Capo Dei Capi
BANNED
- Oct 23, 2014
- 752
- 7,253
I've been doing some research into wordpress security and I think I found the one of the best ways to secure a wordpress site without using plugins like wordfence or limit login attempt since they can use resources on a site.
The following from two sites I found seem like they work together to make a really secure wordpress without using any resource hogging plugin, if used with a really strong secret admin name and password
http://www.wpexplorer.com/htaccess-wordpress-security/
http://diegolamonica.info/secure-your-wordpress-login-without-freeze-your-server-with-additional-plugins/
I personally think that using a a security token is a better option than doing a ip restriction since your IP may change over time, but if you have a static ip such as a private vpn than that may be a better option. As for admin login I find that using 36 character name <AZ><az> and 40 character password <AZ><az><09><symbols> while using a different nickname to display to the public will pretty much prevent a brute force attack.
The following from two sites I found seem like they work together to make a really secure wordpress without using any resource hogging plugin, if used with a really strong secret admin name and password
Code:
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteCond %{HTTP_COOKIE} !^.*secure\-dlm\-cookie=12345.*$ [NC]
RewriteRule wp-login.php 403.html [NC,L,R=403]
</IfModule>
# Deny access to wp-config.php file
<files wp-config.php>
order allow,deny
deny from all
</files>
# Deny access to all .htaccess files
<files ~ "^.*\.([Hh][Tt][Aa])">
order allow,deny
deny from all
satisfy all
</files>
# Block wp-includes folder and files
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^wp-admin/includes/ - [F,L]
RewriteRule !^wp-includes/ - [S=3]
RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
RewriteRule ^wp-includes/theme-compat/ - [F,L]
</IfModule>
# Disable access to all file types except the following
Order deny,allow
Deny from all
<Files ~ ".(xml|css|js|jpe?g|png|gif|pdf|docx|rtf|odf|zip|rar)$">
Allow from all
</Files>
# Disable directory browsing
Options All -Indexeshttp://diegolamonica.info/secure-your-wordpress-login-without-freeze-your-server-with-additional-plugins/
I personally think that using a a security token is a better option than doing a ip restriction since your IP may change over time, but if you have a static ip such as a private vpn than that may be a better option. As for admin login I find that using 36 character name <AZ><az> and 40 character password <AZ><az><09><symbols> while using a different nickname to display to the public will pretty much prevent a brute force attack.
Last edited:
