How to keep WordPress & hosting secure

Highest risk level

1. Use plugins you trust and which are updated frequently
2. Safe WordPress hosting (server level security and firewall)
3. Use the latest stable PHP version (at least 7.4 – 2021)
4. Smart usernames and passwords
5. Newest WordPress version

Medium risk level

1. Secure /wp-admin section
2. 2FA for admins
3. DDoS-protection
4. HTTPS – SSL-certificate
5. Secure wp-config.php
6. deactivate XML-RPC
7. Hide WordPress-version
8. HTTP-security headers
9. WordPress-security-plugins
10. Database security

Low risk level and extra safety

1. Safe connections
2. Bestands- en servermachtigingen
3. Bewerken uitschakelen in het Dashboard
4. Secure Hotlinking
5. WordPress-back-ups and external database backups

 

6. Secure /wp-admin section

De meest gebruikelijke en waarschijnlijk eenvoudigste manier om de URL van je WordPress inlogpagina te wijzigen, is met behulp van een gratis plugin zoals WPS Hide Login, die door meer dan 400.000 gebruikers actief wordt gebruikt.

 

 

 

Note: to ensure the code below is not overwritten by WordPress, place it outside the # BEGIN WordPress and # END WordPress tags in the .htaccess file. WordPress can overwrite anything between these tags.

# Block the include-only files.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^wp-admin/includes/ - [F,L]
RewriteRule !^wp-includes/ - [S=3]
RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
RewriteRule ^wp-includes/theme-compat/ - [F,L]
</IfModule>

<?php
define('DB_NAME', 'Your_DB'); // name of database
define('DB_USER', 'DB_User'); // MySQL user
define('DB_PASSWORD', 'DB_pass'); // and password
define('DB_HOST', 'localhost'); // MySQL host

// The WordPress Security Keys

define('AUTH_KEY', 'Your_key_here');
define('SECURE_AUTH_KEY', 'Your_key_here');
define('LOGGED_IN_KEY', 'Your_key_here');
define('NONCE_KEY', 'Your_key_here');
define('AUTH_SALT', 'Your_key_here');
define('SECURE_AUTH_SALT', 'Your_key_here');
define('LOGGED_IN_SALT', 'Your_key_here');
define('NONCE_SALT', 'Your_key_here');

// The WordPress database table prefix
$table_prefix = 'wp_'; // only numbers, letters and underscore

# BEGIN WordPress

Note that this won’t work well on Multisite, as RewriteRule ^wp-includes/[^/]+\.php$ - [F,L] would prevent the ms-files.php file from generating images. Omitting that line will allow the code to work, but offers less security.

 

18. Secure Hotlinking

Hotlinking voorkomen in Apache
Om hotlinking in Apache te voorkomen, voeg je de volgende code toe aan je .htaccess-bestand.

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?yourdomain.com [NC]
RewriteRule \.(jpg|jpeg|png|gif)$ http://dropbox.com/hotlink-placeholder.jpg [NC,R,L]

De tweede rij definieert de toegestane verwijzer – de site die rechtstreeks naar de afbeelding mag linken. Dit moet jouw website zijn. Als je meerdere sites wilt toestaan, kan je deze dupliceren en de verwijzende URL vervangen. Als je complexere regels wilt genereren, bekijk dan deze htaccess hotlink-beschermingsgenerator.

Hotlinking voorkomen in NGINX
Om hotlinking in NGINX te voorkomen, kan je de volgende code toevoegen aan het configuratiebestand.

location ~ .(gif|png|jpe?g)$ {
valid_referers none blocked ~.google. ~.bing. ~.yahoo yourdomain.com *.yourdomain.com;
if ($invalid_referer) {
return 403;
}
}