You have started a blog to share your opinion with the World Wide Web. Someone stumbles upon one of your articles. He likes it, and posts it on Digg. Now it gets everyone’s attention. Visitors come pouring into your site. Your revenue starts to go up. Definitely good news! But now there is a catch. You are now the target of the ‘bad crowd’ of the Internet, spammers, hackers and leechers.
It’s time to toughen up your innocent little WordPress site. The .htaccess file is the easiest and the cheapest (actually it’s free!) solution to secure a WordPress blog.
A lot of the tips covered in this article is offered as a feature in our WordPress Security Plugin
What is a .htaccess File?
The .htaccess file is a configuration file for use on web servers running the Apache Web Server software. When a .htaccess file is placed in a directory which is in turn “loaded via the Apache Web Server”, then the .htaccess file is detected and executed by the Apache Web Server software. It is often used to specify the security restrictions for the particular directory.
In this article I’m going to show you how to strengthen your site’s security by adding/changing a few lines in this file.
Before you make any changes, it might be a good idea to take a backup of your .htaccess. If something gets messed up, you can always replace the hacked .htaccess with the original one.
Restrict Access to WP Admin directory by IP Address
If you are running a single user blog site, there is no reason to allow others to access WordPress administration panel. You can protect your WP admin from unauthorized access by listing your static IP address in the .htaccess. Here’s the trick
allow from a.b.c.d # This is your static IP
deny from all
Disable Hotlinking
Sometimes another site may directly link images from your site. It saves hard disk space by not having to store the images. But your site ends up serving the requests for them, thus using up your precious bandwidth. This is known as ‘hotlinking’. To disable this you can add these lines to the .htaccess
RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)?yourdomain.com/.*$ [NC]
#RewriteRule \.(gif|jpg)$ – [F]
RewriteRule \.(gif|jpg)$ http://www.yourdomain.com/stealingisbad.gif [R,L]
Stop Spammers
Like hotlinking, spammers are notorious to use up your site’s resources. There are a number of ways to identify a potential spammer. One of them is to detect requests with ‘no referrer’. Spammers use bots to post comments on blogs and they come from ‘nowhere’. Add these lines to stop the spammers
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{REQUEST_URI} .wp-comments-post\.php*
RewriteCond %{HTTP_REFERER} !.*yourblog.com.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^$
RewriteRule (.*) ^http://%{REMOTE_ADDR}/$ [R=301,L]
Protect WP-Config
The wp-config.php file in your WordPress installation contains some real important secrets, like database name, database username and password etc. You have no choice but to keep it secure.
<Files wp-config.php>
order allow,deny
deny from all
</Files>
Disable Directory Browsing
Someone who knows the directory structure of a WordPress installation, may use his knowledge to do some damage. Besides you should not let them know what plug-ins are you using.
Options All -Indexes
Protect .htaccess itself!
Last thing you want after spending so much time protecting your site with .htaccess, is to leave the file itself open to attack. The following hack prevents external access to any file starttng with .hta
order allow,deny
deny from all
satisfy all
</Files>
Better still, you can rename the .htaccess to any other name you like
AccessFileName ht.access
That’s it for now. Remember to test, test and test everytime you make changes to your .htaccess file (go to your site, is it still up?). Hope you find these tips useful. Happy blogging!
@David, you can add the code anywhere in the file. Adding it at the top is probably better though.
If i want to edit my site from multiple locations, and therefore IP addresses, I don’t think I can use that first hack. I really want to protect my .htaccess file but if it means I could only then edit my site from one location I would rather not change anything.
When you paste in this new code to the file, does it matter where you put it? Should it always go at the bottom, to be the latest thing added, or at the top?