sudo nano \/etc\/fail2ban\/jail.d\/wordpress.conf<\/pre>\nAdd the following configuration to the newly created file:<\/p>\n
[wordpress]\r\nenabled = true\r\nfilter = wordpress\r\nlogpath = \/var\/log\/auth.log\r\nport = http,https<\/pre>\nRestart the Fail2Ban service:<\/p>\n
sudo service fail2ban restart<\/pre>\nTest by attempting a failed login on your WordPress site before considering yourself protected. In my case it did not work right away and I had to troubleshoot it.<\/p>\n
Implement 2FA (Two-Factor Authentication) with the 2FAS Prime<\/strong> (by Two Factor Authentication Service Inc) plugin.<\/p>\nThen go to Users in the left menu and enable 2FA for your user. It is self-explanatory and only requires the Google Authenticator app to scan the QR code and enter the generated temporary code.<\/p>\n
Run a quick environment check with Loginizer<\/strong> (by Softaculous). After installing and activating it, find its menu on the left side.<\/p>\nOn the first page, the analysis may reveal opportunities such as changing file permissions to prevent modification:<\/p>\n
sudo chmod 444 \/var\/www\/wordpress\/wp-config.php<\/pre>\nYou can now disable, delete, or simply leave this plugin installed.<\/p>\n
If you do not use any API that requires XML-RPC, disable this feature as it can be a vulnerability.<\/p>\n
Install and activate the Disable XML-RPC-API<\/strong> (by Neatmarketing) plugin. No further action is needed.<\/p>\nIf the website will have many users, it is recommended to install the WP Activity Log<\/strong> plugin (by WP White Security). It provides useful information about user activity.<\/p>\nEdit the .htaccess file to prevent directory listing:<\/p>\n
sudo nano \/var\/www\/wordpress\/.htaccess<\/pre>\nAdd the following:<\/p>\n
Options -Indexes<\/pre>\nConfigure Apache:<\/p>\n
sudo nano \/etc\/apache2\/apache2.conf<\/pre>\nMake sure .htaccess files can override configurations:<\/p>\n
<Directory \/var\/www\/>\r\n...\r\n AllowOverride All\r\n<\/strong> ServerSignature Off\r\n...\r\n<\/Directory><\/pre>\nAs a manual alternative to disable xmlrpc.php<\/strong>, append the following to .htaccess<\/strong>:<\/p>\n# BEGIN Disable XML-RPC.PHP\r\n\r\n<Files xmlrpc.php>\r\nOrder Deny,Allow\r\nDeny from all\r\n<\/Files>\r\n\r\n# END Disable XML-RPC.PHP<\/pre>\nAlso, disable the execution of PHP files in the uploads directory:<\/p>\n
sudo nano \/var\/www\/wordpress\/wp-content\/uploads\/.htaccess<\/pre>\nAdd the following:<\/p>\n
<Files *.php>\r\ndeny from all\r\n<\/Files><\/pre>\nRestart Apache:<\/p>\n
sudo chmod 444 \/var\/www\/wordpress\/.htaccess\r\nsudo chmod 444 \/var\/www\/wordpress\/wp-content\/uploads\/.htaccess\r\nsudo chown www-data: -R \/var\/www\/\r\nsudo systemctl restart apache2<\/pre>\nIf the purpose of this server is to host multiple websites, enable Multi-Site<\/strong>. It creates a network where many websites can be managed from a single WordPress installation.<\/p>\nThe multiple sites would use one of the following address formats:<\/p>\n
example.com\/site1
\nexample.com\/site2<\/p>\n
OR<\/p>\n
site1.example.com
\nsite2.example.com<\/p>\n
For more flexibility, use Multi-Domain<\/strong> to support multiple domain addresses:<\/p>\nexample.com
\nanotherexample.com<\/p>\n
sudo nano \/var\/www\/wordpress\/wp-config.php<\/pre>\nAppend the following lines:<\/p>\n
\/* Multisite *\/\r\ndefine('WP_ALLOW_MULTISITE', true);<\/pre>\nGo to WP Admin and navigate to Tools > Network Setup, then select the subdomain option.<\/p>\n
The next page will show the configuration for .htaccess<\/strong>. Copy and paste it as instructed.<\/p>\nRefresh the browser and a new option will appear in the top menu.<\/p>\n
![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2020\/10\/Screenshot-from-2021-04-06-10-23-36.png\")
<\/p>\n
The multi-domain functionality works best with the WordPress MU Domain Mapping<\/strong> plugin (by Donncha O Caoimh).<\/p>\nIt is also good practice to implement a Web Application Firewall (WAF) on the server or through a third-party Content Delivery Network (CDN).<\/p>\n
A recommended WAF plugin is Wordfence Security – Firewall & Malware Scan<\/strong> (by Wordfence). Cloudflare [Link<\/a>] is a well-known CDN provider that offers free services as well as additional paid features.<\/p>\nFor backing up or migrating websites, the recommended plugin is Duplicator<\/strong> (by Snap Creek).<\/p>\n","protected":false},"excerpt":{"rendered":"I just installed WordPress on my server and the first concern? Security! We will cover […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[],"class_list":["post-405","post","type-post","status-publish","format-standard","hentry","category-web"],"_links":{"self":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/405","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=405"}],"version-history":[{"count":11,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/405\/revisions"}],"predecessor-version":[{"id":5826,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/405\/revisions\/5826"}],"wp:attachment":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=405"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=405"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=405"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}