WordPress Security
Hardening Guide

# Block xmlrpc.php completely
<Files xmlrpc.php>
    Order deny,allow
    Deny from all
</Files>

location = /xmlrpc.php {
    deny all;
    access_log off;
    log_not_found off;
    return 444;
}

// Disable XML-RPC completely
add_filter( 'xmlrpc_enabled', '__return_false' );

// Remove the X-Pingback header
add_filter( 'wp_headers', function( $headers ) {
    unset( $headers['X-Pingback'] );
    return $headers;
} );

// Disable pingbacks (additional attack vector)
add_filter( 'xmlrpc_methods', function( $methods ) {
    unset( $methods['pingback.ping'] );
    unset( $methods['pingback.extensions.getPingbacks'] );
    return $methods;
} );

# Define login rate-limit zone (10 req/min per IP)
limit_req_zone $binary_remote_addr zone=wp_login:10m rate=10r/m;

location = /wp-login.php {
    limit_req zone=wp_login burst=5 nodelay;
    limit_req_status 429;
    allow 203.0.113.10;  # your IP
    deny  all;
    fastcgi_pass unix:/run/php/php8.2-fpm.sock;
    include fastcgi_params;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
}

[Definition]
failregex = ^<HOST> .* "POST /wp-login.php
            ^<HOST> .* "POST /xmlrpc.php
ignoreregex =

[wordpress-login]
enabled   = true
filter    = wordpress
logpath   = /var/log/nginx/access.log
            # For Apache: /var/log/apache2/access.log
maxretry  = 5
findtime  = 300
bantime   = 3600
action    = iptables-multiport[name=wordpress, port="80,443"]

# Install via WP-CLI
$ wp plugin install two-factor --activate --path=/var/www/html

# Verify activation
$ wp plugin status two-factor --path=/var/www/html

/**
 * Force 2FA enrollment for Administrators and Editors.
 * Redirect to profile page if 2FA is not configured.
 */
add_action( 'init', function() {
    if ( ! is_user_logged_in() ) return;

    $user = wp_get_current_user();
    $required_roles = [ 'administrator', 'editor' ];

    if ( array_intersect( $required_roles, (array) $user->roles ) ) {
        if ( class_exists( 'Two_Factor_Core' ) ) {
            $providers = Two_Factor_Core::get_enabled_providers_for_user( $user );
            if ( empty( $providers ) && ! doing_action( 'profile_update' ) ) {
                if ( ! is_admin() || ! in_array( $GLOBALS['pagenow'], ['profile.php', 'user-edit.php'] ) ) {
                    wp_redirect( admin_url( 'profile.php#two-factor-options' ) );
                    exit;
                }
            }
        }
    }
} );

/**
 * Enforce strong password policy for Admin/Editor roles.
 * Min 12 chars, uppercase, lowercase, number, special char.
 */
add_action( 'user_profile_update_errors', 'enforce_strong_password', 10, 3 );
add_action( 'validate_password_reset', 'enforce_strong_password', 10, 2 );

function enforce_strong_password( $errors, $update = null, $user = null ) {
    $pass1 = isset( $_POST['pass1'] ) ? trim( $_POST['pass1'] ) : '';
    if ( empty( $pass1 ) ) return;

    $errors_found = [];
    if ( strlen( $pass1 ) < 12 )
        $errors_found[] = 'At least 12 characters';
    if ( ! preg_match( '/[A-Z]/', $pass1 ) )
        $errors_found[] = 'One uppercase letter';
    if ( ! preg_match( '/[a-z]/', $pass1 ) )
        $errors_found[] = 'One lowercase letter';
    if ( ! preg_match( '/[0-9]/', $pass1 ) )
        $errors_found[] = 'One number';
    if ( ! preg_match( '/[\W_]/', $pass1 ) )
        $errors_found[] = 'One special character (!@#$%^&*)';

    if ( ! empty( $errors_found ) ) {
        $errors->add(
            'weak_password',
            'Password must include: ' . implode( ', ', $errors_found ) . '.'
        );
    }
}

// Prevent admins from bypassing the weak password check
add_filter( 'user_profile_update_errors', function( $errors ) {
    if ( isset( $_POST['pw_weak'] ) ) {
        unset( $_POST['pw_weak'] );
    }
    return $errors;
}, 1 );

# Block author scan enumeration
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{QUERY_STRING} author=\d
    RewriteRule ^ /? [L,R=301]
</IfModule>

# Block ?author=N enumeration
if ( $query_string ~* "author=\d+" ) {
    return 403;
}

/**
 * Restrict /wp-json/wp/v2/users to authenticated requests only.
 * Returns 401 for unauthenticated users.
 */
add_filter( 'rest_endpoints', function( $endpoints ) {
    if ( isset( $endpoints['/wp/v2/users'] ) ) {
        foreach ( $endpoints['/wp/v2/users'] as $key => $endpoint ) {
            $endpoints['/wp/v2/users'][$key]['permission_callback'] = function() {
                return current_user_can( 'list_users' );
            };
        }
    }
    if ( isset( $endpoints['/wp/v2/users/(?P<id>[\d]+)'] ) ) {
        foreach ( $endpoints['/wp/v2/users/(?P<id>[\d]+)'] as $key => $endpoint ) {
            $endpoints['/wp/v2/users/(?P<id>[\d]+)'][$key]['permission_callback'] = function() {
                return current_user_can( 'list_users' );
            };
        }
    }
    return $endpoints;
} );

// Disable author archives to prevent enumeration via URL
add_action( 'template_redirect', function() {
    if ( is_author() ) {
        wp_redirect( home_url( '/' ), 301 );
        exit;
    }
} );

// 1. Remove version from <meta name="generator">
remove_action( 'wp_head', 'wp_generator' );

// 2. Remove version query strings from scripts and styles
add_filter( 'style_loader_src', 'remove_wp_version_strings', 9999 );
add_filter( 'script_loader_src', 'remove_wp_version_strings', 9999 );

function remove_wp_version_strings( $src ) {
    if ( strpos( $src, 'ver=' ) !== false ) {
        $src = remove_query_arg( 'ver', $src );
    }
    return $src;
}

// 3. Remove version from RSS feeds
add_filter( 'the_generator', '__return_empty_string' );

// 4. Remove WP version from login page
add_filter( 'login_headerurl', function() { return home_url(); } );

# Block WordPress fingerprinting files
<FilesMatch "^(readme|license|licenc[s|e]|changelog)\.(html|txt|md)$">
    Order deny,allow
    Deny from all
</FilesMatch>

# Block backup and config disclosure files
<FilesMatch "\.(bak|config|sql|fla|psd|ini|log|sh|inc|swp|dist)$">
    Order deny,allow
    Deny from all
</FilesMatch>

$ rm /var/www/html/readme.html
$ rm /var/www/html/license.txt
$ rm -f /var/www/html/wp-admin/install.php   # if already installed

# Set owner to web server user (www-data on Ubuntu/Debian)
$ chown www-data:www-data /var/www/html/wp-config.php

# Restrict to owner read/write only (no group, no world)
$ chmod 600 /var/www/html/wp-config.php

# Move wp-config.php ONE level above web root (optional but recommended)
$ mv /var/www/html/wp-config.php /var/www/wp-config.php
# WordPress auto-discovers it one level up — no code change needed

# Verify permissions
$ ls -la /var/www/wp-config.php
→ -rw------- 1 www-data www-data

# Block direct access to wp-config.php
<Files wp-config.php>
    Order deny,allow
    Deny from all
</Files>

# Generate fresh keys from WordPress API and paste into wp-config.php
$ curl -s https://api.wordpress.org/secret-key/1.1/salt/

# Replace existing define() salt lines in wp-config.php with output above:
define( 'AUTH_KEY',         '... generated value ...' );
define( 'SECURE_AUTH_KEY',  '... generated value ...' );
define( 'LOGGED_IN_KEY',    '... generated value ...' );
define( 'NONCE_KEY',        '... generated value ...' );
define( 'AUTH_SALT',        '... generated value ...' );
define( 'SECURE_AUTH_SALT', '... generated value ...' );
define( 'LOGGED_IN_SALT',   '... generated value ...' );
define( 'NONCE_SALT',       '... generated value ...' );

// Force SSL for admin and logins
define( 'FORCE_SSL_ADMIN', true );

// Disable file editing from WP admin dashboard
define( 'DISALLOW_FILE_EDIT', true );

// Disable plugin/theme installation/updates from dashboard
define( 'DISALLOW_FILE_MODS', true );

// Limit post revisions to reduce DB bloat and attack surface
define( 'WP_POST_REVISIONS', 3 );

// NEVER enable debug in production
define( 'WP_DEBUG',         false );
define( 'WP_DEBUG_LOG',     false );
define( 'WP_DEBUG_DISPLAY', false );

# Disable directory listing and CGI execution globally
<Directory /var/www/html>
    Options -Indexes -ExecCGI
    AllowOverride All
    Require all granted
</Directory>

Options -Indexes

# Disable autoindex (directory listing)
autoindex off;

# Block direct access to wp-includes PHP files
location ~* /wp-includes/.*.php$ { deny all; return 403; }

# Block PHP execution in uploads
location ~* /wp-content/uploads/.*\.php$ { deny all; return 403; }

# Disable PHP/script execution in uploads directory
<FilesMatch "\.(php|php3|php4|php5|php7|phtml|pl|py|jsp|asp|sh|cgi)$">
    Order deny,allow
    Deny from all
</FilesMatch>

<IfModule mod_php.c>
    php_flag engine off
</IfModule>
<IfModule mod_php8.c>
    php_flag engine off
</IfModule>

# Block PHP execution in uploads directory
location ~* /wp-content/uploads/.*\.(php|phtml|php3|php4|php5|pl|py|jsp|asp|sh)$ {
    deny all;
    return 403;
}

# Force nosniff on all served upload content
location ~* ^/wp-content/uploads/ {
    add_header X-Content-Type-Options nosniff always;
    location ~* \.(jpg|jpeg|png|gif|webp|mp4|mp3|pdf|zip|doc|docx)$ {
        expires 30d;
        add_header Cache-Control "public, immutable";
    }
}

/**
 * Restrict uploaded file MIME types to safe list.
 * Blocks SVG by default (XSS risk) — add only if needed with sanitization.
 */
add_filter( 'upload_mimes', function( $mimes ) {
    $allowed = [
        'jpg|jpeg|jpe' => 'image/jpeg',
        'gif'          => 'image/gif',
        'png'          => 'image/png',
        'webp'         => 'image/webp',
        'pdf'          => 'application/pdf',
        'doc|docx'     => 'application/msword',
        'mp4|m4v'      => 'video/mp4',
        'mp3|m4a'      => 'audio/mpeg',
    ];
    return $allowed;
}, 1 );

# Install ModSecurity for Apache
$ apt-get install libapache2-mod-security2 -y
$ a2enmod security2

# Download OWASP Core Rule Set (CRS)
$ cd /etc/modsecurity/
$ wget https://github.com/coreruleset/coreruleset/archive/v4.0.0.tar.gz
$ tar -xzf v4.0.0.tar.gz
$ cp coreruleset-4.0.0/crs-setup.conf.example crs-setup.conf

# Enable modsecurity.conf and switch to enforcement mode
$ cp /etc/modsecurity/modsecurity.conf-recommended /etc/modsecurity/modsecurity.conf
$ sed -i 's/SecRuleEngine DetectionOnly/SecRuleEngine On/' /etc/modsecurity/modsecurity.conf

$ systemctl restart apache2

# Install Wordfence (free tier has excellent WAF)
$ wp plugin install wordfence --activate --path=/var/www/html

# Block SQL injection patterns
set $block_sql_injections 0;
if ( $query_string ~* "union.*select.*\(" ) { set $block_sql_injections 1; }
if ( $query_string ~* "concat.*\(.*\)" )    { set $block_sql_injections 1; }
if ( $block_sql_injections = 1 ) { return 403; }

# Block XSS attempts
set $block_xss 0;
if ( $query_string ~* "<script>" )          { set $block_xss 1; }
if ( $query_string ~* "javascript:" )       { set $block_xss 1; }
if ( $block_xss = 1 )                       { return 403; }

# Block common vulnerability scanners
if ( $http_user_agent ~* (nikto|sqlmap|nmap|masscan|zgrab) ) { return 403; }

# Block requests with no User-Agent
if ( $http_user_agent = "" ) { return 403; }

<IfModule mod_headers.c>
    # Prevent clickjacking
    Header always set X-Frame-Options "SAMEORIGIN"
    # Prevent MIME type sniffing
    Header always set X-Content-Type-Options "nosniff"
    # XSS filter (legacy browsers)
    Header always set X-XSS-Protection "1; mode=block"
    # HSTS — 1 year, include subdomains, submit to preload list
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
    # Referrer Policy
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    # Permissions Policy — disable unused browser features
    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=(), payment=()"
    # Content Security Policy (adjust domains as needed)
    Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self'; frame-ancestors 'self'; base-uri 'self'; form-action 'self';"
    # Remove server version disclosure
    Header always unset X-Powered-By
    Header always unset Server
</IfModule>

# Disable server signature in apache2.conf
ServerTokens Prod
ServerSignature Off

add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "geolocation=(), microphone=(), camera=(), payment=()" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; frame-ancestors 'self'; base-uri 'self'; form-action 'self';" always;
server_tokens off;
fastcgi_hide_header X-Powered-By;

expose_php = Off

# Enhanced log format with User-Agent and request time
log_format security_combined
    '$remote_addr - $remote_user [$time_local] '
    '"$request" $status $body_bytes_sent '
    '"$http_referer" "$http_user_agent" '
    '$request_time $upstream_response_time';

access_log /var/log/nginx/access.log security_combined;
error_log  /var/log/nginx/error.log warn;

# Install auditd
$ apt-get install auditd -y

# Add immediate rules
$ auditctl -w /var/www/html/wp-config.php -p rwa -k wp-config-access
$ auditctl -w /var/www/html/wp-content/uploads -p w -k uploads-write
$ auditctl -w /var/www/html/.htaccess -p rwa -k htaccess-access

# Make rules persistent across reboots
$ echo '-w /var/www/html/wp-config.php -p rwa -k wp-config-access' >> /etc/audit/rules.d/wordpress.rules
$ echo '-w /var/www/html/wp-content/uploads -p w -k uploads-write' >> /etc/audit/rules.d/wordpress.rules
$ echo '-w /var/www/html/.htaccess -p rwa -k htaccess-access' >> /etc/audit/rules.d/wordpress.rules

$ systemctl restart auditd

# Install WP Activity Log (formerly WP Security Audit Log)
$ wp plugin install wp-security-audit-log --activate --path=/var/www/html

/var/log/nginx/access.log /var/log/nginx/error.log {
    daily
    rotate 90         # Keep 90 days
    compress
    delaycompress
    missingok
    notifempty
    sharedscripts
    postrotate
        nginx -s reopen
    endscript
}

#!/bin/bash
# WordPress Secure Backup Script
# Run via cron: 0 2 * * * /usr/local/bin/wp-backup.sh

SITE_DIR="/var/www/html"
BACKUP_DIR="/var/backups/wordpress"  # OUTSIDE web root
DATE=$(date +%Y%m%d_%H%M%S)
DB_NAME="wordpress_db"
DB_USER="wp_user"
DB_PASS="your_db_password"
GPG_RECIPIENT="backup@yourdomain.com"
RETENTION_DAYS=30

mkdir -p $BACKUP_DIR

# 1. Database backup (encrypted)
mysqldump -u $DB_USER -p$DB_PASS $DB_NAME | \
    gzip | \
    gpg --recipient $GPG_RECIPIENT --encrypt \
    > $BACKUP_DIR/db_${DATE}.sql.gz.gpg

# 2. Files backup (encrypted, exclude cache)
tar -czf - \
    --exclude="$SITE_DIR/wp-content/cache" \
    --exclude="$SITE_DIR/wp-content/uploads/cache" \
    $SITE_DIR | \
    gpg --recipient $GPG_RECIPIENT --encrypt \
    > $BACKUP_DIR/files_${DATE}.tar.gz.gpg

# 3. Set strict permissions on backups
chmod 600 $BACKUP_DIR/*.gpg
chown root:root $BACKUP_DIR/*.gpg

# 4. Remove old backups beyond retention period
find $BACKUP_DIR -name "*.gpg" -mtime +$RETENTION_DAYS -delete

echo "Backup completed: $DATE" >> /var/log/wp-backup.log

$ chmod +x /usr/local/bin/wp-backup.sh
$ (crontab -l 2>/dev/null; echo "0 2 * * * /usr/local/bin/wp-backup.sh") | crontab -
$ echo "Deny from all" > /var/backups/wordpress/.htaccess

$ wp plugin install updraftplus --activate --path=/var/www/html

# ─── Block PHP execution in wp-includes/ ──────────────────────
<IfModule mod_rewrite.c>
    RewriteEngine On
    # Block all PHP files in wp-includes (except ms-files.php for Multisite)
    RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
    RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
    RewriteRule ^wp-includes/theme-compat/ - [F,L]
</IfModule>

# Block direct access to sensitive core files
<FilesMatch "^(install|load|ms-files|wp-db|atomlib|pluggable)\.php$">
    Order deny,allow
    Deny from all
</FilesMatch>

Options -Indexes

# ─── uploads/ hardening ─────────────────────────────────────────

# 1. Block ALL script execution — every variant
<FilesMatch "\.(php|php3|php4|php5|php6|php7|php8|phtml|phar|pl|py|cgi|asp|aspx|sh|bash|rb|lua)$">
    Order deny,allow
    Deny from all
</FilesMatch>

# 2. Kill PHP engine entirely in this directory
<IfModule mod_php.c>
    php_flag engine off
</IfModule>
<IfModule mod_php8.c>
    php_flag engine off
</IfModule>

# 3. Disable directory listing
Options -Indexes

# 4. Block PHP at any path depth inside uploads (catches subdirs)
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule \.php$ - [F,L]
    RewriteRule \.phar$ - [F,L]
</IfModule>

# 5. Force nosniff + restrict CSP — prevents SVG/HTML XSS
<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
    Header set Content-Security-Policy "default-src 'none'"
</IfModule>

# 6. Whitelist ONLY safe static extensions
<IfModule mod_rewrite.c>
    RewriteCond %{REQUEST_FILENAME} -f
    RewriteRule !\.(jpg|jpeg|png|gif|webp|ico|pdf|mp4|mp3|mov|doc|docx|xls|xlsx|ppt|pptx|zip|txt|woff|woff2|ttf|eot)$ - [F,L]
</IfModule>

# ─── wp-includes/ lockdown ────────────────────────────────────
location /wp-includes/ {
    autoindex off;

    # Allow ONLY ms-files.php for WordPress Multisite
    location ~ ^/wp-includes/ms-files\.php$ {
        allow all;
        fastcgi_pass unix:/run/php/php8.2-fpm.sock;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    }

    # Block ALL other PHP files in wp-includes
    location ~* /wp-includes/.*\.php$ {
        deny all;
        return 403;
    }

    # Block archive/backup files inside wp-includes
    location ~* /wp-includes/.*\.(log|bak|sql|gz|tar|zip)$ {
        deny all;
        return 403;
    }
}

# Block theme-compat directory
location ~* /wp-includes/theme-compat/ {
    deny all;
    return 403;
}

# ─── wp-content/uploads/ lockdown ────────────────────────────
location /wp-content/uploads/ {
    autoindex off;

    # HIGH PRIORITY — deny all PHP/script files. Catches double-extension tricks.
    location ~* /wp-content/uploads/.*\.(php|php3|php4|php5|php7|php8|phtml|phar|pl|py|cgi|asp|sh|bash|rb|lua)$ {
        deny all;
        return 403;
        access_log /var/log/nginx/uploads_blocked.log;   # alert in SIEM
    }

    # Prevent SVG and HTML from executing JS (XSS vector)
    location ~* /wp-content/uploads/.*\.(svg|svgz|html|htm|xml)$ {
        add_header Content-Type text/plain;
        add_header Content-Disposition attachment;
        add_header X-Content-Type-Options "nosniff" always;
    }

    # Block hidden/dotfiles (.htaccess, .env, etc.)
    location ~* /wp-content/uploads/\. {
        deny all;
        return 403;
    }

    # Force nosniff + restrictive CSP on all uploads responses
    add_header X-Content-Type-Options "nosniff" always;
    add_header Content-Security-Policy "default-src 'none'" always;

    # Serve only safe static file types
    location ~* \.(jpg|jpeg|png|gif|webp|ico|pdf|mp4|mp3|mov|doc|docx|xls|xlsx|ppt|pptx|zip|txt|woff|woff2|ttf|eot)$ {
        expires 30d;
        add_header Cache-Control "public, immutable";
        add_header X-Content-Type-Options "nosniff" always;
    }
}

# Monitor this log for SIEM alerts: tail -f /var/log/nginx/uploads_blocked.log

; ─── CRITICAL: Prevent path-info RCE ────────────────────────────
; Without this: attacker uploads image.jpg → accesses image.jpg/evil.php → RCE
cgi.fix_pathinfo = 0

; ─── Restrict PHP file access to web root only ───────────────────
open_basedir = /var/www/html:/tmp:/usr/share/php

; ─── Disable dangerous PHP functions ─────────────────────────────
disable_functions = exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,parse_ini_file,show_source

; ─── Hide PHP version (no X-Powered-By: PHP/8.x header) ──────────
expose_php = Off

; ─── Block remote file inclusion ──────────────────────────────────
allow_url_fopen = Off
allow_url_include = Off

; ─── Limit upload size to what WP actually needs ─────────────────
upload_max_filesize = 10M
post_max_size = 12M

; Restrict this PHP-FPM pool to web root only (overrides php.ini per pool)
php_admin_value[open_basedir] = /var/www/html:/tmp
php_admin_value[disable_functions] = exec,passthru,shell_exec,system,proc_open,popen
php_admin_flag[allow_url_fopen] = off
php_admin_flag[allow_url_include] = off

# ── Scan for existing PHP webshells in uploads ────────────────
$ find /var/www/html/wp-content/uploads/ \
    -name "*.php" -o -name "*.phar" -o -name "*.phtml" -o -name "*.php*"

# If ANY files found — quarantine immediately:
$ mkdir -p /tmp/quarantine
$ find /var/www/html/wp-content/uploads/ -name "*.php*" \
    -exec mv {} /tmp/quarantine/ \;

# Scan for executable files that shouldn't exist
$ find /var/www/html/wp-content/uploads/ -perm /111 -type f

# ── Fix permissions on uploads/ ──────────────────────────────
$ chown -R www-data:www-data /var/www/html/wp-content/uploads/
$ find /var/www/html/wp-content/uploads/ -type d -exec chmod 755 {} \;
$ find /var/www/html/wp-content/uploads/ -type f -exec chmod 644 {} \;

# ── Set wp-includes/ to read-only for web server ─────────────
$ chown -R www-data:www-data /var/www/html/wp-includes/
$ find /var/www/html/wp-includes/ -type f -exec chmod 444 {} \;
$ find /var/www/html/wp-includes/ -type d -exec chmod 555 {} \;