---
tags:
  - wordpress
  - security
  - ubuntu
  - lamp
  - hardening
---

# Securing a WordPress Installation on Ubuntu

WordPress's popularity makes it a prime target for attackers. A default installation is not secure enough for a production environment. This guide covers the essential steps to harden your WordPress site on a LAMP stack.

## 1. Prerequisites

*   A working WordPress installation.
    *   **Reference:** [[Ubuntu-WordPress-Setup|Installing WordPress on a LAMP Stack]]

## 2. File & Folder Permissions

The principle of "least privilege" is your most powerful defense. Files and folders should only have the permissions they absolutely need to function.

*   **Reference:** [[Ubuntu-File-Permissions|Mastering Ubuntu File Permissions]]

1.  **Set Ownership:** Ensure all files are owned by the web server user (`www-data`).
    ```bash
    sudo chown -R www-data:www-data /var/www/html
    ```
2.  **Set Permissions:**
    *   Set all directories to `755` (or `750` for more security). This allows the owner to do anything, and others to read and execute (enter the directory).
    *   Set all files to `644` (or `640`). This allows the owner to read/write, and others to only read.
    ```bash
    sudo find /var/www/html/ -type d -exec chmod 755 {} \;
    sudo find /var/www/html/ -type f -exec chmod 644 {} \;
    ```
3.  **Protect `wp-config.php`:** This file is the most critical. It contains your database credentials. Lock it down further.
    ```bash
    sudo chmod 600 /var/www/html/wp-config.php
    ```

## 3. Disable the Dashboard File Editor

By default, WordPress allows administrators to edit theme and plugin files directly from the dashboard. If an attacker gains access to your admin account, they can execute malicious code.

1.  **Edit your config file:**
    ```bash
    sudo nano /var/www/html/wp-config.php
    ```
2.  **Add this line** just before `/* That's all, stop editing! */`:
    ```php
    define('DISALLOW_FILE_EDIT', true);
    ```
3.  Save and exit (`Ctrl+O`, `Enter`, `Ctrl+X`). The "Theme File Editor" and "Plugin File Editor" options will now be gone from your dashboard.

## 4. Disable XML-RPC

XML-RPC is an old API that allows remote connections to WordPress. It's a common target for brute-force attacks. If you don't use the WordPress mobile app or other remote publishing tools, you should disable it.

*   **Method 1 (Plugin):** The easiest way is to use a security plugin (see below) which often has a one-click option to disable it.
*   **Method 2 (`.htaccess`):** If you are using Apache, you can block access by adding the following to your `.htaccess` file:
    ```apache
    <Files xmlrpc.php>
    order deny,allow
    deny from all
    </Files>
    ```

## 5. Install a Security Plugin (WAF)

A Web Application Firewall (WAF) is a shield that sits between your site and the internet, blocking malicious requests before they even reach WordPress.

*   **Recommendation:** Install **Wordfence** or **Sucuri Security** from the WordPress plugin repository.
*   **Key Features:**
    *   Firewall to block common attacks.
    *   Malware scanner to check for infected files.
    *   Login protection (rate limiting, 2FA).

## 6. General Best Practices

*   **Don't use "admin" as a username.** If you created it during installation, make a new administrator user and delete the original 'admin'.
*   **Use strong, unique passwords** for all accounts, especially your database and admin user.
*   **Keep everything updated:** WordPress core, all plugins, and all themes must be kept on their latest versions to patch security vulnerabilities.
*   **Regular Backups:** Set up a regular, automated backup schedule. A good backup is the ultimate security tool, as it allows you to recover from any disaster.