Difference between revisions of "WordPress"
From Jon's Wiki
| Line 17: | Line 17: | ||
Use a content security policy. There is a plugin for managing one from within WordPress, but it is straightforward to cobble one and add it to the headers. Here's an example content security policy that allows JavaScript, images and CSS from only certain origins, and denies everything else: | Use a content security policy. There is a plugin for managing one from within WordPress, but it is straightforward to cobble one and add it to the headers. Here's an example content security policy that allows JavaScript, images and CSS from only certain origins, and denies everything else: | ||
| − | Header always set Content-Security-Policy "base-uri 'self'; | + | Header always set Content-Security-Policy <nowiki>"base-uri 'self'; |
default-src 'none'; media-src 'self'; | default-src 'none'; media-src 'self'; | ||
connect-src 'self' https://*.wp.com wss://public-api.wordpress.com https://api.stripe.com https://checkout.stripe.com; | connect-src 'self' https://*.wp.com wss://public-api.wordpress.com https://api.stripe.com https://checkout.stripe.com; | ||
| Line 30: | Line 30: | ||
script-src 'self' 'unsafe-inline' 'unsafe-eval' https://widget.surveymonkey.com https://*.wp.com | script-src 'self' 'unsafe-inline' 'unsafe-eval' https://widget.surveymonkey.com https://*.wp.com | ||
https://public-api.wordpress.com https://*.stripe.com https://maps.googleapis.com https://ajax.googleapis.com; | https://public-api.wordpress.com https://*.stripe.com https://maps.googleapis.com https://ajax.googleapis.com; | ||
| − | style-src 'self' 'unsafe-inline' https://*.wp.com https://ajax.googleapis.com https://fonts.googleapis.com;" | + | style-src 'self' 'unsafe-inline' https://*.wp.com https://ajax.googleapis.com https://fonts.googleapis.com;"</nowiki> |
Other headers can be used to further enforce some secure behaviour: | Other headers can be used to further enforce some secure behaviour: | ||
Revision as of 04:30, 20 August 2021
Enable user-plugin installation by allowing write access to wp-content/{plugins,themes} and configure:
# in wp-config.php
define('FS_METHOD', 'direct');
Other nifty things:
- CLI, wp-cli.org
- Security scanner, wpscan.org
Use SSL
Use Letsencrypt to enforce HTTPS everywhere and dehydrated to maintain the SSL certificate, and use the latest Mozilla SSL Guideline from their configurator to set up strong SSL.
Content security
Use a content security policy. There is a plugin for managing one from within WordPress, but it is straightforward to cobble one and add it to the headers. Here's an example content security policy that allows JavaScript, images and CSS from only certain origins, and denies everything else:
Header always set Content-Security-Policy "base-uri 'self';
default-src 'none'; media-src 'self';
connect-src 'self' https://*.wp.com wss://public-api.wordpress.com https://api.stripe.com https://checkout.stripe.com;
font-src 'self' data: https://*.wp.com https://wordpress.com https://fonts.googleapis.com https://fonts.gstatic.com;
form-action 'self';
frame-ancestors 'self';
frame-src 'self' https://jetpack.wordpress.com https://*.wp.com https://www.google.com https://*.stripe.com
https://player.vimeo.com https://www.youtube.com https://www.surveymonkey.com;
img-src 'self' data: https://*.tile.openstreetmap.org https://*.gravatar.com https://*.wp.com
https://*.wordpress.com https://s.w.org https://maps.googleapis.com https://maps.gstatic.com
https://q.stripe.com https://secure.surveymonkey.com;
script-src 'self' 'unsafe-inline' 'unsafe-eval' https://widget.surveymonkey.com https://*.wp.com
https://public-api.wordpress.com https://*.stripe.com https://maps.googleapis.com https://ajax.googleapis.com;
style-src 'self' 'unsafe-inline' https://*.wp.com https://ajax.googleapis.com https://fonts.googleapis.com;"
Other headers can be used to further enforce some secure behaviour:
Header always set X-Content-Type-Options "nosniff" Header always set X-XSS-Protection "1; mode=block" Header always set Referrer-Policy "strict-origin-when-cross-origin" Header always set Access-Control-Allow-Origin "*"
- gzip + WP SuperCache = win
Lock things down
As suggested by WPScan, prevent DDoS attacks on web-accessible cron and XMLRPC endpoints, but allow CLI invocation, and prevent execution of uploaded PHP content:
<Files "xmlrpc.php">
Require ip 127
</Files>
<Files "wp-cron.php">
Require ip 127
</Files>
RedirectMatch 404 "/readme\.html"
<Location "/wp-content/uploads">
SetHandler none
RedirectMatch 404 ".+\.php"
</Location>