My security solutions so far:
WordPress
- Make all new posts private (in WordPress)
- Don’t use any modules, the more third party software I add the less secure the repo becomes
- Two factor authentication ( this would break the no third party module rule above)
Apache
- Force https (in .htaccess)
- Protect web repository using .htpasswd (in .htpasswd)
- Two factor authentication (not sure if it can be done on a server level? )
- Allow access to server only from my country (in .htaccess)
Related Posts:
- Improve wordpress security by hiding non public resources
- Does this .htaccess security setting really work?
- File and directory permissions
- Using “wordpress_logged_in” to restrict direct access to uploads folder in 2021
- WordPress URL/Folder ReWrite using Htaccess
- Which WordPress scripts need to be executable for a fresh installation?
- Blocking access to wp-login via htaccess not working
- Attach to wp-login.php and xmlrpc.php
- XMLRPC filtering through htaccess not working
- Restricting user login by IP address
- WordPress: Adding Security
- How do I test to ensure that my wp-config file is protected?
- WordPress not seeing .htaccess rules
- Rules in .htaccess only if the requested URL is /wp-admin
- Disable directory browsing of uploads folder
- Strange behaviour of is_user_logged_in() and get_current_user_id()
- Selectively Disabling PHP via .htaccess in Root Directory
- Should I prevent access to .htaccess and wp-config.php files?
- Blocking wp-login in HTACCESS has also blocked password protected pages
- Basic Auth .htaccess on wp-login, but allow logout from woocommerce
- Using htaccess to prevent spam through wp-comments-post.php
- Restrict Content for only Contributors via .htaccess
- Allowing access to certain WordPress created pages or posts with htaccess / htpasswd
- Change Login URL Without Plugin
- htaccess rewrite conflict with wordpress rules and ssl
- Plugin to edit htaccess file
- Options for restricting access to wp-admin
- Remove year and month in URL using .htaccess
- Unable to access WP admin
- Move wordpress to folder without changing urls
- Using WordPress only for the backend, and using AngularJS as a frontend
- Two domains on one WordPress Installation
- Protect Upload Folder Files With Ampersand Problem
- Is it possible to dynamically redirect URL using htaccess?
- .htaccess and WordPress Admin Bar
- Setup Permanent 301 Redirects after moving to Https [closed]
- Force www to non-www on a subdomain in WordPress?
- How to Redirect huge numbers of URLs to another URLs?
- WP site URL changed to have HTTPS but still homepage does not redirect
- Struggling with add_rewrite_rule
- Giving WordPress its own subdirectory – nginx
- Cannot mask WordPress page URL using .htaccess
- How can I make an htaccess file on a Mac? [closed]
- .htaccess ‘down for maitenance’ and WordPress
- WordPress overrides custom 404 page with it’s own
- New installation can’t be found due to htaccess of the original non-WordPress site
- Fixing custom 404 pages broken by WordPress in a subdirectory
- Case insensitive header params for API request
- 301 Redirect domain Sub-folders to Subdomain subfolder
- Drawbacks to using Options -Indexes
- Override 404 page with htaccess
- Htaccess Rewrite reverts to default .htaccess file
- what could cause the htaccess file to be modified?
- change permalink structure with htaccess without SEO impact
- How to Change The WordPress Login URL Without Plugin
- Site in subfolder – all pages work except home
- Can’t upload .htaccess after editing in notepad
- Directing subdomain to main domain and keeping the subdomain format with .htaccess
- Remove /sites/25/ from image URLS
- How disable canonical redirect wp-signup
- .htaccess RewriteRule always overwritten – how to prevent?
- Forcing HTTPS with WordPress on AWS
- WordPress Example Code for Blocking Referrer Spam
- How could a .htaccess with authentication suddenly appear or change?
- Force non-ssl on WordPress RSS feeds in htaccess, using cloudflare
- Password protect directory but not files
- Protect wp-login, but get an internal server error
- Local wordpress install only shows home page, all other pages Not Found
- WordPress is rewrite my htacces file. I adding a font rule
- Redirect within wordpress template/plugin
- Redirect wrong links WordPress
- fix 302 redirection error on https
- main-domain of wordpress keep redirecting to subdomain
- Accepting special characters in querystring
- Centos 7.2 wordpress on going to /admin shows Forbidden You don’t have permission to access /wordpress/wp-admin/ on this server
- Multiple wordpress installations on same server
- Cannot access subdirectory subpages
- WordPress constantly running out of memory
- How can I create a smarter .htaccess file that will add a directory?
- .htaccess found in every folder
- Help with htaccess querystring rewrite
- How do I properly redirect requests to WordPress subdirectory?
- Redirect default pagination page to template page’s pagination
- Install second wordpress in root subfolder, Error 404
- Leverage browser caching
- WordPress URL not working?
- How to direct users to a subcatalog
- .htaccess redirects for posts in new directory and new domain
- How to block wordpress admin by htaccess
- htaccess conflict between WordPress and password protected subdirectory
- Using subdomain as primary domain
- Redirect from domain.com to subdomain.domain.com
- MAMP.app & .htaccess – Can’t override after config
- register_post_type and register taxonomy and htaccess
- Why ‘Authorization Required’ is coming on wordpress login
- Restricting direct downloads of wp content files, but allow them on the website.
- Forward blog requests to another URL
- Couple questions about .htaccess, login page, updates
- .htaccess rewrite rule stopped working for wordpress site after moving server
- .htaccess seems to be required but I can not find it