WordPress - Revision history

Johnno: /* Cache all the things */

2026-10-23T22:52:48Z

Cache all the things

← Older revision		Revision as of 22:52, 23 October 2026
Line 12:		Line 12:

	# Install and configure [https://wordpress.org/plugins/wp-super-cache/ WP Super Cache] to cache page content.		# Install and configure [https://wordpress.org/plugins/wp-super-cache/ WP Super Cache] to cache page content.
			# Install a Redis server, and get the [https://wordpress.org/plugins/wp-redis/#installation WP-Redis] plugin and follow its installation instructions. This hugely reduces load times by caching PHP object data and reducing calls to the database. To install a Redis server:<pre>apt install redis-server</pre>
	# Install a Redis server, and get the [https://wordpress.org/plugins/wp-redis/#installation WP-Redis] plugin and follow its installation instructions. This hugely reduces load times by caching PHP object data and reducing calls to the database. To install a Redis server:
	apt install redis-server

	# Configure Apache to gzip all the static assets, and use a long cache expiry time.		# Configure Apache to gzip all the static assets, and use a long cache expiry time.

Johnno: /* Cache all the things */

2026-10-23T22:50:48Z

Cache all the things

← Older revision		Revision as of 22:50, 23 October 2026
Line 11:		Line 11:
	WordPress is slow. Fortunately, there are things we can do to make it behave more like a static site, which for 99% of the time, it may as well be.		WordPress is slow. Fortunately, there are things we can do to make it behave more like a static site, which for 99% of the time, it may as well be.

	~~First, install~~ and configure [https://wordpress.org/plugins/wp-super-cache/ WP Super Cache] to cache page content.		# Install and configure [https://wordpress.org/plugins/wp-super-cache/ WP Super Cache] to cache page content.

	~~Second, install~~ a Redis server, and get the [https://wordpress.org/plugins/wp-redis/#installation WP-Redis] plugin and follow its installation instructions. This hugely reduces load times by caching PHP object data and reducing calls to the database.		# Install a Redis server, and get the [https://wordpress.org/plugins/wp-redis/#installation WP-Redis] plugin and follow its installation instructions. This hugely reduces load times by caching PHP object data and reducing calls to the database. To install a Redis server:
	apt ~~get~~ install redis-server		apt install redis-server

	~~Also, configure~~ Apache to gzip all the static assets and use a long cache expiry time.		# Configure Apache to gzip all the static assets, and use a long cache expiry time.

	== Allow user-installed plugins and themes ==		== Allow user-installed plugins and themes ==

Johnno at 22:47, 23 October 2026

2026-10-23T22:47:56Z

← Older revision		Revision as of 22:47, 23 October 2026
Line 2:		Line 2:

	== Optimise PHP ==		== Optimise PHP ==

			Install the latest PHP version you can; see the WordPress Handbook [https://make.wordpress.org/core/handbook/references/php-compatibility-and-wordpress-versions/ PHP compatibility page] for up-to-date information; as of October 2026, PHP 8.5 is supported by versions 7.x of WordPress.

	Use PHP-FPM and use the Opcache. See the [[PHP]] page.		Use PHP-FPM and use the Opcache. See the [[PHP]] page.

Johnno: /* Cache all the things */

2021-10-11T21:53:19Z

Cache all the things

← Older revision		Revision as of 21:53, 11 October 2021
Line 12:		Line 12:

	Second, install a Redis server, and get the [https://wordpress.org/plugins/wp-redis/#installation WP-Redis] plugin and follow its installation instructions. This hugely reduces load times by caching PHP object data and reducing calls to the database.		Second, install a Redis server, and get the [https://wordpress.org/plugins/wp-redis/#installation WP-Redis] plugin and follow its installation instructions. This hugely reduces load times by caching PHP object data and reducing calls to the database.
			apt get install redis-server

	Also, configure Apache to gzip all the static assets and use a long cache expiry time.		Also, configure Apache to gzip all the static assets and use a long cache expiry time.

Johnno: /* Use a content security policy */

2021-10-11T20:41:35Z

Use a content security policy

← Older revision		Revision as of 20:41, 11 October 2021
Line 50:		Line 50:
	Use a content security policy to reduce or even eliminate several methods of attack. There is a plugin for managing one from within WordPress, but it is straightforward to cobble one and add it to the headers. Here's an example content security policy that allows JavaScript, images and CSS from only certain origins, and denies everything else:		Use a content security policy to reduce or even eliminate several methods of attack. There is a plugin for managing one from within WordPress, but it is straightforward to cobble one and add it to the headers. Here's an example content security policy that allows JavaScript, images and CSS from only certain origins, and denies everything else:

			# Expanded for readability; needs to be on one line:
	Header always set Content-Security-Policy <nowiki>"base-uri 'self';		Header always set Content-Security-Policy <nowiki>"base-uri 'self';
	default-src 'none'; media-src 'self';		default-src 'none'; media-src 'self';

Johnno: /* Use SSL everywhere */

2021-10-11T20:40:30Z

Use SSL everywhere

← Older revision		Revision as of 20:40, 11 October 2021
Line 44:		Line 44:
	=== Use SSL everywhere ===		=== Use SSL everywhere ===

	Use [[Letsencrypt]] to get free SSL certificates, and enforce it everywhere using HTTP redirection to HTTPS. This is probably the most important thing you can do to increase the attack difficulty of your site. Use dehydrated to automatically renew the SSL certificate, and grab the latest [[https://ssl-config.mozilla.org/ Mozilla SSL Guideline] to set up strong SSL.		Use [[Letsencrypt]] to get free SSL certificates, and enforce it everywhere using HTTP redirection to HTTPS. This is probably the most important thing you can do to increase the attack difficulty of your site. Use dehydrated to automatically renew the SSL certificate, and grab the latest [https://ssl-config.mozilla.org/ Mozilla SSL Guideline] to set up strong SSL.

	=== Use a content security policy ===		=== Use a content security policy ===

Johnno at 20:39, 11 October 2021

2021-10-11T20:39:42Z

← Older revision		Revision as of 20:39, 11 October 2021
Line 26:		Line 26:
	It is however useful as a temporary measure when starting out, and once the website is nearing a stable production-ready state, you can audit it all, and switch back to maintaining the selection of themes and plugins separately (e.g. in git, using submodules, or using wp-cli on the server) and disallowing user installs.		It is however useful as a temporary measure when starting out, and once the website is nearing a stable production-ready state, you can audit it all, and switch back to maintaining the selection of themes and plugins separately (e.g. in git, using submodules, or using wp-cli on the server) and disallowing user installs.

	== ~~WP CLI~~ ==		== Command line tool ==

	Use [https://wp-cli.org wp-cli], a really useful tool for managing WordPress sites from the command line. Once downloaded you can keep it updated with:		Use [https://wp-cli.org wp-cli], a really useful tool for managing WordPress sites from the command line. Once downloaded you can keep it updated with:
Line 32:		Line 32:
	wp cli update		wp cli update

	~~== Use SSL ==~~		Manage users, pages, posts and so on. Plugins and themes can be installed, enabled or disabled, removed, and kept up to date:

	~~Use [[Letsencrypt]] to enforce HTTPS everywhere and reduce the attack surface of your site. Use dehydrated to maintain the SSL certificate, and the latest [[https://ssl~~-~~config.mozilla.org/ Mozilla SSL Guideline] to set up strong SSL.~~		wp plugin install wp-super-cache wp-redis
			wp theme install astra
			wp plugin update --all

	== ~~Content security~~ ==		== Security hardening ==

	Use a content security policy. There is a plugin for managing one from within WordPress, but it is straightforward to cobble one and add it to the headers. Here's an example content security policy that allows JavaScript, images and CSS from only certain origins, and denies everything else:		Treat the internet like it is: an invading horde of zombie bots, script kiddies, crypto miners and identity thieves swarming outside relentlessly trying to break into your site.

			=== Use SSL everywhere ===

			Use [[Letsencrypt]] to get free SSL certificates, and enforce it everywhere using HTTP redirection to HTTPS. This is probably the most important thing you can do to increase the attack difficulty of your site. Use dehydrated to automatically renew the SSL certificate, and grab the latest [[https://ssl-config.mozilla.org/ Mozilla SSL Guideline] to set up strong SSL.

			=== Use a content security policy ===

			Use a content security policy to reduce or even eliminate several methods of attack. There is a plugin for managing one from within WordPress, but it is straightforward to cobble one and add it to the headers. Here's an example content security policy that allows JavaScript, images and CSS from only certain origins, and denies everything else:

	Header always set Content-Security-Policy <nowiki>"base-uri 'self';		Header always set Content-Security-Policy <nowiki>"base-uri 'self';
Line 59:		Line 69:
	style-src 'self' 'unsafe-inline' https://*.wp.com https://ajax.googleapis.com		style-src 'self' 'unsafe-inline' https://*.wp.com https://ajax.googleapis.com
	https://fonts.googleapis.com;"</nowiki>		https://fonts.googleapis.com;"</nowiki>

			=== Quick win HTTP headers ===

	Other headers can be used to further enforce some secure behaviour:		Other headers can be used to further enforce some secure behaviour:
Line 67:		Line 79:
	Header always set Access-Control-Allow-Origin "*"		Header always set Access-Control-Allow-Origin "*"

	== ~~Some more security hardening~~ ==		=== Mandate strong user passwords ===

	~~There's~~ a ~~lot of written material out there. but for a start~~, as ~~suggested by~~ [https://~~wpscan~~.~~com~~/~~wordpress~~-~~security~~-~~scanner WPScan~~]~~, prevent DDoS attacks on web-accessible cron and XMLRPC endpoints, but allow CLI invocation, and prevent execution of uploaded PHP content~~:		Consider installing a password policy plugin, such as [https://wordpress.org/plugins/password-policy-manager/ this one] from [https://www.miniorange.com/ Mini Orange].

			=== Prevent server-side execution of uploaded content ===

			Users can upload images and documents to the <code>wp-content/uploads</code> directory. This directory is therefore writeable by the webserver, including any of its processes hijacked by an attacker. This is a major avenue of attack, where an attacker can place malicious code in a site's upload directory and then run it on the server. So, we simply prevent server-side execution of anything uploaded this way:

			<Location "/wp-content/uploads">
			SetHandler none
			RedirectMatch 404 ".+\.php"
			</Location>

			=== Periodically scan your site ===

			There are a few online scanning tools available which can be useful for keeping up with SecOps developments. For example, [https://wpscan.com/wordpress-security-scanner WPScan] recommends preventing DDoS attacks on web-accessible cron and XMLRPC endpoints, but allowing CLI invocation:
	<Files "xmlrpc.php">		<Files "xmlrpc.php">
			# Note: this breaks Jetpack
	Require ip 127		Require ip 127
	</Files>		</Files>
	<Files "wp-cron.php">		<Files "wp-cron.php">
			# Note: this breaks Jetpack
	Require ip 127		Require ip 127
	</Files>		</Files>

	RedirectMatch 404 "/readme\.html"		RedirectMatch 404 "/readme\.html"

	~~<Location "/wp-content/uploads">~~
	~~SetHandler none~~
	~~RedirectMatch 404 ".+\.php"~~
	~~</Location>~~

	== Do you need an online shop? ==		== Do you need an online shop? ==

Johnno: /* Use SSL */

2021-10-11T20:01:51Z

Use SSL

← Older revision		Revision as of 20:01, 11 October 2021
Line 34:		Line 34:
	== Use SSL ==		== Use SSL ==

	Use [[Letsencrypt]] to enforce HTTPS everywhere and dehydrated to maintain the SSL certificate, and ~~use~~ the latest ~~Mozilla SSL Guideline from their~~ [https://ssl-config.mozilla.org/ ~~configurator~~] to set up strong SSL.		Use [[Letsencrypt]] to enforce HTTPS everywhere and reduce the attack surface of your site. Use dehydrated to maintain the SSL certificate, and the latest [[https://ssl-config.mozilla.org/ Mozilla SSL Guideline] to set up strong SSL.

	== Content security ==		== Content security ==

Johnno: /* Cache all the things */

2021-10-11T19:56:17Z

Cache all the things

← Older revision		Revision as of 19:56, 11 October 2021
Line 7:		Line 7:
	== Cache all the things ==		== Cache all the things ==

	WordPress is slow. ~~Install~~ and configure [https://wordpress.org/plugins/wp-super-cache/ WP Super Cache] to ~~make it go much faster~~. Also, configure Apache to gzip all the static assets and use a long cache expiry time.		WordPress is slow. Fortunately, there are things we can do to make it behave more like a static site, which for 99% of the time, it may as well be.

			First, install and configure [https://wordpress.org/plugins/wp-super-cache/ WP Super Cache] to cache page content.

			Second, install a Redis server, and get the [https://wordpress.org/plugins/wp-redis/#installation WP-Redis] plugin and follow its installation instructions. This hugely reduces load times by caching PHP object data and reducing calls to the database.

			Also, configure Apache to gzip all the static assets and use a long cache expiry time.

	== Allow user-installed plugins and themes ==		== Allow user-installed plugins and themes ==

Johnno: /* Optimise PHP */

2021-10-11T19:32:53Z

Optimise PHP

← Older revision		Revision as of 19:32, 11 October 2021
Line 3:		Line 3:
	== Optimise PHP ==		== Optimise PHP ==

	See the [[PHP]] page.		Use PHP-FPM and use the Opcache. See the [[PHP]] page.

	== Cache all the things ==		== Cache all the things ==