[Defender Pro] Additional automated actions for code protection

0

1) Automatic changing of database keys to a different file and adding require_once “wp-config-db.php”;
2) Auto debug change from standard to:
define(‘WP_DEBUG’, false);

if ( ! WP_DEBUG ) {
ini_set(‘display_errors’, 0);
}
3) Adding htaccess
<FilesMatch “wp-config.*.php|.htaccess|readme.html”>
Order allow,deny
Deny from all
</FilesMatch>

And at the end
4) Hiding WP version in head, RSS and scripts
5) For wp-includes
<FilesMatch “.(?i:php)$”>
Order allow,deny
Deny from all
</FilesMatch>
<Files wp-tinymce.php>
Allow from all
</Files>
<Files ms-files.php>
Allow from all
</Files>
6) For wp-content catalog and each and every inside create a htaccess files
<FilesMatch “.(?i:php)$”>
Order allow,deny
Deny from all
</FilesMatch>

  • Adam
    • Support Gorilla

    Hi Kuba

    Thank you for your suggestions!

    As for no 1 I’m not really sure about it:

    Moving keys into separate file doesn’t really add anything to security unless that file would be outside of available/accessible WP/site path; that would make sense but then – Defender wouldn’t be able to do this as such path wouldn’t be available to it; On a properly configured setup plugin wouldn’t be able to write to a file outside of the root path of the install and if it can do that – then it renders that entire change useless because other code would be able to write to it too.

    Ad 2)

    DEBUG should only be enabled on site temporarily and only during trubleshooting or some development stages but never kept enabled on production site all the time anyway; But “ini_set(‘display_errors’, 0);” may be worth considering indeed. I’ll pass that idea over to our developers.

    Ad 3, 5 & 6)

    In “Defender Pro -> Recommendations” page you’ll fine “Prevent PHP Execution” and “Prevent Information Disclosure” security tweaks that are directly related to it. If applied, they should suffice.

    Ad 4).

    We do have it planned already. I don’t have ETA but it should be added in one of future versions, as well as possibly hiding theme and plugin names from source code.

    Best regards,
    Adam