WordPress的正确.htaccess文件

Question

I client of mine just got hacked on his WordPress site. No tbeing to familiar with WordPress or the proper usage of WordPress assocaited .htaccess files I have one simple question.

Does this look proper? For some reason I'm thinking the Rewrite Cond for the wp-content, wp-admin, and wp-include shouldn't be there. Are these important? The site seems to work fine without them I'm just not very sure if they have anything to do with WordPress vulnerabilities.

Options +FollowSymLinks 

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /

RewriteCond %{HTTP_HOST} ^www.mydomain.com [NC] 
RewriteRule ^(.*)$ http://mydomain.com/$1 [R=301,L]

RewriteCond %{REQUEST_FILENAME} ^wp-content.*
RewriteCond %{REQUEST_FILENAME} ^wp-admin.*
RewriteCond %{REQUEST_FILENAME} ^wp-include.*
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress

AddHandler php-legacy .php

And here is the new .htaccess I wrote to replace the one up top

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress

<files wp-config.php>
order allow,deny
deny from all
</files>

# directory browsing
Options All -Indexes

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http(s)?://(www\.)?mydomain [NC]
RewriteRule \.(jpg|jpeg|png|gif)$ - [NC,F,L]

Any tips tricks or suggestions on hardening a wordpress .htaccess would be greatly appreciated. Thanks for your time!

Answer 1

You can copy the .htaccess to your computer and then delete it from your server after doing this go to settings and then select permalink settings after this select default if it is selected then select another one of the options click save and then after select default and then again save after this go back to what type you had it set to ... From what I have seen and read this creates a new .htaccess file onto the server so you can check this and if all works well then you can keep the new one if you find things go a little wrong then revert back..

First of all I would open the config file and then use this website to create a new salt keys https://api.wordpress.org/secret-key/1.1/salt/

This forces any one logged in to be kicked out and re login..

Also if you think your wordpress site was hacked it would be a good idea to change the database password for your mysql... After doing this change this in the config.php and then you have at least got any logged in user out and changed database passwords ...

Hope this helps