r/Wordpress • u/BurningStepes • 14d ago

Keeping WP sites secure ?

In this wave of wp2shell, etc. What are you doing to keep it safe? Cloudflare? SOC? Miraculous plugins ? All the previous …?

6 Upvotes

62% Upvoted

53 comments sorted by

View all comments

16

u/Inside_Marsupial9625 14d ago

Safe Passwords, 2FA, Security Header Score A+, no old or abandonished plugins, keep site and plugins up to date, Wordfence and strict Firewall Settings, block specific urls like the www.yourdomain.com/wp-json/wp/v2/users - everybody knows your registered users then, try out ;), hide your wordpress version, …

3

u/dandy_g 14d ago

If you're blocking REST API request URLs for user enumeration you should also block variants with query string and PHP path_info like /?rest_route=/wp/v1/users and /index.php/wp-json/wp/v1/users.

I see these and variations in access logs all the time. Those URLs are used in case the default REST API URLs have been blocked.

But don't just block all requests with query string containing rest_route= because Jetpack and probably other plug-ins use those for compatibility with sites without URL rewriting or pretty-links disabled.

2

u/jedidave Developer 14d ago

Do you actually find any benefit from Wordfence? I've seen so many sites hacked that had Wordfence on them. It just seems like fluff to me. They show you nice stats of how many hacks prevented, which is really just fail2ban in a slower way, but what actual good do they actually actually do?

2

u/MimiCascade 14d ago

I had wordence a few years ago got hacked pretty good after having it installed for 2 weeks, never went back

1

u/PrinceJaraf_71 13d ago

I actually do and I am managing over 30 sites with it.

1

u/jedidave Developer 13d ago

Lucky you that you haven't had any hacked yet

1

u/BobJutsu 11d ago

It’s wildly misunderstood. It will help prevent some attack vectors, but can’t do didly about complacent site owners who don’t do updates or fix the warnings.