WordPress bezbednost 2026: Kompletni vodič za zaštitu vašeg sajta

← Blog

Zašto je WordPress primarna meta napadača

Popularnost je dvosekli mač: što više sajtova koristi WordPress, to je vrednije razviti alate za automatizovano skeniranje i napad WordPress instalacija. Prema Wordfence podacima, samo u 2024. godini blokirano je više od 100 milijardi malicioznih zahteva ka WordPress sajtovima. Vektori napada su predvidivi: zastareli plugin-ovi, slabe admin lozinke, izloženi xmlrpc.php i wp-login.php.

1. Ažuriranja: Core, Plugins, Themes

Prema analizi WordPress.org, 97% uspješnih napada eksploatiše poznate ranjivosti u plugin-ovima i temama za koje postoje zakrpe. Konfigurišite automatska ažuriranja za minor WordPress verzije, i redovno ažurirajte plugin-ove — idealno u staging okruženju pre produkcije.

• Uključite automatic updates u wp-config.php: define('WP_AUTO_UPDATE_CORE', true);
• Koristite WP-CLI za batch ažuriranje: wp plugin update --all
• Deinstalirajte neaktivne plugin-ove i teme — neaktivni kod je i dalje ranjivi kod

2. Zaštita login stranice

/wp-login.php i /wp-admin/ su pod konstantnim brute force napadom. Mere zaštite:

• Promenite URL admin logovanja (Wordfence, WPS Hide Login)
• Implementirajte rate limiting na login pokušaje
• Obavezni 2FA za sve admin naloge (Google Authenticator, Wordfence Login Security)
• IP whitelist za wp-admin ako je moguće
• Zabranite enumeraciju korisnika: /?author=1 ne sme vraćati username

3. Onemogućite xmlrpc.php

XML-RPC je zastareli protokol koji je napadači koriste za brute force (multiplicative attacks, do 1000 pokušaja u jednom HTTP zahtevu) i DDoS amplifikaciju. Ako ga ne koristite, blokirajte ga:

# .htaccess:
<Files xmlrpc.php>
  order deny,allow
  deny from all
</Files>

# Nginx:
location = /xmlrpc.php {
  deny all;
}

4. Bezbednost baze podataka

• Promenite default prefiks tabela (umesto wp_ koristite moj_sajt_)
• Zasebni database korisnik sa minimalnim privilegijama (samo SELECT/INSERT/UPDATE/DELETE)
• Nikada ne koristite root MySQL nalog za WordPress
• Redovni backup baze (Updraft Plus, ili server-side cron)

5. Bezbednost fajl sistema

# wp-config.php permissions:
chmod 400 wp-config.php
# wp-content/uploads - samo upload, ne execute:
# Nginx:
location ~* /uploads/.*\.php$ { deny all; }

Onemogućite PHP execution u uploads folderu — čak i ako napadač upload-uje PHP shell, ne može ga izvršiti.

6. Security Headers za WordPress

Dodajte u functions.php vašeg teme ili u Nginx konfiguraciju:

function add_security_headers() {
    header('X-Content-Type-Options: nosniff');
    header('X-Frame-Options: SAMEORIGIN');
    header('Referrer-Policy: strict-origin-when-cross-origin');
}
add_action('send_headers', 'add_security_headers');

7. WordPress plugin-ovi za bezbednost

• Wordfence: WAF, malware scanner, login security, live traffic monitoring
• Sucuri Security: File integrity monitoring, malware scan, post-hack recovery
• iThemes Security: Brute force protection, database backup, 2FA
• WP Cerber: Anti-spam, login protection, bot detection

8. Redovni bezbednosni assessment

WordPress instalacija se menja sa svakim novim plugin-om. Redovni external vulnerability assessment otkriva propuste koji su vidljivi sa strane napadača: exposed wp-config.php backup, verzija WordPress-a u meta tagovima, directory listing, ranjive plugin verzije.

← Blog

Why WordPress Is the Primary Attack Target

Popularity is a double-edged sword: the more sites use WordPress, the more valuable it is to develop tools for automated scanning and attacking WordPress installations. According to Wordfence data, over 100 billion malicious requests to WordPress sites were blocked in 2024 alone. Attack vectors are predictable: outdated plugins, weak admin passwords, exposed xmlrpc.php and wp-login.php.

1. Updates: Core, Plugins, Themes

According to WordPress.org analysis, 97% of successful attacks exploit known vulnerabilities in plugins and themes for which patches exist. Configure automatic updates for minor WordPress versions, and regularly update plugins — ideally in a staging environment before production.

2. Login Page Protection

/wp-login.php and /wp-admin/ are under constant brute force attack. Protection measures:

• Change the admin login URL (Wordfence, WPS Hide Login)
• Implement rate limiting on login attempts
• Mandatory 2FA for all admin accounts
• IP whitelist for wp-admin if possible

3. Disable xmlrpc.php

XML-RPC is a legacy protocol that attackers use for brute force (multiplicative attacks, up to 1000 attempts in a single HTTP request) and DDoS amplification. If you don't use it, block it:

# Nginx:
location = /xmlrpc.php {
  deny all;
}

4. File System Security

Disable PHP execution in the uploads folder — even if an attacker uploads a PHP shell, they cannot execute it.

5. Security Plugins

• Wordfence: WAF, malware scanner, login security, live traffic monitoring
• Sucuri Security: File integrity monitoring, malware scan, post-hack recovery

6. Regular Security Assessment

A WordPress installation changes with every new plugin. Regular external vulnerability assessment reveals weaknesses visible from an attacker's perspective: exposed wp-config.php backups, WordPress version in meta tags, directory listings, vulnerable plugin versions. Shieldome Scout detects these automatically.