Actually, you could achieve all this by simply modifying the vhost file. It would be nicer if the client could toggle these on and off, I know.
Restricting Access to Files and Directories
Do you mean to a specific IP? If so:
location = /wp-config.php {
allow <ip>;
deny all;
}
Blocking Unauthorized Access to xmlrpc.php
location = /xmlrpc.php {
deny all;
}
This could be done from the WP Dashboard.
You can disable the trackbacks and pingbacks feature by going to Settings » Discussion in the WordPress dashboard.
Then, just uncheck the box next to "Allow link notifications from other blogs (pingbacks and trackbacks) on new posts".
And uncheck the box next to ‘Attempt to notify any blogs linked to from the article’ option.
Click on the save changes button to store your settings.
Keep in mind that this setting only disables trackbacks and pingbacks for any new articles you publish.
All your old posts will still have trackbacks and pingbacks enabled.
Disabling File Editing in WordPress Dashboard
Add this to the wp-config.php file:
define('DISALLOW_FILE_EDIT', 'true');
This could be done using the Ninja Firewall plugin (which I use on all my sites) or through NGINX:
if ($args ~* "^author=([0-9]+|{num:[0-9]+)") {
return 444;
}
if ($request_uri ~ "/wp-json/wp/v2/users") {
return 444;
}
if ($request_uri ~ "/author/") {
return 444;
}
if ($request_uri ~ "wp-sitemap-users-[0-9]+.xml") {
return 444;
}
Blocking Directory Browsing
I think this is already done by Enhance by default using autoindex off;
Forbidding Execution of PHP Scripts in Specific Directories
You could use this:
location = /(?:uploads|files|wp-content|wp-includes)/.*.php$ {
deny all;
}
Disabling Scripts Concatenation for WordPress Admin Panel
Add this to the wp-config.php file:
define('CONCATENATE_SCRIPTS', false);
Blocking Access to Sensitive Files
You could use this for example:
location = /install.php {
deny all;
}
location = /upgrade.php {
deny all;
}
location = /wp-config-sample.php {
deny all;
}
This all should be done by the admin and there is no way to a client for now to make these changes. I would love if Enhance could give us the chance to make these changes global to WordPress sites in the future or by making a WP security tab in the Toolkit for toggling off and on.
