My security solutions so far:
WordPress
- Make all new posts private (in WordPress)
- Don’t use any modules, the more third party software I add the less secure the repo becomes
- Two factor authentication ( this would break the no third party module rule above)
Apache
- Force https (in .htaccess)
- Protect web repository using .htpasswd (in .htpasswd)
- Two factor authentication (not sure if it can be done on a server level? )
- Allow access to server only from my country (in .htaccess)