Search Our Database

Securing WordPress in Plesk 12.5

Last updated on |
by

To check and secure WordPress installations:

  1. Go to Websites & Domains > WordPress.
  2. Do one of the following:
    • To check the security of all WordPress installations, click Check Security.
    • To secure a single WordPress installation, click the icon in the S column next to the name of the desired WordPress installation.
    • To secure two or more WordPress installations, select the checkboxes for the corresponding WordPress installations, then click Check Security.
  3. Select the checkboxes corresponding to the security improvements you want to apply, then click Secure.

    WP_Check_security

Caution: Keep in mind that not all security improvements can be rolled back. It is recommended to back up the corresponding subscription before securing WordPress installations.

The complete list of WordPress security improvements
  • The wp-content folder. The
    wp-content

    directory may contain insecure PHP files that can be used to damage your site. After WordPress installation, PHP files can be executed from the

    wp-content

    directory. The security check verifies that the execution of PHP files in the

    wp-content

    directory is forbidden. Note that custom directives in the

    .htaccess

    or

    web.config

    files might override this security measure. Also, note that some of your plugins might stop working after securing the wp-content folder.

  • The wp-includes folder. The
    wp-includes

    directory may contain insecure PHP files that can be used to damage your site. After WordPress installation, PHP files can be executed from the

    wp-includes

    directory. The security check verifies that the execution of PHP files in the

    wp-includes

    directory is forbidden. Note that custom directives in the

    .htaccess

    or

    web.config

    files might override this security measure. Also, note that some of your plugins might stop working after securing the wp-includes folder.

  • The configuration file. The
    wp-config.php

    file contains credentials for database access and other sensitive information. After the WordPress installation, the

     wp-config.php

    file can be executed. If for some reason, the processing of PHP files by the webserver is turned off, hackers can access the content of the

    wp-config.php

    file. The security check verifies that unauthorized access to the

    wp-config.php

    file is blocked. Note that custom directives in the

    .htaccess

    or

    web.config

    files might override this security measure.

  • Directory browsing permissions. If directory browsing is turned on, hackers can obtain information about your site (what plugins you use and so on). By default, directory browsing is turned off in Plesk. The security check verifies that directory browsing on the WordPress installation is turned off.
  • Database prefix

    . WordPress database tables have the same names in all WordPress installations. When the standard

    wp_

    database table name prefix is used, the whole WordPress database structure is not a secret and anyone can obtain any data from it. The security check changes the database table name prefix to something other than

    wp_

    . The maintenance mode is turned on, all plugins are deactivated, the prefix is changed in the configuration file, the prefix is changed in the database, the plugins are re-activated, the permalink structure is refreshed, and then the maintenance mode is turned off.

  • Security keys

    . WordPress uses security keys (

    AUTH_KEY

    ,

    SECURE_AUTH_KEY

    ,

    LOGGED_IN_KEY

    , and

    NONCE_KEY

    ) to encrypt information stored in the user’s cookies. A good security key should be long (60 characters or longer), random and complicated. This security check verifies that the security keys are set up and that they at least contain both alphabetic and numeric characters.

  • Permissions for files and directories

    . If permissions for files and directories do not comply with the security policy, these files can be used to hack your site. After WordPress installation, files and directories can have various permissions. The security check verifies that the permissions for the

    wp-config.php

    file are set to

    600

    , for other files to

    644

    , and for directories to

    755

    .

  • Administrator’s username

    . When a WordPress copy is installed, by default there is a user with administrative privileges and the username

    admin

    . As a user’s username cannot be changed in WordPress, one only needs to guess the password to access the system as the administrator. The security check verifies that there is no user with the administrative privileges and the username

    admin

    .

  • Version information

    . There are known security vulnerabilities for each WordPress version. For this reason, displaying the version of your WordPress installation makes it an easier target for hackers. The version of an unprotected WordPress installation can be seen in the pages’ metadata and

    readme.html

    files. The security check verifies that all

    readme.html

    files are empty and that every theme has a

    functions.php

    file which contains the line:

     remove_action(\'wp_head\', \'wp_generator\');

    .