Category: WordPress Security
Locked out after renaming the admin username
When attacking WordPress websites, guessing usernames and passwords is still a commonly used method to gain access to a WordPress back-end. It goes without saying, that using easy to guess passwords like ‘12345’ or ‘Welcome2022’ will make it really easy for attackers to login to your administrator account. The same goes for usernames; using easy to guess usernames like ‘Admin’ will make it too easy for attackers. This is why Really Simple SSL allows you to prevent usage of the
Configuring the Permissions Policy
The permissions policy controls which browser features can be used on your website. This is true for both your own content, or embedded content. If you do not use certain browser features, it is strongly advised to fully disallow these features. NB. The Geolocation API can still be used in some instances whereby a map is embedded a geolocation is used to center the map for example. Please make sure you test your website afterwards. Which option to choose? For
Configuring HSTS (HTTP Strict Transport Security)
One of the best-known policies is the HTTP Strict Transport Security. Below, we will give a quick overview of HSTS configuration and what is recommended. If you want to know what HSTS is or why you need it: What is HSTS? Why do you need HSTS? Configuring HTTP Strict Transport Security The most effective way to use HSTS is by preloading the strict policy directly in supported browsers. If you do not preload your website, the browser will only remember
Configuring the Cross-Origin Policies
The different Cross-Origin headers supported by Really Simple SSL are: CORP: Cross-Origin Resource Policy (same-site | same-origin | cross-origin) COEP: Cross-Origin Embedder Policy (unsafe-none | require-corp) COOP: Cross-Origin Opener Policy (unsafe-none| same-origin-allow-popups | same-origin) Practical usage in WordPress A quick decision tree for these headers is as follows: CORP: Your site is used as a resource on other websites => yes, third party websites=> CORP set to cross-origin. yes, but only your own subdomains=> CORP set to same-site no=>CORP set
About Hardening Features
The newest addition to Really Simple SSL is hardening features. These features will tackle the known and lesser-known weaknesses when running a WordPress website. Hardening features are focused on minimizing risk by removing points of attack. Mostly in disabling features that are not used or limiting access to those who use them. For more information on Hardening Features for WordPress, please read this article. Hardening Features Most of these hardening features are self-explanatory, but we will pick some to explain