Manages common security aspects of WordPress. Supports nginx and Apache.

This package implements the following commands:

wp secure block_access_to_htaccess

Blocks access to .htaccess and nginx.conf files.

wp secure block_access_to_htaccess [--remove] [--file-path=/alternative/path] [--output] [--server=apache|nginx]

wp secure block_access_to_sensitive_directories

Blocks direct access to sensitive directories - .git, svn, cache and vendors

wp secure block_access_to_sensitive_directories [--remove] [--file-path=/alternative/path] [--output] [--server=apache|nginx]

wp secure block_access_to_sensitive_files

Blocks direct access to sensitive files - readme.txt, readme.html, wp-config.php, wp-admin/install.php and wp-admin/upgrade.php

wp secure block_access_to_sensitive_files [--remove] [--file-path=/alternative/path] [--output] [--server=apache|nginx]

wp secure block_access_to_xmlrpc

Blocks direct access XML-RPC

wp secure block_access_to_xmlrpc [--remove] [--file-path=/alternative/path] [--output] [--server=apache|nginx]

Blocks author scanning. Author scanning is a common technique of brute force attacks on WordPress. It is used to crack passwords for the known usernames and to gather additional information about the WordPress itself.

wp secure block_author_scanning [--remove] [--file-path=/alternative/path] [--output] [--server=apache|nginx]

Blocks direct access and execution of PHP files in wp-content/plugins directory.

wp secure block_php_execution_in_plugins [--remove] [--file-path=/alternative/path] [--output] [--server=apache|nginx]

Blocks direct access and execution of PHP files in wp-content/uploads directory.

wp secure block_php_execution_in_uploads [--remove] [--file-path=/alternative/path] [--output] [--server=apache|nginx]

Blocks direct access and execution of PHP files in wp-content/themes directory.

wp secure block_php_execution_in_themes [--remove] [--file-path=/alternative/path] [--output] [--server=apache|nginx]

Blocks direct access and execution of PHP files in include directories - wp-admin/includes, wp-includes/*.php, wp-includes/js/tinymce/langs/*.php, wp-includes/theme-compat

wp secure block_php_execution_in_wp_includes [--remove] [--file-path=/alternative/path] [--output] [--server=apache|nginx]

Disables directory browsing.

By default when your web server does not find an index file (i.e. a file like index.php or index.html), it automatically displays an index page showing the contents of the directory. This could make your site vulnerable to hack attacks by revealing important information needed to exploit a vulnerability in a WordPress plugin, theme, or your server in general.

wp secure disable_directory_browsing [--remove] [--file-path=/alternative/path] [--output] [--server=apache|nginx]

Removes all security rules.

wp secure flush

Using --remove with any rule command, you can remove it from configuration.

wp secure block_php_execution_in_wp_includes --remove

Using --output option with any rule command, you can see actual rule code which you can inspect or manually copy to any file of your choice.

wp secure block_php_execution_in_wp_includes --output
wp secure block_php_execution_in_wp_includes --output --server=nginx

By default, all rules are generated for Apache or LiteSpeed web servers that utilize .htaccess file. However, you can use --server to specify nginx if you want.

wp secure block_php_execution_in_wp_includes --server=nginx
wp secure block_php_execution_in_wp_includes --server=--file-path=/home/user/mysite.com/nginx.conf

By default, all commands assume that rules should be written in the root of WordPress installation in .htaccess and nginx.conf, depending on which server you choose. However, you can specify a custom file path that is going to be used for storing security rules.

wp secure block_php_execution_in_plugins --file-path=/home/user/mysite.com/.htaccess

nginx rules are stored in the nginx.conf file. However, for rules to actually work, you need to manually include this file in your vhost configuration and then restart nginx server:

systemctl restart nginx

WIth each rule deploy or removal, you also need to restart nginx server.

To install the latest version of this package over what's included in WP-CLI, run:

wp package install [email protected]:igorhrcek/wp-cli-secure-command.git