{"id":111,"date":"2018-04-24T05:42:41","date_gmt":"2018-04-24T05:42:41","guid":{"rendered":"http:\/\/td_uid_62_5adec3d1305c3"},"modified":"2018-05-21T02:25:25","modified_gmt":"2018-05-21T02:25:25","slug":"10-ways-to-limit-local-attack-for-wordpress","status":"publish","type":"post","link":"https:\/\/forumweb.hosting\/blog\/10-ways-to-limit-local-attack-for-wordpress\/","title":{"rendered":"10 Ways to Limit Local Attack for WordPress"},"content":{"rendered":"

What is a Local Attack?<\/strong><\/p>\n

Local Attack is a very common method used to attack a particular website on the same server. The tool of this attack is to use exploit code written in several programming languages \u200b\u200bsuch as PHP, ASP.Net, Python …<\/p>\n

That code is called Shell. When a server on the server is uploaded to this shell file, the attacker can use the exploit commands to penetrate the hosting account with the server to read the sensitive information such as: Email, Database information (username , password ..) easily. From there the attacker can do whatever they want.<\/p>\n

How to limit Local Attack in WordPress?<\/p>\n

Let’s take a look at 10 ways to limit Local Attack in WordPress.<\/p>\n

1. Hide wp-config.php file<\/strong><\/p>\n

Usually the files of the website will be in the public_html directory and usually the path will be \/home\/username\/public_html\/wp-config.php.<\/p>\n

Therefore, the best way to hide the config file is to put the wp-config.php file out of the public_html directory, you can log on to the host via FTP and create a directory of any name horizontally adjacent to public_html. (here we will create a folder named secowcof)<\/p>\n

Then download the wp-config.php file in the public_html directory and upload it to the newly created directory. Finally edit the wp-config.php file in the public_html directory as follows, see the link below:<\/p>\n

<php
\nif ( !defined(‘ABSPATH’) )
\ndefine(‘ABSPATH’, dirname(__FILE__) . ‘\/’);
\nrequire_once(ABSPATH . ‘..\/secowcof\/wp-config.php’);<\/p><\/blockquote>\n

You replace the secowcof into your directory name that you created it on the par with public_html.<\/p>\n

Note: This method only applies to websites that have files installed in the public_html directory but not in another folder. You can apply to the www directory if available.<\/p>\n

2. Change the database prefix<\/strong><\/p>\n

The default WordPress prefix database is wp_, which inadvertently causes the hackers to know the name of each of your site’s tables if you do not change the prefix.<\/p>\n

3. Change the security key<\/strong><\/p>\n

Access the wp-config.php file<\/p>\n

define(‘AUTH_KEY’, ‘put your unique phrase here’);
\ndefine(‘SECURE_AUTH_KEY’, ‘put your unique phrase here’);
\ndefine(‘LOGGED_IN_KEY’, ‘put your unique phrase here’);
\ndefine(‘NONCE_KEY’, ‘put your unique phrase here’);
\ndefine(‘AUTH_SALT’, ‘put your unique phrase here’);
\ndefine(‘SECURE_AUTH_SALT’, ‘put your unique phrase here’);
\ndefine(‘LOGGED_IN_SALT’, ‘put your unique phrase here’);
\ndefine(‘NONCE_SALT’, ‘put your unique phrase here’);<\/p><\/blockquote>\n

– Go to: https:\/\/api.wordpress.org\/secret-key\/1.1\/salt\/ to get the secret key
\n– Replace the entire code with the provided code<\/p>\n

4. Do not edit files (plugins, themes) in wp-admin<\/strong><\/p>\n

Add to the bottom of the wp-config.php file the following code<\/p>\n

define( ‘DISALLOW_FILE_EDIT’, true );<\/p><\/blockquote>\n

5. Do not install plugins, themes in wp-admin<\/strong><\/p>\n

Add to the bottom of the wp-config.php file the following code<\/p>\n

define(‘DISALLOW_FILE_MODS’,true);<\/p><\/blockquote>\n

6. Chmod file wp-config.php<\/strong><\/p>\n

Chmod file into 400 or 404<\/p>\n

7. Secure wp-config.php with .htaccess<\/strong><\/p>\n

Add the following code to the end of the<\/p>\n

# protect wpconfig.php
\norder allow,deny
\ndeny from all\n<\/p><\/blockquote>\n

8. Protect the wp-content directory<\/strong><\/p>\n

Create the .htaccess file and add the following code<\/p>\n

Order deny,allow
\nDeny from all
\nAllow from all\n<\/p><\/blockquote>\n

Note: If the wp-content directory contains other files related to the wordpress source code, then you need to add the extension (woff example example) to the list above.<\/p>\n

9. Lock the wp-admin path<\/strong><\/p>\n

The wp-admin and wp-login.php files are always the attackers if someone wants to visit your site. Therefore, it’s best to block all visits to these areas except you.
\nCreate a .htaccess file in the wp-admin directory and insert the following.<\/p>\n

<FilesMatch “.*”>
\nOrder Deny,Allow
\nDeny from all
\nAllow from 123.456.789\n<\/p><\/blockquote>\n

123.456.789 is your IP, you can use any tools to know your real IP address.<\/p>\n

10. Use the malware scan plugin<\/strong><\/p>\n

This step may be lucky enough to let you know what hosts your files contain so that you can delete them or download them. Here are the best plugins for you to scan the malicious code on the host completely free that you can use:<\/p>\n

Wordfence Scan
\nAnti-Malware (Get Off Malicious Scripts)
\n6Scan Security
\nAnd if you have money, I encourage you to use Sucuri Premium<\/p>\n

Here are 10 ways to restrict Local Attack in WordPress. Also, in the process of choosing hosting services for your website, you should also choose reputable hosting providers that support local attack limits to secure your website.<\/p>\n","protected":false},"excerpt":{"rendered":"

What is a Local Attack? Local Attack is a very common method used to attack a particular website on the same server. The tool of this attack is to use exploit code written in several programming languages \u200b\u200bsuch as PHP, ASP.Net, Python … That code is called Shell. When a server on the server is […]<\/p>\n","protected":false},"author":1,"featured_media":204,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[6,12,8],"tags":[89,87,88,17],"_links":{"self":[{"href":"https:\/\/forumweb.hosting\/blog\/wp-json\/wp\/v2\/posts\/111"}],"collection":[{"href":"https:\/\/forumweb.hosting\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/forumweb.hosting\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/forumweb.hosting\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/forumweb.hosting\/blog\/wp-json\/wp\/v2\/comments?post=111"}],"version-history":[{"count":6,"href":"https:\/\/forumweb.hosting\/blog\/wp-json\/wp\/v2\/posts\/111\/revisions"}],"predecessor-version":[{"id":203,"href":"https:\/\/forumweb.hosting\/blog\/wp-json\/wp\/v2\/posts\/111\/revisions\/203"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/forumweb.hosting\/blog\/wp-json\/wp\/v2\/media\/204"}],"wp:attachment":[{"href":"https:\/\/forumweb.hosting\/blog\/wp-json\/wp\/v2\/media?parent=111"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/forumweb.hosting\/blog\/wp-json\/wp\/v2\/categories?post=111"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/forumweb.hosting\/blog\/wp-json\/wp\/v2\/tags?post=111"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}