WordPress Security Checklist

#A checklist to WordPress Security

Hardening WordPress via Codex:

• http://codex.wordpress.org/Hardening_WordPress

Locking Down WordPress - FREE PDF

• http://build.codepoet.com/2012/07/10/locking-down-wordpress

1. Update! Update! Update!

2. Secure File permissions

   • 2.1 All WordPress Core Files should have 0644 Default Permissions ( Only Writeable by user account )
   • 2.2 Default WordPress Folder Permissions are 0755 (file is writeable only by user and readable by web server and every one else.

3. Disable Directory Views (protects a directory from displaying a content tree to the user)

   • 3.2 Place this snippet in the .htaccess file of your site's root directory ...

   Options -Indexes

4. Protect wp-config.php

• 4.1 use this snippet in your root's .htaccess file.

  #Secure Config File
  <Files ~ wp\-config\.php>
     Order Deny, Allow
     Deny from all
     Allow from xxx.xxx.xxx (your personal IP whitelist)
  </Files>

5. Protect install.php
   • 5.1 Option one is to Nuke the file entirely
   • 5.2 Option two is to use the site's root .htaccess file for control.
6. Protect wp-admin directory
7. Protect sensitive files by type
8. Stop users from injecting malicious code via dashboard editors. Place the following line in your wpconfig - define('DISALLOW_FILE_EDIT', true);

Directory Root .htaccess Snippets

#Options -Indexes
#Disable Directory View
#Secure Config File
<Files wp\-config\.php>
Order Deny, Allow
Deny from all
Allow from xxx.xxx.xxx (your personal IP whitelist)
</Files>

#Secure Range of IP to Config File
#<Files wp\-config\.php>
#Order Deny, Allow
#Deny from all
#Allow from xxx.xxx. (your personal IP whitelist)
#</Files>

#Protect WordPress imstall.php from revealing any info to hackers
#<Files install.php>
#Order Allow, Deny
#Deny from all
#Satisfy all
#</Files>

#Protect Sensitive Files by File Type.
#<Files "\.(htaccess|ini|php)$">
#Order Deny, Allow
#Deny from all
#Allow from xxx.xxx.xxx
#</Files>

# Custom IP BLACKLIST
#<Limit GET POST PUT>
#Order Allow,Deny
#Allow from all
#Deny from xxx.xxx.xxx.xx
#</Limit>

wp-admin Directory .htaccess snippets
# Protect WP-Admin Files
<FilesMatch "*.*">
Order Deny, Allow
Deny from all
Allow from xxx.xxx.xxx
</FilesMatch>

# Secure WP-admin directory
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{REMOTE_ADDR} !^123\.456\.789
RewriteRule ^(.*)$ - [F,L]
</IfModule>