Category: WordPress Security
404 Not Found errors detected on your homepage
The 404 Blocking rule in Really Simple Security’s Firewall helps protect your site against malicious scanning attempts by blocking IP addresses that generate too many 404 Not Found errors while scanning your site for vulnerabilities (a detailed explanation is available here). If you see the following notice appear on the Really Simple Security Dashboard, this means that the plugin has detected 404 Not Found errors on the homepage of your site. In such cases, the plugin automatically deactivates the 404 Blocking
About the Firewall
The Firewall module in Really Simple Security is a powerful feature that allows you to monitor and filter requests to your WordPress site. You can activate the firewall by enabling the “Enable Firewall” slider under SSL & Security -> Settings -> Firewall. This article explains how to configure the firewall rules in Really Simple Security to identify and lock out unwanted, malicious traffic from your WordPress site. Table of Contents 404 Blocking Region Blocking User Agents IP Allowlist & Blocklist Event
Protecting site visitors with Security Headers
Each time you visit a website, information is exchanged between your device and the website’s server. HTTP headers play an important role in this communication, as they provide extra information about the data that is being shared. Security Headers are types of HTTP headers that are specifically designed to improve web application security. They instruct web browsers on how to handle a site’s content, to protect website visitors against common types of malicious attacks. Protecting your website visitors from malicious
Hardening your website’s security
Table of Contents Introducing WordPress Hardening Hardening – Basic Disable “anyone can register” Disable the built-in file editors Prevent code execution in the public ‘Uploads’ folder Hide your WordPress version Prevent login feedback Disable directory browsing Disable user enumeration Block the ‘admin’ username Disable XML-RPC Block user registrations when login and display name are the same Hardening – Advanced Disable HTTP methods Rename and randomize your database prefix Change debug.log file location Disable application passwords Restrict creation of administrator roles
Login protection as essential security
Your WordPress login page is publicly accessible to anyone who knows your domain. That means it gets hit by automated bots running through username and password combinations every day. Most attacks on WordPress sites start right here. Login protection covers a few critical variables: limiting how many login attempts are allowed, changing or hiding the login URL so bots cannot easily find it, and adding a second verification step (2FA) so a stolen password alone isn’t enough to break in.