Установка и защита WordPress на Debian

Установка базового стека

apt update && apt upgrade -y
apt install -y nginx mariadb-server \
php8.4-fpm php8.4-mysql php8.4-xml php8.4-curl \
php8.4-gd php8.4-mbstring php8.4-zip unzip curl

---

Создание базы данных WordPress

mysql_secure_installation

CREATE DATABASE wp_example CHARACTER SET utf8mb4;
CREATE USER 'wp_user'@'localhost' IDENTIFIED BY 'STRONG_PASSWORD';
GRANT ALL PRIVILEGES ON wp_example.* TO 'wp_user'@'localhost';
FLUSH PRIVILEGES;

---

Установка WordPress

cd /var/www
wget https://wordpress.org/latest.zip
unzip latest.zip
mv wordpress example-site.ru
chown -R www-data:www-data /var/www/example-site.ru

---

Конфигурация wp-config.php

cp wp-config-sample.php wp-config.php
nano wp-config.php

define('DB_NAME', 'wp_example');
define('DB_USER', 'wp_user');
define('DB_PASSWORD', 'STRONG_PASSWORD');
define('DB_HOST', 'localhost');

SALT-ключи

curl -s https://api.wordpress.org/secret-key/1.1/salt/

Полностью заменить блок AUTH_KEY … NONCE_SALT.

---

Автообновления безопасности WordPress

define( 'WP_AUTO_UPDATE_CORE', 'minor' );

---

Конфигурация Nginx (HTTPS)

server {
    server_name example-site.ru www.example-site.ru;
    root /var/www/example-site.ru;
    index index.php index.html;

    client_max_body_size 10G;

    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.4-fpm.sock;
    }

    location ~ /\. {
        deny all;
    }

    listen 443 ssl;
    ssl_certificate /etc/letsencrypt/live/example-site.ru/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example-site.ru/privkey.pem;
}

---

Получение SSL-сертификата Let’s Encrypt

apt install -y certbot python3-certbot-nginx
certbot --nginx -d example-site.ru -d www.example-site.ru

Автообновление:

systemctl enable certbot.timer

---

Защита WordPress (рекомендованный минимум)

Закрыть xmlrpc.php

location = /xmlrpc.php {
    deny all;
}

Ограничить wp-admin по IP

location ^~ /wp-admin/ {
    allow 192.168.100.0/24;
    deny all;

    index index.php;
    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.4-fpm.sock;
    }
}

wp-login rate limit

limit_req_zone $binary_remote_addr zone=wp_login:10m rate=10r/m;

location = /wp-login.php {
    limit_req zone=wp_login burst=20 nodelay;
    include snippets/fastcgi-php.conf;
    fastcgi_pass unix:/run/php/php8.4-fpm.sock;
}

---

Security Headers

add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;

---

Fail2Ban для Nginx + WordPress

apt install -y fail2ban

[nginx-wordpress]
enabled = true
filter = nginx-wordpress
logpath = /var/log/nginx/access.log
maxretry = 5
bantime = 1h

---

Скрытие версии WordPress (MU-plugin)

mkdir -p wp-content/mu-plugins
nano wp-content/mu-plugins/hardening.php

<?php
remove_action('wp_head', 'wp_generator');
add_filter('the_generator', '__return_empty_string');

---

Разрешение загрузки .exe (только для администраторов)

add_filter('upload_mimes', function ($mimes) {
    if (current_user_can('administrator')) {
        $mimes['exe'] = 'application/octet-stream';
    }
    return $mimes;
});

---