In our effort to make our platform more secure and robust, we have added the following security measures to our WordPress Hosting & Reselling product.

Limit login attempts to /wp-admin

Brute-force login attempts will no longer be allowed on /wp-admin login page. After five wrong attempts (wrong username or password) the system will block login attempts from the IP being used. This will have a cool-off period of 15 minutes. The following error message will be shown in the interim :

Restrict .htaccess in uploads folder

Uploading .htaccess files inside the WordPress /uploads folder will no longer be allowed. This will prevent bad actors from uploading config files of your WordPress site.

Executing .php files in uploads folder

Executing .php files inside the WordPress /uploads folder will no longer be allowed. This will prevent script injection attacks to your WordPress site.

Disable xml-rcp.php

xml-rpc.php allows remote updates to a WordPress site. This will be disabled by default on all new instances to prevent misuse and unauthorized updates.

Database security

We have taken steps to make your WordPress database more secure which prevents unauthorized parties from getting access to your data stored in SQL.