WordPress hardening

Secure file uploads in a WordPress plugin An upload form is the shortest way from the internet to the server’s disk. If a plugin accepts a file because its name ends with .pdf or because the browser said Content-Type: application/pdf, an attacker uploads shell.php with a fake type and calls it in the browser. WordPress…

Configure a Content Security Policy for WordPress A Content Security Policy (CSP) header tells the browser which sources a page may load scripts, styles, images, fonts and frames from, and whether inline scripts may run. With a strict policy, an XSS injection that slips through cannot run its script, because the browser refuses it. The…

Rate limiting for the WooCommerce checkout, registration and coupons Card testing bots use small shops to check stolen card numbers: they place hundreds of cheap orders, each with a different card, and the shop pays the gateway fees and risks its merchant account. Other bots register thousands of accounts or try coupon codes until one…

Content Security Policy for the WooCommerce checkout Card skimmers on online shops work by getting one extra script onto the checkout page: through a hacked plugin, a compromised third-party script or an injected database option. The script reads the card fields and sends them to the attacker’s server. A Content Security Policy tells the browser…

SSH keys only: disable password login on a WordPress server Every server with an open SSH port gets thousands of login attempts a day from bots that try common user names and passwords. With key authentication and passwords switched off, these attempts cannot succeed. The change takes five minutes; the only risk is locking yourself…

Harden a Linux WordPress server with Fail2ban and unattended upgrades A WordPress server on the internet is scanned all the time by bots looking for weak passwords, open admin endpoints and unpatched software. Two tools cover two different layers. Fail2ban reads the logs, finds repeated failures from one IP and blocks it in the firewall.…

Block brute force attacks on wp-login.php by implementing PHP-based login attempt rate limiting, adding CAPTCHA via the WordPress hooks, and hardening with .htaccess rules.

Set correct Linux file permissions for WordPress directories and use .htaccess rules to block PHP execution in the uploads folder, stopping a common malware vector.

Block the ?author=N redirect and disable the REST API users endpoint to prevent attackers from discovering WordPress usernames.