by: Web

I just installed WordPress on my server and the first concern? Security!

We will cover the following points:

  • Fail2Ban
  • WP Fail2Ban
  • 2FAS Prime
  • Loginizer
  • Disable XML-RPC-API
  • WP Activity Log
  • Manual Configurations
  • Multi-Site
  • Multi-Domain
  • WP MU Domain Mapping
  • WAF and CDN
  • Duplicator

If you have control of your server (like a VPS, not Godaddy, etc.) it is mandatory to have Fail2Ban securing SSH, but it can also be used with WordPress. If it is not set up yet, read the following post about Increasing Security with Fail2Ban on Ubuntu 20.4 [Link].

Inside your WordPress Dashboard, search for and install the plugin WP Fail2Ban (by Charles Lecklider) and activate it.

Then go to your Linux terminal and add the Filter and the Jail:

sudo curl https://plugins.svn.wordpress.org/wp-fail2ban/trunk/filters.d/wordpress-hard.conf > /etc/fail2ban/filter.d/wordpress.conf

If it does not work, get the file here [wordpress.conf] and place it in: /etc/fail2ban/filter.d/

Next, edit the jail file:

sudo nano /etc/fail2ban/jail.d/wordpress.conf

Add the following configuration to the newly created file:

[wordpress]
enabled = true
filter = wordpress
logpath = /var/log/auth.log
port = http,https

Restart the Fail2Ban service:

sudo service fail2ban restart

Test by attempting a failed login on your WordPress site before considering yourself protected. In my case it did not work right away and I had to troubleshoot it.

Implement 2FA (Two-Factor Authentication) with the 2FAS Prime (by Two Factor Authentication Service Inc) plugin.

Then go to Users in the left menu and enable 2FA for your user. It is self-explanatory and only requires the Google Authenticator app to scan the QR code and enter the generated temporary code.

Run a quick environment check with Loginizer (by Softaculous). After installing and activating it, find its menu on the left side.

On the first page, the analysis may reveal opportunities such as changing file permissions to prevent modification:

sudo chmod 444 /var/www/wordpress/wp-config.php

You can now disable, delete, or simply leave this plugin installed.

If you do not use any API that requires XML-RPC, disable this feature as it can be a vulnerability.

Install and activate the Disable XML-RPC-API (by Neatmarketing) plugin. No further action is needed.

If the website will have many users, it is recommended to install the WP Activity Log plugin (by WP White Security). It provides useful information about user activity.

Edit the .htaccess file to prevent directory listing:

sudo nano /var/www/wordpress/.htaccess

Add the following:

Options -Indexes

Configure Apache:

sudo nano /etc/apache2/apache2.conf

Make sure .htaccess files can override configurations:

<Directory /var/www/>
...
     AllowOverride All
     ServerSignature Off
...
</Directory>

As a manual alternative to disable xmlrpc.php, append the following to .htaccess:

# BEGIN Disable XML-RPC.PHP

<Files xmlrpc.php>
Order Deny,Allow
Deny from all
</Files>

# END Disable XML-RPC.PHP

Also, disable the execution of PHP files in the uploads directory:

sudo nano /var/www/wordpress/wp-content/uploads/.htaccess

Add the following:

<Files *.php>
deny from all
</Files>

Restart Apache:

sudo chmod 444 /var/www/wordpress/.htaccess
sudo chmod 444 /var/www/wordpress/wp-content/uploads/.htaccess
sudo chown www-data: -R /var/www/
sudo systemctl restart apache2

If the purpose of this server is to host multiple websites, enable Multi-Site. It creates a network where many websites can be managed from a single WordPress installation.

The multiple sites would use one of the following address formats:

example.com/site1
example.com/site2

OR

site1.example.com
site2.example.com

For more flexibility, use Multi-Domain to support multiple domain addresses:

example.com
anotherexample.com

sudo nano /var/www/wordpress/wp-config.php

Append the following lines:

/* Multisite */
define('WP_ALLOW_MULTISITE', true);

Go to WP Admin and navigate to Tools > Network Setup, then select the subdomain option.

The next page will show the configuration for .htaccess. Copy and paste it as instructed.

Refresh the browser and a new option will appear in the top menu.

The multi-domain functionality works best with the WordPress MU Domain Mapping plugin (by Donncha O Caoimh).

It is also good practice to implement a Web Application Firewall (WAF) on the server or through a third-party Content Delivery Network (CDN).

A recommended WAF plugin is Wordfence Security – Firewall & Malware Scan (by Wordfence). Cloudflare [Link] is a well-known CDN provider that offers free services as well as additional paid features.

For backing up or migrating websites, the recommended plugin is Duplicator (by Snap Creek).