# Security

Source: https://flywp.com/docs/site/security/

Security is paramount when it comes to website management. FlyWP’s Security page provides a suite of settings that help you protect and harden your WordPress site against common vulnerabilities and attacks.

> Note that the General Tab is only available on NGINX site, not on OpenLiteSpeed sites.

### Accessing the Security Page

1. From the FlyWP dashboard, navigate to your chosen site.
2. Click on the “Security” option in the left sidebar.

[![Iscreen shoter google chrome 251028160924](https://flywp.com/wp-content/uploads/2023/05/iScreen-Shoter-Google-Chrome-251028160924-547x1024.jpg)](https://flywp.com/wp-content/uploads/2023/05/iScreen-Shoter-Google-Chrome-251028160924.jpg)

### Security Configuration Options

[Video: Ultimate Guide: Secure Your WordPress Site with FlyWP | FlyWP’s Security settings](https://www.youtube.com/watch?v=gn_Yw8QexFg)

### 8G Firewall

- **Purpose:** The next-generation security firewall by Perishable Press. As an advanced evolution of the 7G, it is engineered to safeguard your site from a wider spectrum of malicious attacks and emerging threats.
- **Recommendation:** Highly recommended. Enabling the 8G firewall provides a robust, state-of-the-art defence, offering superior protection against both established vulnerabilities and new attack vectors.

#### 7G Firewall

- **Purpose**: A cutting-edge security firewall by Perishable Press, designed to safeguard your site from malicious attacks.
- **Recommendation**: Enabling this provides an additional layer of defence against known vulnerabilities.

### Bad Bot Protection

- **Purpose:** A specialised security measure designed to identify and block automated malicious bots. This includes content scrapers, vulnerability scanners, and spam bots that consume resources and probe for weaknesses.
- **Recommendation:** Essential to enable. This protects your site’s content, conserves server bandwidth, and reduces the risk of automated attacks, ensuring site performance and security are not compromised by malicious traffic.

### Bad Referrer Protection

- **Purpose:** A filter that blocks inbound traffic originating from known malicious or spam-heavy domains (referrers). This prevents your site from being associated with or targeted by disreputable sources.
- **Recommendation:** Strongly recommended. Enabling this helps prevent referrer spam, which can pollute your site’s analytics data, and blocks a common vector for hotlinking and other exploitative traffic.

#### Disable XML-RPC

- **Purpose**: Prevents remote clients from communicating with WordPress through the XML-RPC protocol.
- **Recommendation**: If you’re not using applications that require XML-RPC (like certain mobile apps), keep this disabled.

#### Disable RSS and Atom Feeds

- **Purpose**: Turns off feed updates, preventing users from subscribing to your site updates via feed readers.
- **Recommendation**: Only necessary if you don’t want to offer feed-based updates to readers.

#### Protect Directories

- **wp-content Directory & wp-includes Directory**:
  - **Purpose**: Shields these directories from direct access, preventing unauthorized users from accessing sensitive files.
  - **Recommendation**: It’s wise to enable these settings to ensure maximum security for your site content.

#### Disable `wp-links-opml.php`

- **Purpose**: Disables the ability for users to export their links to an OPML file.
- **Recommendation**: This feature is rarely used; keeping it disabled can prevent potential misuse.

#### Disable Comments

- **Purpose**: Turns off comments on your website.
- **Recommendation**: Activate this if you don’t require comments or are using an external commenting system.

#### Disable Trackbacks

- **Purpose**: Prevents other sites from sending trackbacks to your site.
- **Recommendation**: Keep disabled if you’re not using trackbacks.

#### Add Security Headers

- **Purpose**: Appends security headers to your site, enhancing protection against attacks.
- **Recommendation**: Always enable this, especially if you’re using SSL.

#### Disable WP Admin

- **Purpose**: Turns off access to the WordPress admin area.
- **Recommendation**: Use this if you’re away or don’t need frequent access to the admin dashboard to prevent unauthorized access.

#### Disable Login

- **Purpose**: Restricts access to the WordPress login page.
- **Recommendation**: Activate during periods of high unauthorized login attempts or if you’re away for extended durations.

#### Restrict Theme & Plugin Access

- **Themes & Plugins Editor**: Disables the option to edit themes and plugins via the WordPress admin.
- **Themes & Plugins Update and Installation**: Disallows the ability to update or install themes and plugins through the WordPress admin.
- **Recommendation**: Keeping these settings active ensures no accidental or unauthorized changes occur within your themes or plugins.