Security WordPress

.htaccess

# .htaccess mein add karo
<IfModule mod_rewrite.c>
  RewriteRule ^wp-json/wp/v2/posts [F,L]
  RewriteRule ^wp-json/wp/v2/pages [F,L]
  RewriteRule ^wp-json/wp/v2/media [F,L]
</IfModule>

# .htaccess khud ko protect kare
<Files .htaccess>
  Order deny,allow
  Deny from all
</Files>

# xmlrpc.php band karo (common attack vector)
<Files xmlrpc.php>
  Order deny,allow
  Deny from all
</Files>

functions.php

<?php

// Post creation sirf logged-in users ke liye
add_action('rest_api_init', function() {
  remove_post_type_support('post', 'comments');
});

// Auto-publish band karo REST se
add_filter('rest_pre_insert_post', function($prepared_post, $request) {
  if (!is_user_logged_in()) {
    return new WP_Error('rest_forbidden', 'Not allowed', ['status' => 403]);
  }
  // Force draft — auto publish nahi hoga
  $prepared_post->post_status = 'draft';
  return $prepared_post;
}, 10, 2);

// New user registration band karo (agar zarurat nahi)
add_filter('option_users_can_register', '__return_false');

wp-config.php

<?php

// wp-config.php mein add karo — abhi
define('DISALLOW_FILE_EDIT', true);
define('DISALLOW_FILE_MODS', true);