6 htaccess Snippets
This blog will show you how to strengthen your WordPress security, with 6 htaccess snippets. WordPress powers millions of websites worldwide, making it a prime target for hackers due to its popularity and the vast array of plugins, themes, and integrations available. However, you don't need to be an expert to bolster your website's security. In this blog, we'll provide you with some invaluable .htaccess snippets to enhance your WordPress security without relying on plugins or hiring a professional.
Warning: Before proceeding with any changes to your .htaccess file, it's crucial to understand that alterations can have significant consequences for your website. Always proceed with caution and ensure you have a backup of the file before making any edits.
1. Block Access to .htaccess and .htpasswd Files
The .htaccess and .htpasswd files are vital configuration files for your website. Allowing unauthorized access to these files can lead to various exploits and security breaches. To safeguard against this, you can block access to these files using the following snippet:
# Block .htaccess and .htpasswd <FilesMatch ^(?i:\.ht.*)$> Require all denied </FilesMatch> # Block .htaccess and .htpasswd End
2. Block Unauthorized Access to xmlrpc.php
While xmlrpc.php facilitates remote post management in WordPress, it can also be exploited for malicious purposes, such as brute-force attacks and DDoS attacks. To prevent unauthorized access to xmlrpc.php, use the following snippet:
# Block xmlrpc <files xmlrpc.php> Require all denied </files> # Block xmlrpc End
3. Block Author Scans
Brute-force attacks often target usernames. By blocking author scans, you can mitigate this risk. However, note that depending on your permalink configuration, this option might affect page accessibility. Use the following snippet to block author scans:
# Block author scans
RewriteEngine On
RewriteBase /
RewriteCond %{QUERY_STRING} (author=\d+) [NC]
RewriteRule .* - [F]
# Block author scans End
4. Block Directory Browsing
Prevent sensitive data exposure by disabling directory browsing with the following snippet:
# Block directory browsing Options -Indexes # Block directory browsing End
5. Block Access to Sensitive Files:
Protect critical files containing credentials and sensitive information from public view with this snippet:
# Block access sensitive files <FilesMatch "^.*(((?:wp-config)\.(?:php|bak|swp))|php.ini|\.[hH][tT][aApP].*|((?:error_log|readme|license|changelog|-config|-sample)\.(?:php|md|log|txt|htm|html)))$"> Require all denied </FilesMatch> # Block access sensitive files End
6. Enable Bot Protection
Safeguard your website from harmful bots and scanners with this snippet:
# Enable bot protection
RewriteEngine on
RewriteCond %{HTTP_USER_AGENT}
#Remove the spaces after MJ12bot/v| and Xenu\s+Link\s+Sleuth| (?:virusbot|spambot|evilbot|acunetix|BLEXBot|domaincrawler\.com|LinkpadBot|MJ12bot/v| majestic12\.co\.uk|AhrefsBot|TwengaBot|SemrushBot|nikto|winhttp|Xenu\s+Link\s+Sleuth| Baiduspider|HTTrack|clshttp|harvest|extract|grab|miner|python-requests) [NC]
RewriteRule ^(.*)$ http://no.access/
# Enable bot protection End
Implementing these .htaccess snippets will significantly enhance the security of your WordPress website, reducing the risk of malicious attacks and ensuring the safety of your valuable data. Remember to proceed with caution and always have a backup of your .htaccess file before making any changes. Strengthening your website's security is essential and these snippets provide a solid foundation for safeguarding your online presence.
If you are need of security assistance, don't hesitate to get in touch. We are experts and can assist you with any website issues you are facing.
