[op-overview set_id="8745" highlight="day"]
This is test paragraph.
Tag Archives: WordPress
WordPress plugins
This is a list of WordPress plugins that I use often and that I have grown to trust. The list is a work in progress.
- Admin Post Navigation
- Disable Comments
- Disable Embeds
- Disable Emojis
- Classic Editor
- GitHub Updater – Install and update plugins/themes hosted on GitHub, Bitbucket and more
- Omni Contact Form – @ GitHub
- Omni Control
- Query Monitor
- Relenanssi – Better search for small to medium-sized sites – Home
- Term Management Tools – Old but still works (Aug 2020)
- Two Factor – @ GitHub
- User Switching
WordPress performance checklist
For recipes.op111.net
- Apache – Enable OCSP stapling
- Apache – Set cache expiration for different file types
- CSS – Sort properties consistently (helps compression) – follow Concentric CSS
- System – Use newest possible version of PHP
- WordPress – HTML – Remove uneeded IDs and classes from menu items
- WordPress – HTML – Minify HTML – Autoptimize has option
- WordPress – Assets – Remove Gutenberg CSS if not using Gutenberg
- WordPress – Assets – Remove jQuery Migrate if not needed
- WordPress – Disable Embeds if not needed – use Disable Embeds
- WordPress – Disable Emojis if not needed – use Disable Emojis
- WordPress – Disable Comments if not needed – use Disable Comments
Changelog
- 2020-06-25. Started.
WordPress security checklist
2020-06-29: Copied to recipes.op111.net
This is a list of security items to check when setting up WordPress websites and web servers for WordPress websites.
I use it for web servers running Debian 10 (Buster), Apache 2.4 and PHP 7.3 or PHP 7.4, and for websites accessible via HTTPS. The list is a work in progress.
Apache HTTP server
- Disable TLS 1.0 and 1.1
- Disable AllowOverride globally (default since Apache 2.3.9) and for each site
- Put WP rewrite rules in vhost config – default rules
- Disable the autoindex module
- Disable the auth_basic module
- Disable the TRACE HTTP method (disabled by default in Debian 10) – h5bp snippet
- Configure security response headers
- Disallow MIME sniffing
- Remove X-Powered-By
- Configure X-Frame-Options
- Configure Strict-Transport-Security – h5bp snippet
- Configure Content-Security-Policy – h5bp snippet – may need adapting
- Forbid access to hidden files and directories that don’t need to be accessible – h5bp snippet
- Forbid access to files that don’t need to be accessible – h5bp snippet
- (for WP) Forbid access to xmlrpc.php if XML-RPC is not needed – snippets
- (for WP) Forbid access to wp-login.php unless IP is trusted – not always feasible
- (for WP) Forbid access to wp-login.php if agent uses HTTP/1.* – snippets
- (for WP) Forbid access to PHP files in wp-content
- (for WP) Forbid access to PHP files in wp-includes
- (for WP) Forbid manual uploading of themes and plugins – snippet
- (for WP) Forbid user enumeration
- (for WP) Forbid GET requests to core REST API endpoints
- (for WP) Configure Content-Security-Policy for wp-admin
PHP
- Disable eval if not needed – PHP diseval extension
WordPress
- Set DISALLOW_FILE_EDIT to true
- Set WP_DEBUG_DISPLAY to false
- Set WP_DEBUG_LOG to true
- Remove inactive themes except one (fallback)
- Remove inactive plugins
- Disable gravatars (one less thing to set CSP for)
- (via plugin) Require strong passwords for all users
- (via plugin) Require multi-factor authentication for admins – plugin
- (via plugin) Disable comments completely if not needed – plugin
Resources and documentation
- Apache HTTP Server 2.4 - Documentation - Access Control
- H5BP - Apache HTTP server boilerplate configs
- Mozilla SSL Configurator Generator
- Qualys SSL Server Test
- Security Headers - Analyse your HTTP response headers
Possible additions and improvements for the future
- Try Snuffleupagus when version 0.6.0 comes out
Testing post categories in WordPress 5.4.1
Hello!
This is a test post. One two three four five six seven eight.
It belongs in the Miscellaneous category.