What additional securities do you add to open source cms installations?

Question

I know that being open source does not necessarily make the program more / less secure than a closed source (let's say this neutrality to keep the flames from this message). Fact: since the source code is open, everyone knows your default URLs, default admin logins, etc.

I use Wordpress and Joomla in some projects of my clients, and I always try to create some additional security. Excluding always updating your files to the latest version, what do you usually do to add extra security to this scenario? Some of my thoughts:

• I always change the admin name when applicable;

• I would not want to explain what technologies I use, but since I want to promote cms (I think this is the minimum that I should do), I just don’t tell the exact version so the attackers don’t know which vulnerabilities they can attack (wordpress automatically creates a meta tag in html saying "Wordpress 2.8.4", for example);

• Set the correct permissions in the directories and bash scripts on my server that work every day when setting 0h to 755 in a directory, which I may have changed to 775 during the day and forgot to return;

• When applicable, I set the apache configuration to limit ips.

What else should I do? What out of the box solutions do you usually make for your installations?

Answer 1

- mod_security mod_evasive Apache - , ; , - , .
Apache, Apache, , .

PHP- PHP-IDS; -:

PHPIDS ( PHP- System) , , - PHP . IDS , , , , . , . , .

, "" CMS, - , , - , .
" ?" FAQ.

, , : SQL, ; ; ,...

Answer 2

, - Apache. -, / / .

, . , "" Wordpress admin /wp -admin - (,/my-admin). .

, . , Drupal . , .

//, 100% . MySQL, . chroot jail ( , , root), .

Answer 3

. Hardening Wordpress Wordpress htaccess wordpress.org codex.

Wordpress

function remove_header_info() {

remove_action('wp_head', 'wp_generator');
}

add_action('init', 'remove_header_info');

functions.php , WP wp_head header.php.

Answer 4

Joomla , jos_.

Answer 5

, Wordpress.

Wordpress, , .

- ( pugins), , , ( ).