Tool to securely and efficiently wipe devices and partiitions for Linux - joedefen/dwipe
- Defense in Depth
- Least Privilege
- Separation of Duties
- Secure by Design
- Keep It Simple, Stupid (KISS)
NO - Security by Obscurity
get SSL certificate
backup site
disable caching (?)
install plugin Really Simple SSL
https://wordpress.org/plugins/really-simple-ssl/
re-save permalinks
Better Search Replace (plugin)
replace "http://website.com" to "https://website.com"
enable caching
test
check and find problems:
https://www.whynopadlock.com
https://jitbit.com/sslcheck/
- Block all access "xmlrpc.php" and temporary block access to "wp-login.php" (by IP)
BEGIN Disable XML-RPC.PHP
<Files "xmlrpc.php">
Order Deny,Allow
Deny from all
</Files>
END Disable XML-RPC.PHP
BEGIN Limit Access to WP-LOGIN.PHP
<Files "wp-login.php">
Order Deny,Allow
Deny from all
Allow from 1.2.3.4
</Files>
END Limit Access to WP-LOGIN.PHP
-
Change default "admin" username if used
-
Set plugin to control login attempts
https://wordpress.org/plugins/loginizer/
(4. Password protect access to "wp-login.php" ... this doesn't work on my server, and it's apparently not the best solution)
BEGIN Password Protect WP-LOGIN.PHP
<FilesMatch "wp-login.php">
AuthUserFile /home/user/.htpasswd
AuthName "Authorized Only"
AuthType Basic
Require valid-user
</FilesMatch>
END Password Protect WP-LOGIN.PHP
BEGIN Disable XML-RPC.PHP
<Files "xmlrpc.php">
Order Deny,Allow
Deny from all
</Files>
