WordPress Administrator Username Disclosure
What is WordPress user enumeration?
1) Protected by Website Application Firewall (WAF)
2) Disable author archives
https://wordpress.org/plugins/disable-author-archives/
3) Disable REST API user endpoints
https://wordpress.org/plugins/stop-user-enumeration/
4) Disable WordPress XML-RPC
https://wordpress.org/plugins/disable-xml-rpc/
5) Update htaccess to block author scan
# BEGIN block author scans
RewriteEngine On
RewriteBase /
RewriteCond %{QUERY_STRING} (author=\d+) [NC]
RewriteRule .* – [F]
# END block author scans
Publicly Accessible Internal Files
1) Protected by Website Application Firewall (WAF)
2) Added code to htaccess
<filesMatch “.(htaccess|htpasswd|ini|phps|fla|psd|log|sh)$”>
Order Allow,Deny
Deny from all
</filesMatch>
3) Add robot.txt
User-agent: *
Disallow: /wp-admin/
Disallow: /wp-includes/
XML-RPC Enabled
Disable XML-RPC3) Rate Limit Guard
Rate Limit Guard4) Update htaccess to block XML-RPC # Block WordPress xmlrpc.php requests <Files xmlrpc.php> order deny,allow deny from all allow from 123.123.123.123 <Files>
HTML Injection
1) Protected by Website Application Firewall (WAF)
2) Injection Guard
https://wordpress.org/plugins/injection-guard/
Prevent Unrestricted Form Submission
Added various security measures to prevent Unrestricted Form Submission
Website Application Firewall to block Bad Bots
Rate Limit Guard
https://wordpress.org/plugins/rate-limit-co/
Google Recaptcha
Host Header Injection
Host Header Injection Fix
https://wordpress.org/plugins/host-header-injection-fix/
Cookie Flag “HTTPOnly” Not Set
Make sure that mod_headers.so is enabled then add the following header in apache2.conf for debian based system or httpd.conf for rpm based system (or add to .htaccess)
Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure
For lower than Apache 2.2.4 version use the following:
Header set Set-Cookie HttpOnly;Secure
Content Security Policy
Cookies and Content Security Polic
https://wordpress.org/plugins/cookies-and-content-security-policy/
Add to .htaccess
Header always set Strict-Transport-Security: “max-age=31536000; includeSubdomains;” env=HTTPS
Header always set X-XSS-Protection “0”
Header always set X-Frame-Options: “SAMEORIGIN”
Header set Set-Cookie HttpOnly;Secure
Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure
Header always set Content-Security-Policy “upgrade-insecure-requests;”
HTTP Strict Transport Security (HSTS)
Update htaccess with HTTP Strict Transport Security (HSTS)
<IfModule mod_headers.c>
Header set Strict-Transport-Security “max-age=31536000” env=HTTPS
</IfModule>
Disabled HTTP Method “OPTIONS”
Update code to htaccess
RewriteCond %{THE_REQUEST} !^(POST|GET)\ /.*\ HTTP/1\.1$
RewriteRule .* – [F]
Really Simple SSL Pro
Advance Hardening – Disable HTTP Methods
Cross-Origin Resource Sharing (CORS)
Update code to htaccess
Header set Access-Control-Allow-Origin https://domainname.com
Application is Vulnerable to Clickjacking
Security measures for X-Frame-Options and Clickjacking
1) Protected by Sucuri Website Application Firewall (WAF)
2) Really Simple SSL Pro
cross-origin-opener-policy : same-origin
cross-origin-resource-policy : same-origin
cross-origin-embedder-policy : same-origin
Default Installation Page, Version Disclosure
Added hardening measures with Really Simple SSL
Disable “”anyone can register””
Disable the built-in file editors
Prevent code execution in the public ‘Uploads’ folder
Hide your WordPress version
Prevent login feedback
Disable directory browsing
Disable user enumeration
Auto Complete is Not Disabled
Remove AutoComplete in WPForm and Elementor Form
https://wpmonks.com/blog/how-to-disable-autocomplete-in-wpforms/
How to stop auto-complete on Elementor Forms
byu/hamsternose inelementor
