized users from executing PHP scripts that could potentially expose or manipulate critical data.
3. Protection Against Malicious Uploads:
   • If an attacker manages to upload a malicious PHP file to your server, disabling PHP execution in directories where uploads are unnecessary prevents the uploaded file from being executed, limiting the impact of a potential breach.
4. Hardening Against File Inclusion Vulnerabilities:
   • File inclusion vulnerabilities can occur when an application allows the inclusion of files based on user input. Disabling PHP execution in certain directories helps mitigate the risk of such vulnerabilities, making it more challenging for attackers to exploit weaknesses in file inclusion mechanisms.
5. Reduced Attack Surface:
   • Disabling PHP execution in directories that don’t require it reduces the attack surface of your website. The principle of least privilege suggests limiting access and permissions to only what is necessary for each component, reducing the potential impact of a security breach.

To disable PHP execution in a specific directory, you can use directives in your web server configuration file

While disabling PHP execution is a valuable security measure, it’s important to carefully implement and test such changes.

Be aware of the potential impact on your website’s functionality and thoroughly review the necessity of PHP execution in specific directories before applying this measure.

Disable Directory Indexing and Browsing

Disabling directory indexing and browsing is a safety practice that enhances website security by preventing the exposure of directory contents to the public.

To check if directory indexing and browsing are already disabled on your website, navigate to your-domain.com/wp-includes/

If you encounter a 403 error page or a similar message, it indicates that directory browsing is already disabled on your WordPress website.

It’s important to note that while disabling directory indexing is a good security practice, it’s equally crucial to ensure that your website has appropriate default index files (e.g., index.html) in each directory to maintain a seamless user experience. Additionally, regularly reviewing and securing file permissions and access controls further contributes to overall website security.

Disabling directory indexing in WordPress can be done by adding or modifying directives in the .htaccess file. Here’s a step-by-step guide:

1. Access Your Website’s Files:
   • Use an FTP client or your hosting provider’s file manager to access your WordPress installation files.
2. Locate the .htaccess File:
   • The .htaccess file is often located in the root directory of your WordPress installation. If you can’t find it, make sure that your FTP client is configured to show hidden files.
3. Backup .htaccess:
   • Before making any changes, it’s a good practice to create a backup of your .htaccess file. This ensures that you can revert to the previous state if anything goes wrong.
4. Edit .htaccess:
   • Open the .htaccess file in a text editor. You can use any plain text editor like Notepad on Windows or TextEdit on macOS.
5. Disable Directory Indexing:
   • Add to the last line of code, the following line to your .htaccess file to disable directory indexing: Option -Indexes
6. Save and Upload:
   • Save the changes to your .htaccess file and upload it back to your server.
7. Verify:
   • To confirm that directory indexing is disabled, try accessing a directory on your site that doesn’t have an index file (e.g., index.html or index.php). You should see a 403 Forbidden error or a customized error page, indicating that directory indexing is disabled.

Here’s what your .htaccess file might look like after adding the directive:

After these steps, your WordPress website should have directory indexing disabled for improved security.

Tighten file/folder permissions

Tightening file and folder permissions is a critical aspect of securing your WordPress website. Here are steps you can take to ensure appropriate permissions.

In cPanel, you can easily change file and folder permissions to make them writable only for the owner. Here’s a step-by-step guide:

1. Login to cPanel:
   • Access your cPanel dashboard using your hosting provider’s login information.
2. File Manager:
   • In cPanel, look for the “File Manager” icon. Click on it to open the File Manager.
3. Navigate to WordPress Installation:
   • Go to the directory where your WordPress installation is located. This is typically the “public_html” or “www” directory.
4. Select Files and Folders:
   • Locate the files and folders you want to modify. You can use the checkboxes next to the items to select them.
5. Change Permissions:
   • After selecting the files and folders, find the “Permissions” or “Change Permissions” option. This is usually available in the menu at the top of the File Manager.
6. Set Permissions:
   • In the permissions window, you’ll see fields for Owner, Group, and Public, with checkboxes for Read, Write, and Execute. Set the permissions to “Read” and “Write” for the owner, and uncheck everything for Group and Public.
7. Apply Changes:
   • Once you’ve set the permissions, click the “Change Permissions” or “Save Changes” button to apply the changes.
8. Confirm Changes:
   • Check the files and folders again to confirm that the permissions have been updated. The owner should have read and write permissions, while the group and public have no permissions.

Repeat these steps for any other files or folders you want to modify.

It’s essential to exercise caution when modifying permissions. Giving the owner read and write access means they can modify or delete these files. Only change permissions for files and folders that require it, and be mindful of the potential security implications.

If you encounter any issues or are unsure about which files to modify, it’s a good idea to consult with your hosting provider’s support or a knowledgeable web developer.