Wordpress and Joomla

Wordpress :

PHP Deny Rule

<Files *.php>
deny from all
</Files>

Wordpress :

- Upgrade your web applications to latest version to secure the websites from

known vulnerabilities.

- Set strong website admin panel password.

- Do not store unnecessary files online

- Avoid having directory/files with 0777 permission.

- Scan your local system with a good antivirus.

- Install themes and plugins from trusted source.

- Install security plugins like bulletproof and wordfence.

Joomla :

Please do the below steps over the domain to protect from further code

injections.

====

-- Please ensure you have the latest version of Joomla for your version of

Joomla. Delete all files in your Joomla installation, saving a copy of the

configuration.php file.

-- Review Vulnerable Extensions List to make sure any 3rd party extensions

versions used appear on the vulnerable list.

-- Scan all machines with FTP, Joomla super admin, and Joomla admin access for

malware, virus, trojans, spyware, etc.

-- Change all passwords and if possible user names for the website host control

panel. Change the Joomla database user name and password.

-- Use proper permissions on files and directories. They should never be 777,

ideal is 644 for files and 755 for directories. The configuration file can be

set to 444 which is read only.

-- Check your htaccess for for any odd code (i.e. code which is not in the

standard htaccess supplied as part of the Joomla installation).

-- Check the crontab or Task Scheduler for unexpected jobs/tasks.

-- Verify individually that any non-Joomla file such as but not limited to that

will be placed back on the website such as images, pdf files, files for

download, and other documents and files are valid and are supposed to be part of

your website.