Website Security Hardening

18 items · Technical · Hard difficulty · 2 hours

Essential steps to harden your website and reduce attack surface.

• Install and configure an SSL/TLS certificate

  Use Let's Encrypt or a commercial cert; configure auto-renewal and correct chain.

• Redirect all HTTP traffic to HTTPS (301)

  Update server or CMS redirects and test with curl and browsers.

• Enable HSTS with a conservative max-age and test before preloading

  Start with a small max-age, verify all subdomains serve HTTPS before increasing.

• Disable weak TLS versions and ciphers; enable TLS1.2+ / TLS1.3

  Scan with SSL Labs and remove TLS1.0/1.1 and weak ciphers.

• Update CMS core to the latest stable release

  Apply updates on staging first when possible; test critical functionality.

• Audit plugins and themes for vulnerabilities

  Check changelogs, vendor reputation, and vulnerability databases.

• Remove inactive or unsupported plugins and themes

  Delete unused code to reduce attack surface.

• Verify plugin/theme update cadence and vendor support

  Prefer actively maintained extensions with quick security fixes.

• Configure and test a Web Application Firewall (WAF)

  Enable OWASP/core rules and tune false positives before enforcing.

• Enable login rate limiting and account lockout

  Throttle failed attempts and temporarily block abusive IPs.

• Enforce strong admin account policies

  Use unique usernames, long passwords, and role-based access.

• Enable multi-factor authentication for administrator accounts

  Use time-based OTP or hardware keys for higher assurance.

• Change database table prefix and rotate DB credentials

  Rotate DB user password and restrict DB user privileges.

• Harden file and directory permissions to least privilege

  Apply 644/640 for files and 755 for directories, adjust for your server user.

• Restrict wp-config.php and other sensitive files via server rules

  Set file to 400/440 and block web access with server or .htaccess rules.

• Disable directory listing and block access to .git and backup files

  Prevent exposure of source and backups via web server configuration.

• Implement regular offsite backups and test restores

  Schedule automated backups, keep versions offsite, and perform restore drills.

• Monitor logs and enable alerting for suspicious activity

  Centralize logs, watch for repeated failures and unexpected file changes.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.