[website security]Things you need to make your website more secure
Hi there
Today, I would like to introduce what you need to make your website more secure. If you have your own website like me, you can get some ideas out of it.
1: Firewall
It is very important to place firewalls on your website for a security reason.
I introduce things you need to do to protect your wordpress website using Cloudflare.
Whitelist your IP address (don’t forget)
before you set up your firewall settings, you need to do whitelist your IP address. Whitelist is an exception when you block some external access. You should block malicious attacks but allow yourself to access your website.
First, from Cloudflare page, (https://dash.cloudflare.com) you login your console.
You choose Firewall > tools.
The photo above shows the following settings
Where: from your home (your home router’s IP address)
Acton: allow
Access destination: This website (in this case, http://13.115.66.130)
Therefore, If you block external access, you can only access from your home. So that you can continue to maintain your website while blocking malicious attacks.
A: Block “wp-login.php” access
When you access a console page of your website, it should be
“yourpagename/wp-login.php”
In my page, http://13.115.66.130/wp-login.php
When you type “yourpagename/wp-login.php”, you should be able to see a login page like above. This page should be accessed by only a website owner. So you should block external access to that page.
You can setup blocking at Firewall > Firewall rules > Create a Firewall rule
You can create up to 5 rules for free plan.
Rule name: wp-login block (whatever name is ok)
Field: URI Path
Operator: contains
Value: /wp-login.php
Action : Block
You can also see Expression preview if yours matches mine.
If you setup correctly, you can press Deploy.
You can see how much attack blocked last 24h. There are so many people aiming to hack your website in the world.
B: Block xmlrpc.php attack
XML-RPC has some needs when you post contents to multi WordPress sites like Desktop, smartphone and tablet at once. You can create firewall as followings
You can see some attacks too.
C: Block wp-admin attack
“yoursitename/wp-admin” is a console page which you should block because many important settings like password, posts and SNS are managed here.
To set up a firewall, you can do as followings
Reference: https://10alert.com/how-to-use-cloudflare-to-secure-your-wordpress-site/
2: spam comments workaround
Spam is very annoying as you can see the example below.
I introduce some good ways to minimize spam comments.
A: Setup a blacklist for comments
When you access your admin page, you can go to
Settings > Discussion > Disallowed comment keys. It says
When a comment contains any of these words in its content, author name, URL, email, IP address, or browser’s user agent string, it will be put in the Trash. One word or IP address per line. It will match inside words, so “press” will match “WordPress”.So, you can setup keyword like name, IP address and author name. If the comment includes blacklist keyword, it automatically goes to Trash.
B: Use plugin
In this case, I use “ Anti-Spam by CleanTalk” You can install from plugin and it looks like this
3 Anti-virus
you should use anti-virus software as you use it to your computer. There is an anti-virus plugin you can use for free.
I use “MalCare”
You can register your website from here
“https://www.malcare.com/"
It provides malware scan and firewall for free.
Conclusion
It is so important to protect your website since there are more malicious activities after COVID-19 pandemic. We can use so many tools for free.
Lets make your website more secure and we can enjoy our web surfing with no worries.
Have a great day,
Taka