Hardening Guide for WordPress and cPanel/WHM
Protection Against XML-RPC Attacks on WordPress
XML-RPC is a protocol used by WordPress for remote communications, but it is a common vector for brute force attacks. Here's how to block it:
1. Complete Deactivation of XML-RPC
Add to the
.htaccess file:
# Bloquear XML-RPC
order deny,allow
deny from all
2. Configuration in cPanel/WHM
In WHM, navigate to
Security Center > ModSecurity™ Tools and apply the OWASP rules to block malicious XML-RPC requests.
Configuring Security HTTP Headers
1. Content Security Policy (CSP)
Add to the
.htaccess or server configuration:
Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://trusted.cdn.com; style-src 'self' 'unsafe-inline'"
2. HTTP Strict Transport Security (HSTS)
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
PHP Injection Mitigation
1. .htaccess Rules to Block PHP Execution
# Prevenir ejecución en subcarpetas
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-content/uploads/
RewriteRule .php$ - [F]
2. mod_security Configuration
In WHM, enable the OWASP Core Rule Set (CRS) rules and add custom rules:
SecRule ARGS "@rx b(?:system|shell_exec|phpinfo)b"
"id:1000,phase:2,deny,status:403,msg:"PHP Injection Attempt""
Frequently Asked Questions
How can I verify if security headers are active?
Use tools like
SecurityHeaders.com or the
curl -I tudominio.com command.
What impact does disabling XML-RPC have on WordPress?
It may affect certain plugins or the WordPress mobile app. For safe alternatives, consider
specific plugins that allow granular control.
How can I test mod_security rules without blocking legitimate traffic?
Initially configure them in
SecRuleEngine DetectionOnly mode and monitor the logs before enabling blocking.
