Wordpress Security Enhancement on Server End
By: Naman Vyas
Tags: WordPress, Devops Practice, Best Practices, DevOps, Security

WordPress security is a topic of huge importance. Google blacklists thousands websites every day for malware and phishing every week. It is very important to pay attention to the WordPress security best practices.



A hacked WordPress site can cause serious damage to your business revenue and reputation. Hackers can steal user information, passwords, install malicious software or may be worse you may be paying a hacker to regain you access to your website.

To accomplish the security best practices keep updating wordpress regularly, keeping a strong password, using security plugins etc. Hosting wordpress also plays an important role in securing websites.

$$ What to do?

Secure wordpress’s “wp-config” file and hosting it securely using Apache web server is illustrated below

#Securing Config File

wp-config is a key file which stores credentials, keys, authentication tokens etc. If an intruder will able to gain access to this file, it can gain access to several things in infrastructure. As a best practice, Config files should not be accessible over the hosted domain.

To protect config or any other php file containing vulnerable information:

Firstly, Never commit this file to our source code management system (Git, SVN, Bitbucket etc). These files should not be accessible by your webserver directly. Only specified server users should have permission to gain access to the file that to read only. The config should always be accessed from a distinct directory which is not accessible publicly. Now, the question is how? because wp-config is a necessary file.

To accomplish, simply include the below piece of code to access files from a distinct and secure directory.

** remove the entire data from the file first. The file should only contain below piece of code

<?php

include(‘/Path-to-non-accessible-directory/<name_of_file>.php’);

?>

“<name_of_file>.php” will contain the actual content of wp-config file. Let’s assume name as config.php

5. Use variables to access credentials in a config file to make the entire setup more robust, secure and to effectuate the credentials during DR

a) Create the distinct or secure directory for the config file.

b) Now, Install a php composer to the corresponding directory. ((“https://getcomposer.org/download/"))

c) Run “composer init” (This will create a composer.json file)

d) Run “ composer require vlucas/phpdotenv “ (This will install the required package)

e) Add below lines at the top of the config.php file, it will allow the php to read credentials from env file.

/ Load .ENV Support Library /

require_once(__DIR__ . ‘/vendor/autoload.php’);

$dotenv = Dotenv\Dotenv::createMutable(__DIR__);

$dotenv->load();

f) Create an .env file and save the credentials to it.

g) Now, use a variable to call these credentials. Example as below

/ *MySQL database username* /

define(‘DB_USER’, getenv(‘DB_USER’));

/* MySQL database password */

define(‘DB_PASSWORD’, getenv(‘DB_PASSWORD’));



DB details, credentials, tokens etc can be accessed using this mechanism.

This mechanism will avail more security to the config files. To secure admin-panel, always choose strong range password and rotate it in specified or required intervals

#Webserver security

Webserver security and harding plays an important role, below illustrated are few things to enhance Apache security and robustness. The exemplified steps will differ according to specified organizational requirements

Disabling server tokens: It will not expose the web server version details over the internet.

Eg:

TraceEnable off

ServerSignature Off

ServerTokens Prod Enable XSS protection: Helps to prevent Cross Site Scripting (XSS)

Eg: Header set X-XSS-Protection “1; mode=block” Protect X-Frame (one can deny the use of frame if needed) it will help to prevent Clickjacking Attack

Eg: Header always append X-Frame-Options SAMEORIGIN Setting Max age and Transport security header. The Strict Transport Security feature lets a web site inform the browser that it should never load the site using HTTP and use secure HTTPS layer only

Eg: Header set Strict-Transport-Security “max-age=31536000; includeSubDomains; preload” Allowing CORS rules, specified methods and headers in accordance with specified requirements. SetTimeout and put a limit on request size, this will also help to prevent DOS/DDOS kind of attacks. By default Apache has no limit on the size of requests. SSL is an additional layer of security you are adding into Web Application.It secures communication in an encrypted manner over the Internet Restricting directory access and Indexing or browsing. By default Apache list all the content of Document root directory in the absence of index file Restricting direct access via IP, always use DNS names.

Preventing SQL injections, Cross site-scripting,Server Side Includes, CGI Execution, USer groups changes etc can be applied to make the web server more robust from attackers

Hope this will be helpful.