Chrjoh88

Solid Base .htaccess

Creating a solid base for your .htaccess file. Currently includes RewriteBase, Security (against indexes, files, etc.), and Expires Headers (caching, performance).

• The URL REWRITES would go at the top of the file.
• The SECURITY and the WEB PERFORMANCE can go towards the bottom... before and WordPress or WP Super Cache items.
• UPDATE 2013-08-21: Added code for forcing either non-www or www. on URLs. Also added the MultiViews option.
• UPDATE 2013-08-23: Added specific code for wp-config.php
• UPDATE 2013-10-04: Increased favicon expire time.
• UPDATE 2014-02-05: Removed the Force URL rewrites since there's more than one option.

Chrjoh88

Hardening WP Security

A shortened, actionable version of the full punchlist

1. Sync your entire live site down to your local repo
2. Change the WordPress default admin user + generate a new password
3. Remove any users that aren’t supposed to be there, or that are no longer in use
4. Update WordPress (in case you need to update it manually: https://gist.github.com/ericrasch/4192dc480398a896d4d58b5afe08a1d0)
5. Update all WordPress plugins
6. Remove unused plugins

Chrjoh88

Hardening WordPress

Change file permissions

Run the following commands:

find /path/to/your/wordpress/install/ -type d -exec chmod 755 {} \;

find /path/to/your/wordpress/install/ -type f -exec chmod 644 {} \;

Chrjoh88

###############################################################################
# The MIT License
#
# Copyright 2012-2014 Jakub Jirutka <jakub@jirutka.cz>.
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to deal
# in the Software without restriction, including without limitation the rights
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
# copies of the Software, and to permit persons to whom the Software is

Chrjoh88

ADD RULE with PORT and IPADDRESS
	sudo iptables -A INPUT -p tcp -m tcp --dport port_number -s ip_address -j ACCEPT

ADD RULE for PORT on all addresses
	sudo iptables -A INPUT -p tcp -m tcp --dport port_number --sport 1024:65535 -j ACCEPT

DROP IPADRESS
	sudo iptables -I INPUT -s x.x.x.x -j DROP

VIEW IPTABLES with rule numbers

Chrjoh88

Debian 8 Hardening

1. Update root's mail recipient. Open /etc/aliases replacing administrator@example.tld with an administrator's email address. This is where logs will be emailed.

   root:     administrator@example.tld
   

2. Update the the default umask to 027. Edit the file /etc/init.d/rc and change the following setting:

umask 027