a1dert/lh-tickets-test — Issue #248: WordPress security recommendations
Author: a1dert
Created: 2011-11-30 12:00:36+00:00
State: open
Labels: resolved, wordpress security

Imported from lighthouse. Original ticket at: http://redtape.lighthouseapp.com/projects/59696/tickets/241. Created by Matthew Stibbe - 2011-04-27T11:26:52Z

I can see that you have added some tickets for WordPress security. Thanks for this. I found these recommendations on WordPress.org. They are too technical for me but I would like you to review them and tell me which ones need to be implemented and how long it would take. I will then confirm that you can go ahead and do them.

http://codex.wordpress.org/Hardening_WordPress

---

This directories should be with an empty index.php file.
Hackers should not know about our files. See on http://turbinehq.com/wp-includes/css/

> wp-includes/

> wp-includes/css/

> wp-includes/images/

> wp-includes/js/

> wp-includes/js/crop/

> wp-includes/js/imgareaselect/

> wp-includes/js/jcrop/

> wp-includes/js/jquery/

> wp-includes/js/scriptaculous/

> wp-includes/js/thickbox/

> wp-includes/js/tinymce/

> wp-includes/js/tinymce/langs/

> wp-includes/js/tinymce/plugins/

> wp-includes/js/tinymce/themes/

> wp-includes/js/tinymce/themes/advanced/

> wp-includes/js/tinymce/themes/advanced/img/

> wp-includes/js/tinymce/themes/advanced/js/

> wp-includes/js/tinymce/themes/advanced/skins/

> wp-includes/js/tinymce/themes/advanced/skins/default/

> wp-includes/js/tinymce/themes/advanced/skins/default/img/

> wp-includes/js/tinymce/themes/advanced/skins/o2k7/

> wp-includes/js/tinymce/themes/advanced/skins/o2k7/img/

> wp-includes/js/tinymce/themes/advanced/skins/wp_theme/

> wp-includes/js/tinymce/themes/advanced/skins/wp_theme/img/

> wp-includes/js/tinymce/utils/

> wp-includes/Text/

> wp-includes/Text/Diff/

> wp-includes/Text/Diff/Engine/

> wp-includes/Text/Diff/Renderer/

> wp-includes/pomo/

> wp-includes/theme-compat/

> wp-content/themes/redtapetheme/images/

> wp-content/themes/redtapetheme/js/

> wp-content/themes/redtapetheme/cache/

> wp-content/themes/redtapetheme/media/

> wp-content/themes/redtapetheme/fancybox/

> wp-content/themes/redtapetheme/styles/

> wp-content/upgrade/

> wp-content/uploads/

> wp-content/cache/

> wp-content/cache/simple-thumbs/

> wp-content/mingle-forum-skins/

> wp-content/files_mf/

> wp-admin/css/

> wp-admin/js/

> wp-admin/images/

> wp-admin/includes/

> wp-admin/maint/

---

Remove file readme.html from WP root directory. This file contains WP version. Nothing special, but there is potential security hole.

Also remove WP version from code:
Add to functions.php next line:
> remove_action ('wp_head', 'wp_generator');

---

auth. keys are default.
Generate new authentication keys and salts, using URL - https://api.wordpress.org/secret-key/1.1/salt/ and update wp-config.php.