ihfbib

Hardening WP Security

A shortened, actionable version of the full punchlist

1. Sync your entire live site down to your local repo
2. Change the WordPress default admin user + generate a new password
3. Remove any users that aren’t supposed to be there, or that are no longer in use
4. Update WordPress (in case you need to update it manually: https://gist.github.com/ericrasch/4192dc480398a896d4d58b5afe08a1d0)
5. Update all WordPress plugins
6. Remove unused plugins

ihfbib

#
# Name: nginx-tls.conf
# Auth: Gavin Lloyd <gavinhungry@gmail.com>
# Desc: Nginx SSL/TLS configuration for "A+" Qualys SSL Labs rating
#
# Enables HTTP/2, PFS, HSTS and OCSP stapling. Configuration options not related
# to SSL/TLS are not included here.
#
# Additional tips:
#

ihfbib

<?php
/* 
Plugin Name: Convert Custom Taxonomy to Custom Post Type 
Plugin URI: N/A
Description: A plugin to convert a Custom Taxonomy to a Custom Post Type and transfer associated metadata.
Version: 0.1 
Author: Strap1
Author URI: http:/www.hiphopinenglish.com

/** Convert Taxonomy '%name%' to CPT '%name%' **/

ihfbib

# Read  http://codex.wordpress.org/Nginx
#       http://wiki.nginx.org/Pitfalls
#       http://wiki.nginx.org/QuickStart
#       http://www.queryadmin.com/854/secure-wordpress-nginx/
#       http://tautt.com/best-nginx-configuration-for-security/
#       https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
#
#       Generate your key with: openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048
#       Generate certificate: sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/nginx/ssl/nginx.key -out /etc/nginx/ssl/nginx.crt

ihfbib

############ WordPress ####################

# Disable logging for favicon and robots.txt
location = /favicon.ico {
  try_files /favicon.ico @empty;
  access_log off;
  log_not_found off;
  expires max;
}

ihfbib

location ~* /xmlrpc.php$ {
    allow 172.0.1.1;
    deny all;
}

if ($request_method !~ ^(GET|POST)$ ) {
    return 444;
}

location ~* /(?:uploads|files|wp-content|wp-includes|akismet)/.*.php$ {

ihfbib

# https://codex.wordpress.org/Nginx
# Global restrictions configuration file.
# Deleted config for .htaccess, robots.txt, favicon restriction
# because they are already included in the default
# domain.conf created by ispconfig

# Block PHP files in uploads, content, and includes directory.
location ~* /(?:uploads|files|wp-content|wp-includes)/.*\.php$ {
  deny all;
}

ihfbib

<?php

// This can be found in the Symfony\Component\HttpFoundation\Response class

const HTTP_CONTINUE = 100;
const HTTP_SWITCHING_PROTOCOLS = 101;
const HTTP_PROCESSING = 102;            // RFC2518
const HTTP_OK = 200;
const HTTP_CREATED = 201;
const HTTP_ACCEPTED = 202;

ihfbib

<?php

namespace App\Models;

use Illuminate\Database\Eloquent\Model;

class City extends Model
{
    /**
     * @var array

ihfbib

site:*/sign-in
site:*/account/login
site:*/forum/ucp.php?mode=login
inurl:memberlist.php?mode=viewprofile
intitle:"EdgeOS" intext:"Please login"
inurl:user_login.php
intitle:"Web Management Login"
site:*/users/login_form
site:*/access/unauthenticated
site:account.*.*/login