网站安全
One-Sentence Conclusion
After rescuing the site, you MUST "harden" it, otherwise the recurrence rate is extremely high. Sellers on aaPanel + WordPress who follow this 10-item checklist can block most automated site scanning and brute-force attacks.
10-Point Hardening Checklist
| # | Item | Key Actions |
|---|---|---|
| 1 | Panel access | Change to random path, strong password, IP whitelist |
| 2 | SSH | Change port, disable root password login, use SSH keys |
| 3 | Firewall | Only open 80/443/custom SSH |
| 4 | WordPress | Delete admin user, enable 2FA, disable theme/plugin editor |
| 5 | File permissions | Directories 755, files 644, wp-config.php 600 |
| 6 | Upload directory | Block PHP execution in uploads (Nginx rule) |
| 7 | Updates | Regularly upgrade core, plugins, themes, aaPanel |
| 8 | Backups | Daily DB + weekly full-site backups, off-site storage |
| 9 | Monitoring | Alerts for disk, CPU, file changes |
| 10 | WAF | Rate limiting, SQL injection protection, block common vulnerability paths |
aaPanel Practical Tips
- Security → Enable SSH alerts, panel login alerts
- Scheduled Tasks → Regular audits, delete unfamiliar scripts
- Websites → Enable SSL, force HTTPS, HSTS (after confirming everything works)
- Do not install "cracked plugins" from unknown sources
WordPress Least Privilege Principle
- Use separate accounts for editors and administrators
- Disable XML-RPC (when not needed)
- Add
DISALLOW_FILE_EDITtowp-config.php - Security plugins are only supplementary — they cannot replace server hardening
How This Relates to the Emergency Guide
If your site has already been compromised, first read the Emergency Recovery Guide for Hacked Websites, then run this checklist after cleanup.
FAQ
Q: Will hardening affect website speed? A: Properly configured WAF and caching usually improve or maintain performance; they won't noticeably slow things down.
Q: Do small sites really need all this? A: As long as you have ad spend or payment processing, it's worth doing. Attacks are automated and don't discriminate by size.
Q: Can backups be stored on the same server? A: No. Ransomware will encrypt backups on the same disk. Always use off-site storage (object storage/another machine).
Q: How often should I check? A: Quick monthly inspections, full quarterly audits.
Q: Does GULINGLE offer managed hardening? A: Yes, we offer a one-time hardening package and annual managed maintenance hosting, including monitoring and backup verification.
