Security Essentials (Firewalls & Malware Scans)

Keeping WordPress secure is an ongoing process. Use a web application firewall (WAF), schedule malware scans, harden login access, and maintain backups so you can recover quickly if anything goes wrong.

1) Core Principles

• • Least privilege: Only give users the access they need (Editor, Shop Manager, etc.).

• • Layers of defense: Hosting security + CDN/WAF + WordPress firewall plugin + strong access controls.

• • Visibility & response: Logging, alerts, scheduled scans, and a tested recovery plan.

2) Choose Your Firewall

3) Recommended Baseline Settings

• • Force HTTPS (SSL) and enable HSTS at the edge (if available).

• • 2-Factor Authentication for all Admins; require strong passwords for all users.

• • Login protection: Limit login attempts, enable reCAPTCHA/turnstile, and rename/hide wp-login.php if offered.

• • XML-RPC: Disable or restrict; allowlist Jetpack/mobile IPs only if you need it.

• • File editing off: Add define('DISALLOW_FILE_EDIT', true); to wp-config.php.

• • Firewall rules: Block common exploits (SQLi/XSS), rate-limit /wp-login.php and /xmlrpc.php, block countries/bots if relevant.

• • Security headers: Add Content-Security-Policy (start with report-only), X-Frame-Options, X-Content-Type-Options, and Referrer-Policy via host or plugin.

4) Malware Scans & Integrity Checks

• • Schedule scans (daily/weekly): core files, themes, plugins, uploads for suspicious files, backdoors, and modified core.

• • File change detection: Alert when files are added/edited; review diffs for unexpected changes.

• • Blacklist checks: Monitor search engine and security vendor blocklists.

• • Quarantine or auto-repair infected core files; always review before deleting in uploads.

5) Hardening Checklist

• • Keep everything updated: WordPress core, themes, plugins. Remove anything unused.

• • Backups: Daily database + weekly full files; store off-site (S3/Drive) with 30–90 day retention. Test restores.

• • Least privilege users: Convert old Admins to lower roles or remove; use separate admin account (no blogging as Admin).

• • Lock down wp-admin: Optional IP allowlist or HTTP Auth for high-risk sites.

• • Disable directory indexing and restrict wp-content execution where possible.

• • Enforce plugin/theme integrity (block nulled software) and verify signatures/hashes when available.

6) Incident Response (If You Suspect a Hack)

• • Isolate: Put the site in maintenance mode or restrict traffic via WAF; take a fresh backup for forensics.

• • Scan with your security plugin and at the server/edge; check recent file changes and admin users.

• • Clean: Quarantine or remove malicious files; replace core, theme, plugin files from official sources.

• • Reset credentials: All WordPress users, hosting panel, SFTP/SSH, database, API keys.

• • Patch & harden: Update components, close entry points (vulnerable plugins, weak passwords, exposed endpoints).

• • Request blacklist review (if flagged) and monitor logs for recurring activity.

7) Example Configs (Practical Defaults)

8) Final Security Checklist

• • Edge or plugin firewall enabled and tested.

• • 2FA + strong passwords for all privileged users.

• • Login rate limiting + CAPTCHA/Turnstile active.

• • XML-RPC restricted; file editing disabled.

• • Scheduled malware scans and file change alerts.

• • Backups off-site with recent restore test.

• • Security headers and HTTPS/HSTS configured.

• • Incident response steps documented.