使用.htaccess保护WordPress管理面板免受黑客攻击

If you are using WordPress as the platform behind your blog or website you probably know that there have been a lot of security holes, not just in the software itself, but also in the plugins as well. In light of these problems, we’ll look at how to prevent hacking attempts by locking down your administration folder.

如果您使用WordPress作为博客或网站背后的平台，则您可能知道存在很多安全漏洞，不仅在软件本身，而且在插件方面也存在。 针对这些问题，我们将研究如何通过锁定管理文件夹来防止黑客尝试。

The Apache web server has a built-in mechanism that allows you to assign a required password for a folder, which is separate from your WordPress password.

Apache Web服务器具有内置机制，可让您为文件夹分配所需的密码，该密码与WordPress密码分开。

Quick Blog Security Tips

快速博客安全提示

Security is important enough that I felt it necessary to include some extra tips here. This is by no means a complete list, but you should look into them anyway.

安全性非常重要，以至于我认为有必要在此处添加一些额外的提示。 这绝不是完整的列表，但是无论如何您都应该对其进行研究。

• Make sure you are running the latest version of WordPress and all your plugins.
  确保您正在运行最新版本的WordPress及其所有插件。

• You should consider subscribing to BlogSecurity.net, a blog that attempts to cover security news about blogging platforms.

  您应该考虑订阅BlogSecurity.net ，该博客试图涵盖有关博客平台的安全性新闻。

• Make sure that your file permissions are set correctly according to the WordPress guidelines.

  确保根据WordPress准则正确设置了文件权限。

• Make sure you are using tough passwords for all accounts.
  确保您对所有帐户使用强密码。
• Make sure that you are backing up your entire WordPress installation and database.
  确保您正在备份整个WordPress安装和数据库。
• Lock down your administration folder with .htaccess rules (covered here)
  使用.htaccess规则锁定您的管理文件夹(在此处找到)

Assigning a Password to wp-admin Directory Manually

手动为wp-admin目录分配密码

Create a file named .htaccess in your wp-admin directory, and add the following contents:

在wp-admin目录中创建一个名为.htaccess的文件，并添加以下内容：

AuthName “Restricted Area” AuthType Basic AuthUserFile /var/full/web/path/.htpasswd AuthGroupFile /dev/null require valid-user

AuthName“限制区域” AuthType基本AuthUserFile /var/full/web/path/.htpasswd AuthGroupFile / dev / null需要有效用户

You’ll need to adjust the AuthUserFile line to use the full path to the .htpasswd file we’ll create in the next step. You can find the full path by using the pwd command from the shell prompt.

您需要调整AuthUserFile行，以使用下一步将创建的.htpasswd文件的完整路径。 您可以在shell提示符下使用pwd命令找到完整路径。

Next you’ll need to use the htpasswd command line utility to create the password file. I would also advise that you use a different user account and password than you use for your WordPress installation.

接下来，您将需要使用htpasswd命令行实用程序来创建密码文件。 我还建议您使用与WordPress安装不同的用户帐户和密码。

$ htpasswd -c .htpasswd myusernameNew password: Re-type new password: Adding password for user myusername

$ htpasswd -c .htpasswd myusername新密码：重新输入新密码：为用户myusername添加密码

You’ll want to make sure you are in the directory specified by AuthUserFile, and change “myusername” to something unique for your site. This will create a file with contents similar to the following:

您需要确保您位于AuthUserFile指定的目录中，并将“ myusername”更改为站点唯一的名称。 这将创建一个文件，其内容类似于以下内容：

myusername:aJztXHCknKJ3.

myusername：aJztXHCknKJ3。

At this point you should be prompted for a password when you navigate to your WordPress administration panel. You’ll notice that “Restricted Area” is the text from the .htaccess file, which could be changed to anything else.

此时，当您导航到WordPress管理面板时，系统将提示您输入密码。 您会注意到“限制区域”是.htaccess文件中的文本，可以将其更改为其他任何内容。

If you get a server error instead, you should probably remove the .htaccess file and start over.

如果出现服务器错误，则可能应删除.htaccess文件并重新开始。

Lastly, you should make sure that you remove write permissions to both files with the chmod command as one more layer of security.

最后，您应该确保使用chmod命令删除对这两个文件的写许可权，这是另一层安全性。

chmod 444 .htaccess

chmod 444 .htaccess

chmod 444 .htpasswd

chmod 444 .htpasswd

.htaccess Password File Generator

.htaccess密码文件生成器

There’s a great tool from Dynamicdrive that will do all the hard work of creating the file for you. This is especially useful if you don’t have shell access to your server, because you can just upload the files via your FTP/SFTP client.

Dynamicdrive有一个很棒的工具，它将为您创建文件进行所有艰苦的工作。 如果您没有外壳访问服务器的权限，这将特别有用，因为您可以通过FTP / SFTP客户端上传文件。

http://tools.dynamicdrive.com/password/

http://tools.dynamicdrive.com/password/

You should still make sure that you remove write access once the files are uploaded.

上传文件后，您仍应确保删除写访问权限。

翻译自: https://www.howtogeek.com/howto/the-geek-blog/protecting-your-wordpress-admin-panel-from-hackers-with-htaccess/