Setting up and testing the security measures of PLESK-WordPress-Security
We follow the recommendations of PLESK-WordPress-Security, as well as measures that we consider necessary. These are as follows:
- Restricting access to files and directories
- Configuration of security keys
- Blocking access to xmlrpc.php
- Blocking the directory search
- Not allowing the execution of PHP scripts in the "wp-includes" directory
- Not allowing the execution of PHP scripts in the "wp-content/uploads" directory
- Blocking access to wp-config.php
- Deactivation of script chaining for the WordPress admin panel
- Deactivation of pingbacks
- Deactivation of unused scripting languages
- Deactivation of PHP execution in cache directories
- Deactivation of file editing in the WordPress dashboard
- Changing the default prefix of database tables
- Activation of protection against unusual bots
- Blocking access to sensitive and potentially sensitive files
- Blocking access to HTACCESS and HTPASSWD files
- Blocking of author scans
- Changing the default user name of the administrator
Additional safety measures on request and at your discretion
- Hide unnecessary information or meta links in the area generated by WordPress.
- Set up WP-Audit to track activities on the website by users.
- Set up two-factor authentication (recommended, but not always possible).