WordPress/Hardening - Revision history

R00t at 05:38, 12 January 2015

2015-01-12T05:38:25Z

2015-01-10T05:48:53Z

2015-01-09T07:09:48Z

‎installing needed wp packages

2015-01-09T07:08:52Z

‎installing needed wp packages

2015-01-06T07:32:49Z

‎wordpress connecting ips

2015-01-06T07:29:02Z

2014-10-14T03:23:59Z

2014-10-14T03:23:36Z

2014-10-05T08:36:30Z

‎setting up file/folder permissions

2014-10-05T08:11:21Z

@@ Line 85: / Line 85: @@
   | /wp-content/uploads (directory) || wp-user || www-data || 775
   |}
 ==disable xmlrpc==

@@ Line 49: / Line 49: @@
   ~$ sudo vi /var/www/yoursite.com/wp-config.php
   @ the end of the file add
-  /* settings for ftp access using ssh keys */
+  <nowiki>/* settings for ftp access using ssh keys */
   define('FTP_PUBKEY','/home/wp-user/wp_rsa.pub');
   define('FTP_PRIKEY','/home/wp-user/wp_rsa');
   define('FTP_USER','wp-user');
   define('FTP_PASS','');
-  define('FTP_HOST','127.0.0.1:22');
+  define('FTP_HOST','127.0.0.1:22');</nowiki>
 ===setting up file/folder permissions===

@@ Line 49: / Line 49: @@
   ~$ sudo vi /var/www/yoursite.com/wp-config.php
   @ the end of the file add
   /* settings for ftp access using ssh keys */
   define('FTP_PUBKEY','/home/wp-user/wp_rsa.pub');

@@ Line 54: / Line 54: @@
   define('FTP_PASS','');
   define('FTP_HOST','127.0.0.1:22');
 ===setting up file/folder permissions===
 per [http://codex.wordpress.org/Hardening_WordPress this article], these are the only permissions that should be needed by wordpress and the web service.

← Older revision		Revision as of 07:32, 6 January 2015
Line 100:		Line 100:
	209.15.21.80		209.15.21.80
	209.15.21.129		209.15.21.129
		+	The following were found using Whois and encompass everything above. These ranges are leased to Automattic, founders of Wordpress
		+	192.0.64.0/18
		+	209.15.21.0/24

← Older revision		Revision as of 07:29, 6 January 2015
Line 88:		Line 88:
	~$ sudo chmod 000 xmlrpc.php		~$ sudo chmod 000 xmlrpc.php
	~$ sudo chown root:root xmlrpc.php		~$ sudo chown root:root xmlrpc.php
		+
		+	==wordpress connecting ips==
		+	If you have access to the site limited, like for a dev variant, these ip ranges may be helpful to you. This is not a complete list by any means, but these are the ip ranges I found my site was calling whenever i tried to do an update/upgrade.
		+	add access to wordpress for wordpress.com
		+	192.0.78.9
		+	192.0.78.17
		+	209.15.21.93
		+	209.15.21.85
		+	209.15.21.87
		+	209.15.21.96
		+	209.15.21.80
		+	209.15.21.129

@@ Line 84: / Line 84: @@
   |}
-===disable xmlrpc===
+==disable xmlrpc==
 not needed generally, however could affect some add-on functionality like in jetpack.
   ~$ sudo chmod 000 xmlrpc.php
   ~$ sudo chown root:root xmlrpc.php

← Older revision		Revision as of 03:23, 14 October 2014
Line 83:		Line 83:
	\| /wp-content/uploads (directory) \|\| wp-user \|\| www-data \|\| 775		\| /wp-content/uploads (directory) \|\| wp-user \|\| www-data \|\| 775
	\|}		\|}
		+
		+	===disable xmlrpc===
		+	not needed generally, however could affect some add-on functionality like in jetpack.
		+	~$ sudo chmod 000 xmlrpc.php
		+	~$ sudo chown root:root xmlrpc.php

@@ Line 77: / Line 77: @@
   | /wp-content/themes/ || wp-user || www-data || 664
   |-
-  | /wp-content/plugins/ (directory) || wp-user || wp-user || 755
+  | /wp-content/plugins (directory) || wp-user || wp-user || 755
   |-
   | /wp-content/plugins/ || wp-user || wp-user || 644
   |}

@@ Line 59: / Line 59: @@
   ! Path || Owner || Group || Permissions
   |-
-  | / (parent) || wp-user ||
+  | / (parent) || wp-user || www-data || 644
   |-