Whats your VPS Ubuntu/Debian Setup & Hardening for Wordpress blogs process?

I have not used any hardening on my VPS now and did pretty much everything with CloudPanel or managed hosting. I am curious what the setup process of others are? Do you do any hardening, if yes, what kind? Did you followed any useful guides in the past, which? I heard good stuff about WordFence but I think that doesn't protect the VPS setup any further!? Thanks!

Imunify360 is a very good security app, and has WP protection built-in into it too, I would recommend you to install that

i've looked at a presentation and they look like they are ''selling me'' the modsecurity waf. am i missing something ? i feel like they are a joke
from their main page, from the menu of Imunity360 it says ... Multi-layer server protection with intuitive UI and automation. Note the word SERVER....when someone says they are offering server security, and then i findout they are actually talking about modesecurity security, which is (1)free (2) it's for application, not for server. meaning it protects the applications like wordpress.,
not a good impression they are portraing

i see they also offer antivirus ... why not just promote that and be honest about they're real product. no, they have to exagerate and sell me free stuff

Claudiu said:

i've looked at a presentation and they look like they are ''selling me'' the modsecurity waf. am i missing something ? i feel like they are a joke

from their main page, from the menu of Imunity360 it says ... Multi-layer server protection with intuitive UI and automation. Note the word SERVER....when someone says they are offering server security, and then i findout they are actually talking about modesecurity security, which is (1)free (2) it's for application, not for server. meaning it protects the applications like wordpress.,
not a good impression they are portraing

i see they also offer antivirus ... why not just promote that and be honest about they're real product. no, they have to exagerate and sell me free stuff

Click to expand...

I agree with you, they are selling mod security rules, but they have modified the rules to work in a better way.
It also helps server-side security for some instances; hardening the server is not something you can do automatically.

BertIsFat said:

Do you do any hardening, if yes, what kind? Did you followed any useful guides in the past, which? I heard good stuff about WordFence but I think that doesn't protect the VPS setup any further!?

Click to expand...

For the server:
- disable ssh password login and setup key-based ssh logins
- setup a new user, change root password, disable root login for ssh
- install UFW, disable all unnecessary ports.
- setup fail2ban and ip Allowlist for ssh
- remove all unnecessary packages and stuff like telnet,ftp etc
- setup iptables for basic intrusion detection
- setup autoupdates.
- General OpenSSH hardening (disabling password-logging, setting MaxRetries etc)

For WordPress:
- Disable wp_config access
- disable requesting .htaccess file itself
- disable php file execution from wp_uploads folder
- preferably disable xml-rpc and Post-by-Email if you are not using it
- Unset headers revealing version/vendor strings
- disable directory browsing
- disable indexing of debug logs from search engines

Here are a few gists with htaccess describing how to do these:
https://gist.github.com/Zodiac1978/d25a8f3aebba7cd1c01c
https://gist.github.com/nielslange/044d6f81c59f5418e58cbe617de5976f

Here are some guides:
https://github.com/imthenachoman/How-To-Secure-A-Linux-Server
https://www.digitalocean.com/community/tutorials/how-to-harden-openssh-on-ubuntu-20-04
https://cets.seas.upenn.edu/answers/linux-best-practices.html

https://www.digitalocean.com/community/tutorials/an-introduction-to-securing-your-linux-vps

Thanks a lot for that!