jennimckinnon’s gists

jennimckinnon / functions.php

Created May 22, 2016 06:28

	update_option( 'siteurl', 'http://your-site.com' );
	update_option( 'home', 'http://your-site.com' );

jennimckinnon / wp-config.php

Created May 21, 2016 22:31

	// MySQL settings - You can get this info from your web host //
	/** The name of the database for WordPress */
	define('DB_NAME', 'database_name_here');

	/** MySQL database username */
	define('DB_USER', 'username_here');

	/** MySQL database password */
	define('DB_PASSWORD', 'password_here');

jennimckinnon / .htaccess

Last active May 19, 2016 00:06

Prevent hot linking in WordPress.

	RewriteEngine On RewriteCond %{HTTP_REFERER} !^$ RewriteCond %{HTTP_REFERER}
	!^http://(www\.)?your-site.com/.*$ [NC] RewriteRule \.(gif\|jpg)$
	http://www.your-site.com/hotlink.gif [R,L]

jennimckinnon / .htaccess

Created May 18, 2016 23:52

	SSLOptions +StrictRequire
	SSLRequireSSL
	SSLRequire %{HTTP_HOST} eq "www.you-site.com"
	ErrorDocument 403 https://www.your-site.com

jennimckinnon / .htaccess

Created May 18, 2016 23:50

Prevent username enumeration in WordPress. Source: http://www.acunetix.com/websitesecurity/wordpress-security-top-tips-secure-wordpress-application/

	RewriteCond %{QUERY_STRING} author=d
	RewriteRule ^ /? [L,R=301]

jennimckinnon / .htaccess

Created May 18, 2016 23:34

Restrict all access to wp-includes. Source: http://www.wpexplorer.com/htaccess-wordpress-security/

	<IfModule mod_rewrite.c>
	RewriteEngine On
	RewriteBase /
	RewriteRule ^wp-admin/includes/ - [F,L]
	RewriteRule !^wp-includes/ - [S=3]
	RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
	RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
	RewriteRule ^wp-includes/theme-compat/ - [F,L]
	</IfModule>

jennimckinnon / .htaccess

Created May 18, 2016 23:31

Prevent script injections using GLOBALS and _REQUEST variable in WordPress. Source: http://www.wprecipes.com/protect-your-wordpress-blog-using-htaccess

	Options +FollowSymLinks
	RewriteEngine On
	RewriteCond %{QUERY_STRING} (<\|%3C).script.(>\|%3E) [NC,OR]
	RewriteCond %{QUERY_STRING} GLOBALS(=\|[\|%[0-9A-Z]{0,2}) [OR]
	RewriteCond %{QUERY_STRING} _REQUEST(=\|[\|%[0-9A-Z]{0,2})
	RewriteRule ^(.*)$ index.php [F,L]

jennimckinnon / .htaccess

Created May 18, 2016 23:22

	<Directory "/var/www/wp-content/uploads/">
	<Files "*.php">
	Order Deny,Allow
	Deny from All
	</Files>
	</Directory>

jennimckinnon / .htaccess

Last active January 30, 2023 13:04

Restrict Direct Access to Plugin and Theme PHP files in WordPress. Source: https://www.acunetix.com/websitesecurity/wordpress-security-top-tips-secure-wordpress-application/

	RewriteCond %{REQUEST_URI} !^/wp-content/plugins/file/to/exclude\.php
	RewriteCond %{REQUEST_URI} !^/wp-content/plugins/directory/to/exclude/
	RewriteRule wp-content/plugins/(.*\.php)$ - [R=404,L]
	RewriteCond %{REQUEST_URI} !^/wp-content/themes/file/to/exclude\.php
	RewriteCond %{REQUEST_URI} !^/wp-content/themes/directory/to/exclude/
	RewriteRule wp-content/themes/(.*\.php)$ - [R=404,L]

jennimckinnon / .htaccess

Created May 18, 2016 23:01

Prevent directory browsing

Options All -Indexes