Securiser WordPress Apres un Piratage : 12 Mesures Essentielles

# Changer le mot de passe de tous les administrateurs
wp user list --role=administrator --field=ID --path=/var/www/html | while read id; do
  NEW_PASS=$(openssl rand -base64 24)
  wp user update $id --user_pass="$NEW_PASS" --path=/var/www/html
  echo "Utilisateur $id : mot de passe mis a jour"
done

# 1. Changer le mot de passe MySQL
mysql -u root -p -e "ALTER USER 'wp_user'@'localhost' IDENTIFIED BY 'NouveauMotDePasse_Complexe_2026!';"
 
# 2. Mettre a jour wp-config.php avec le nouveau mot de passe
wp config set DB_PASSWORD 'NouveauMotDePasse_Complexe_2026!' --path=/var/www/html

# Regenerer automatiquement toutes les cles
wp config shuffle-salts --path=/var/www/html

# Installer ModSecurity sur Apache
sudo apt install libapache2-mod-security2
sudo a2enmod security2
 
# Telecharger les regles OWASP CRS
cd /etc/modsecurity/
sudo git clone https://github.com/coreruleset/coreruleset.git
sudo cp coreruleset/crs-setup.conf.example coreruleset/crs-setup.conf
 
# Activer les regles dans la configuration Apache
sudo cat >> /etc/apache2/mods-enabled/security2.conf << 'EOF'
IncludeOptional /etc/modsecurity/coreruleset/crs-setup.conf
IncludeOptional /etc/modsecurity/coreruleset/rules/*.conf
EOF
 
sudo systemctl restart apache2

# Installer le plugin Two-Factor
wp plugin install two-factor --activate --path=/var/www/html

<?php
// Forcer le 2FA pour les administrateurs
add_filter('two_factor_providers', function($providers) {
    // Garder uniquement TOTP et codes de secours
    return array(
        'Two_Factor_Totp'          => $providers['Two_Factor_Totp'],
        'Two_Factor_Backup_Codes'  => $providers['Two_Factor_Backup_Codes'],
    );
});

cd /var/www/html
 
# Permissions des repertoires
find . -type d -exec chmod 755 {} \;
 
# Permissions des fichiers
find . -type f -exec chmod 644 {} \;
 
# Permissions restrictives pour wp-config.php
chmod 400 wp-config.php
 
# Permissions restrictives pour .htaccess
chmod 444 .htaccess
 
# Proprietaire correct (remplacer www-data par votre utilisateur web)
chown -R www-data:www-data /var/www/html/

# wp-content/uploads/.htaccess
<FilesMatch "\.(?:php|phtml|php5|php7|phps)$">
  Order Allow,Deny
  Deny from all
</FilesMatch>

location ~* /wp-content/uploads/.*\.php$ {
    deny all;
}

# Ajouter dans wp-config.php
wp config set DISALLOW_FILE_EDIT true --raw --path=/var/www/html

# Empecher l'installation/mise a jour de plugins et themes depuis le dashboard
wp config set DISALLOW_FILE_MODS true --raw --path=/var/www/html

# Empecher l'acces direct a wp-config.php
<Files wp-config.php>
  Order Allow,Deny
  Deny from all
</Files>

location ~ /wp-config\.php$ {
    deny all;
}

# Deplacer wp-config.php au-dessus de la racine web
mv /var/www/html/wp-config.php /var/www/wp-config.php

# Forcer HTTPS
wp config set FORCE_SSL_ADMIN true --raw --path=/var/www/html
 
# Desactiver le debug en production
wp config set WP_DEBUG false --raw --path=/var/www/html
wp config set WP_DEBUG_DISPLAY false --raw --path=/var/www/html
wp config set WP_DEBUG_LOG false --raw --path=/var/www/html

# Proteger .htaccess lui-meme
<Files .htaccess>
  Order Allow,Deny
  Deny from all
</Files>
 
# Empecher le listing des repertoires
Options -Indexes
 
# Bloquer l'acces aux fichiers sensibles
<FilesMatch "(^\.ht|wp-config\.php|readme\.html|license\.txt|xmlrpc\.php)">
  Order Allow,Deny
  Deny from all
</FilesMatch>
 
# Bloquer l'execution PHP dans wp-includes
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteBase /
  RewriteRule ^wp-admin/includes/ - [F,L]
  RewriteRule !^wp-includes/ - [S=3]
  RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
  RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
  RewriteRule ^wp-includes/theme-compat/ - [F,L]
</IfModule>
 
# Empecher l'acces aux fichiers includes
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond %{SCRIPT_FILENAME} !^(.*)wp-includes/ms-files.php
  RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
</IfModule>
 
# Bloquer les requetes suspectes
<IfModule mod_rewrite.c>
  RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
  RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
  RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
  RewriteRule ^(.*)$ index.php [F,L]
</IfModule>

# Bloquer completement l'acces a xmlrpc.php
<Files xmlrpc.php>
  Order Allow,Deny
  Deny from all
</Files>

<?php
// Ajouter dans functions.php ou un mu-plugin
add_filter('xmlrpc_enabled', '__return_false');
 
// Supprimer le header X-Pingback
add_filter('wp_headers', function($headers) {
    unset($headers['X-Pingback']);
    return $headers;
});
 
// Desactiver les methodes XML-RPC
add_filter('xmlrpc_methods', function($methods) {
    return array();
});

location = /xmlrpc.php {
    deny all;
    access_log off;
    log_not_found off;
}

# Installer et activer le plugin
wp plugin install limit-login-attempts-reloaded --activate --path=/var/www/html

# Limiter l'acces a wp-login.php par adresse IP
<Files wp-login.php>
  Order Deny,Allow
  Deny from all
  # Autoriser votre IP (remplacer par votre IP)
  Allow from 203.0.113.42
  Allow from 198.51.100.0/24
</Files>

# Installer WPS Hide Login
wp plugin install wps-hide-login --activate --path=/var/www/html
 
# Configurer la nouvelle URL de connexion
wp option update whl_page 'mon-acces-securise' --path=/var/www/html

<IfModule mod_headers.c>
  # Forcer HTTPS pendant 1 an
  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
 
  # Prevenir le clickjacking
  Header always set X-Frame-Options "SAMEORIGIN"
 
  # Prevenir le MIME sniffing
  Header always set X-Content-Type-Options "nosniff"
 
  # Politique de referrer
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
 
  # Politique de permissions
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()"
 
  # Content Security Policy (adapter selon votre site)
  Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.google-analytics.com https://www.googletagmanager.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https://www.google-analytics.com;"
</IfModule>

# Headers de securite
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always;

# Verifier les headers HTTP
curl -I https://votre-site.com
 
# Ou utiliser un service en ligne comme securityheaders.com

# Creer un script de monitoring complet
cat > /usr/local/bin/wp-security-monitor.sh << 'SCRIPT'
#!/bin/bash
SITE_PATH="/var/www/html"
LOG="/var/log/wp-security.log"
ALERT_EMAIL="admin@votre-site.com"
 
echo "=== Scan de securite - $(date) ===" >> $LOG
 
# 1. Verifier l'integrite des fichiers core
echo "[Core Checksums]" >> $LOG
wp core verify-checksums --path=$SITE_PATH >> $LOG 2>&1
 
# 2. Verifier l'integrite des plugins
echo "[Plugin Checksums]" >> $LOG
wp plugin verify-checksums --all --path=$SITE_PATH >> $LOG 2>&1
 
# 3. Fichiers PHP dans uploads
echo "[PHP in Uploads]" >> $LOG
PHP_IN_UPLOADS=$(find $SITE_PATH/wp-content/uploads/ -name "*.php" -type f 2>/dev/null)
if [ -n "$PHP_IN_UPLOADS" ]; then
  echo "ALERTE: Fichiers PHP trouves dans uploads:" >> $LOG
  echo "$PHP_IN_UPLOADS" >> $LOG
  echo "$PHP_IN_UPLOADS" | mail -s "ALERTE SECURITE: PHP dans uploads" $ALERT_EMAIL
fi
 
# 4. Fichiers modifies dans les 24 dernieres heures
echo "[Fichiers modifies recemment]" >> $LOG
find $SITE_PATH -name "*.php" -mtime -1 -type f >> $LOG 2>&1
 
# 5. Nouveaux comptes administrateurs
echo "[Comptes admin]" >> $LOG
wp user list --role=administrator --path=$SITE_PATH --format=table >> $LOG 2>&1
 
echo "=== Fin du scan ===" >> $LOG
SCRIPT
 
chmod +x /usr/local/bin/wp-security-monitor.sh
 
# Planifier un scan quotidien
(crontab -l 2>/dev/null; echo "0 4 * * * /usr/local/bin/wp-security-monitor.sh") | crontab -

#!/bin/bash
# Script de hardening WordPress post-piratage
SITE_PATH="/var/www/html"
 
echo "=== Hardening WordPress ==="
 
# Regenerer les cles de securite
wp config shuffle-salts --path=$SITE_PATH
echo "[OK] Cles de securite regenerees"
 
# Desactiver l'editeur de fichiers
wp config set DISALLOW_FILE_EDIT true --raw --path=$SITE_PATH
echo "[OK] Editeur de fichiers desactive"
 
# Forcer HTTPS
wp config set FORCE_SSL_ADMIN true --raw --path=$SITE_PATH
echo "[OK] HTTPS force pour l'admin"
 
# Desactiver le debug
wp config set WP_DEBUG false --raw --path=$SITE_PATH
echo "[OK] Mode debug desactive"
 
# Permissions des fichiers
find $SITE_PATH -type d -exec chmod 755 {} \;
find $SITE_PATH -type f -exec chmod 644 {} \;
chmod 400 $SITE_PATH/wp-config.php
chmod 444 $SITE_PATH/.htaccess
echo "[OK] Permissions des fichiers corrigees"
 
# Installer et activer les plugins de securite
wp plugin install two-factor --activate --path=$SITE_PATH
wp plugin install limit-login-attempts-reloaded --activate --path=$SITE_PATH
echo "[OK] Plugins de securite installes"
 
# Mettre a jour tout
wp core update --path=$SITE_PATH
wp plugin update --all --path=$SITE_PATH
wp theme update --all --path=$SITE_PATH
echo "[OK] WordPress et extensions mis a jour"
 
echo "=== Hardening termine ==="