wp-cron.phpを無効化
/* wp-config.php に追記 */
define('DISABLE_WP_CRON', 'true');
※wp-cron.phpを無効化した場合、予約投稿や通知機能などが動作しなくなるため、サーバーcronを利用
$ sudo vi /etc/crontab
# 1分ごとにcronを実行
* * * * * apache /usr/bin/php ~/wp-cron.php > /dev/null 2>&1
xmlrpc.phpのアクセス制限
# vi ~/.htaccess
<Files xmlrpc.php>
Order deny,allow
Deny from all
</Files>
wp-login.phpをアクセス制限
# vi ~/.htaccess
<Files wp-login.php>
Order deny,allow
Deny from all
Allow from xxxx.xxxx.xxxx.xxxx
Allow from xxxx.xxxx.xxxx.xxxx
...
</Files>
wp-login.phpにBasic認証を設置
# vi ~/.htaccess
<Files wp-login.php>
AuthType Basic
AuthUserFile ~/.htpasswd
AuthName "Please enter your ID and password"
require valid-user
</Files>
wp-comments-post.phpのアクセス制限
# vi ~/.htaccess
<Files wp-comments-post.php>
Order deny,allow
Deny from all
</Files>
wp-trackback.phpのアクセス制限
# vi ~/.htaccess
<Files wp-trackback.php>
Order deny,allow
Deny from all
</Files>
複数設定例
# vi ~/.htaccess
<Files ~ "^(wp-config|wp-cron|xmlrpc)\.php$">
Order deny,allow
Deny from all
</Files>
wp-adminディレクトリ以下(admin-ajax.phpを除く)をアクセス制限
# vi ~/wp-admin/.htaccess
Order deny,allow
Deny from all
Allow from xxxx.xxxx.xxxx.xxxx
Allow from xxxx.xxxx.xxxx.xxxx
...
<Files admin-ajax.php>
Satisfy Any
Order allow,deny
Allow from all
Deny from none
</Files>
wp-adminディレクトリ以下(admin-ajax.phpを除く)にBasic認証を設置
# vi ~/wp-admin/.htaccess
AuthType Basic
AuthUserFile ~/.htpasswd
AuthName "Please enter your ID and password"
Require valid-user
<Files admin-ajax.php>
Satisfy Any
Order allow,deny
Allow from all
Deny from none
</Files>
wp-config.phpのアクセス制限
# vi ~/.htaccess
<Files wp-config.php>
Order deny,allow
Deny from all
</Files>