Security through Obscurity

In our current series, we have talked about ways to harden and optimize your WordPress website. This time we will look at how things have changed since 2020. From caching to keeping your site hidden, the common wisdom has changed significantly.

Security through Obscurity: Didn’t work well then. Doesn’t work at all now.

Security through obscurity has never been recommended, but it did work to some degree decades ago. You could create a subdomain or similar without worrying about robots finding it almost immediately. That is no longer true. Resources like the certificate transparency projects and even browsers like Chrome have features that report URLs to third parties that scrap, scan, and visit your sites.

When you get automatic TLS HTTPS certificates issued through Let’s Encrypt or similar services, certificate transparency projects make a note of the certificate that was issued. Chrome has a similar service where the browser checks visited URLs for malware, phishing, and similar. This plus many other URL checking systems built into plugins, programs, and more publish your “secret” URL almost immediately after setup.

You can secure your website by using strong passwords and requiring login before visiting. A simple .htpasswd prompt can work well for a staging site for example.


Securing your staging or development site with .htaccess

You can set this up manually or via the Webuzo control panel. Make sure you are using https:// on your website so your passwords are sent securely.

Webuzo (Recommended):

Log into your website control panel. Once logged in, scroll down to Security and click on Directory Privacy. The Directory Privacy feature uses .htpasswd and .htaccess to implement password requirements to access your staging or development site. You can set it up in seconds.


Manually:

Using Webuzo’s File Manager or FTP, you will upload .htaccess to the folder you would like to protect such as public_html. After that, you will upload the .htpasswd file one level above public_html for security so it can’t be downloaded. You will put .htpasswd there no matter which folder you would like to protect.

In the .htaccess file, you will use something like the following:

AuthUserFile /home/webuzousernamehere/.htpasswd
AuthType Basic
AuthName "Restricted Access Only"
Require valid-user

You can use online generators such as https://www.web2generators.com/apache-tools/htpasswd-generator to generate the .htpasswd file username and password.

After uploading the files, check the URL in your browser using TLS HTTPS such as https://www.yourdomain.tld/ The browser should ask you for a username and password before allowing access if setup properly. If it doesn’t ask for a password, check the .htaccess file. It should have a . in front of the name and that is a common mistake.


Securing your site by IP instead of password

Alternatively, you can also filter by IP address whitelisting your own computer until the IP changes.

As in our previous example, you will edit the .htaccess. This time list all IP addresses you would like to allow access. Remember that home IP addresses and VPN addresses can change over time so you may need to update this when your workstation IP address changes.

In /home/yourwebuzouserhere/public_html/.htaccess put the following:

    Require all denied
    Require ip 123.123.123.123 124.124.124.124

The configuration will deny access to all IP addresses except the ones you list such as 123.123.123.123. To confirm it is working, try it from your workstation confirming access and your phone or tablet on a separate connection to show it blocking access. This can be easier to use with tools installed onto a workstation such as benchmarking or performance checking tools that may not properly support password checks.