Security: login protection, two-step login and hardening

The Security tab (Baza Helper > Security) groups the settings that make a WordPress site harder to attack. Each is a switch, so you turn on only what you need. At the top, the Checks card tests HTTPS, a user named admin, readme and license files, WP_DEBUG_DISPLAY and the PHP version.

Login protection

• Lock an address after too many failed logins: set Failed attempts allowed and Lock for (minutes).
• Say only “username or password is incorrect”: one generic error, so attackers cannot learn which user names exist.
• Refuse new accounts named admin, root, test and the like.
• The site is behind a proxy or CDN: reads the visitor address from the proxy’s header. Turn it on only if the site really is behind a proxy such as Cloudflare, otherwise visitors could pretend to be someone else.

Locked addresses lists the last 50 lockouts with the time left. Unlock all clears them.

Two-step login

Switch on Ask for a verification code at login and save. Each person then sets up their own account; accounts that have not are not asked for a code. It works with any authenticator app, for example Google Authenticator, Microsoft Authenticator, 1Password or Authy.

1. Press Set up for my account.
2. Open the link on your phone with Open in authenticator app, or type the key in by hand (time based).
3. Enter the 6-digit code and press Confirm and turn on.
4. Save the backup codes. They are shown once, and each works one time if you lose your phone.

Turn off for my account removes the requirement for you. If you lose both your phone and your backup codes, add define( 'BAZA_HELPER_TWOFA_OFF', true ); to wp-config.php, log in, and remove the line afterwards.

Private login address

Type a word in A private word for the login address and save. From then on wp-login.php and wp-admin show a 404 to people who are not logged in, and you log in at the new address, which is shown under the field. Save the new address somewhere before you leave the page. If you lock yourself out, add define( 'BAZA_HELPER_LOGIN_URL_OFF', true ); to wp-config.php and the normal address works again.

Hardening

• Hide the WordPress version from the generator tag and from asset addresses.
• Turn off XML-RPC.
• Turn off the theme and plugin file editor.
• Stop user name scans: the ?author= redirect, the REST users list for guests and the users sitemap.
• Remove readme.html and license.txt from the site root. They show the WordPress version and are removed again after each core update.
• Turn off RSS and Atom feeds. Visitors go to the home page.
• Do not run scripts from the uploads folder and hide its file list. This writes a marked block to uploads/.htaccess and works on Apache and LiteSpeed. On Nginx add the equivalent rule to the server configuration.

Comments

Turn off comments and pingbacks on the whole site closes comments on every post type, removes the comment form and list, the Comments menu and Discussion settings in the admin, the admin bar bubble, the recent-comments widget and the comment feeds. Saved comments are kept and come back if you turn the switch off. Product reviews are comments too, so they stop as well.

Security headers

• X-Content-Type-Options: nosniff
• Referrer-Policy: strict-origin-when-cross-origin
• X-Frame-Options: SAMEORIGIN, so other sites cannot put yours in a frame
• Permissions-Policy: no camera, microphone or payment request

After an incident

Sign out all other users ends every other session at once, and those users must log in again. Your own session stays.