The widely-advertised tricks for securing Wordpress are burdened by the fact that limiting access will simply break certain Wordpress functionality, which is something most tutorials do mention... however, I have worries that most of them would actually stop Wordpress from working
at all.
The trick with locking up wp-admin with a password:
AuthName "Admins Only"
AuthUserFile /home/yourdirectory/.htpasswds/public_html/wp-admin/passwd
AuthGroupFile /dev/null
AuthType basic
require user putyourusernamehere
<Files admin-ajax.php>
Order allow,deny
Allow from all
Satisfy any
</Files>
There is an exception for admin-ajax.php, so that some themes/plugins can access the file, right? But isn't the 'Allow from all' part essentially giving access to everyone? admin-ajax.php is a sensitive part of Wordpress, so doesn't allowing everyone to access it past the password lock defeat the purpose?
Isn't there a way to only allow Wordpress to access itself from
within my own website, by using the my domain name or host IP with the 'allow from...' instruction? I think that would be safer than just opening up a gate to admin-ajax.php for everybody?
Or, is that how it actually
does work, that it only allows access to 'all' who come from within the website, from within my server/host/web account?
AuthUserFile /dev/null
AuthGroupFile /dev/null
AuthName “Access Control”
AuthType Basic
order deny,allow
deny from all
allow from 123.123.123.123
This is supposed to lock the wp-admin from everyone, except the IP listed in 'allow from...', but isn't this going to block the Wordpress install itself from anything in wp-admin? I'm guessing an exception for admin-ajax.php would also be necessary here, again, so that some themes/plugins can access the file? Which would, again, introduce a gate to admin-ajax for everybody out there?...
Another instruction suggests to block script access/execution from within wp-content:
<Files *.php>
Order Allow, Deny
Deny from all
</Files>
Considering how Wordpress works, isn't this going to completely wreck Wordpress, as it won't be able to use any theme and plugins php files?... Or am I missing something here? Are the requests Wordpress makes for its own files when it's running on my host account recognized as some sort of 'inside requests' and are allowed to pass through these deny rules?...
Yet another one, this time blocking the wp-includes directory:
RewriteEngine On
RewriteBase /
RewriteRule ^wp-admin/includes/ - [F,L]
RewriteRule !^wp-includes/ - [S=3]
RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
RewriteRule ^wp-includes/theme-compat/ - [F,L]
The same as above, looks like this will stop Wordpress from wp-includes php files, which seem crucial to its functioning.
There is also the trick to hide wp-config.php from direct access, also using the <Files> brackets and Deny instructions, which looks like it's also going to hide it from Wordpress itself?...
Moreover - all tutorials specify these instructions as the seemingly only necessary ones to be put in a .htaccess file in a given directory (wp-admin, wp-includes, uploads, etc.). But isn't that going to cancel out the main .htaccess file in the web root/Wordpress root directory and any safety instructions set up in them?
I set up hotlinking protection from cPanel on my host to protect image files and it crated a .htaccess file in the web root directory. My Wordpress is in a subdirectory, where another .htaccess was present, created by Wordpress itself, with pretty permalinks instructions. Hotlinking was thus banned around my web account, because of the root .htaccess, but - that protection was lifted in the Wordpress subdirectory, apparently because of the presence of another .htaccess file, which only icluded Rewrite rules for permalinks, and no hotlinking protecton... judging from this, .htaccess files completely overwrite/cancel out each other's functionality?
So if I set up limits on various user agents in root public_html .htaccess, and then place only premalinks rewrites in public_html/wordpress/ .htaccess, these user agents will still be able to access /wordpress, because the limiting instructions won't apply there anymore?
I would appreciate it if someone could help me understand how all this works. I understand how Rewrite rules work and how they can filter/deny requests coming from outside, but I'm still not sure how denying or allowing is dealt with when it comes to activity within a web server/account...
