Wordpress hardening

[privsec]

What steps do you take to secure/lockdown wordpress from bad actors?

[robi]

@privsec Check out the security plugins like Wordfence and Cerber.

[jdaviescoates]

@robi said in Wordpress hardening:

Wordfence and Cerber.

I'm not familiar with Cerber myself, but a big +1 to Wordfence, it's the first thing I install on any WordPress site.

[subven]

• disable REST API
• disable application passwords
• 2FA forced for admin account(s)
• move login page to something other than /wp-login.php
• Captcha for user authentification
• manually approve new registrations
• only a couple plugins that are (auto) updated frequently
• up to date theme
• disable mail functionality (if this is suitable for you)

All In One WP Security plugin is a good start and even the free version brings 90% of the necessary features.

[p44]

@privsec Filter admin access by IP address, check this article:

• Securing WordPress admin area and wp-login.php via VPN

Let me know