I don't use WP much these days, except for parasites. Here is what I got from a host a while back that could help:
- Update all scripts and plugins/components/modules/themes/templates on your account to the latest stable versions. Old applications can have serious security holes that allow exploits such as injections into pages that allow files to be uploaded to your account. The only way to maintain site security is by keeping all applications and scripts up-to-date.
- Change your main account's password along with any other passwords you have (mail accounts, FTP accounts). . It is recommended to create a complex password with alphanumeric characters using both upper and lowercase such as Aa1Bb2Cc3. Additionally, you would want to ensure that you do not use a password related to the domain name or site content.
- Avoid saving passwords in any software such as your FTP password. In your FTP client, please begin using TLS encryption for FTP transfers as that will encrypt the password during the data exchange. In FileZilla, this is supported by going to Site Manager and setting your server's type as "FTPES - FTP over explicit TLS/SSL"
- Scan your local computer for any viruses and trojans frequently. If you have not performed this task recently, please do perform a computer scan as soon as possible to ensure that computer is clean.
- We would suggest disabling remote file inclusions by inserting the following line in your public_html/php.ini file (if not file is there, you may create a new one):
allow_url_fopen=Off
allow_url_include=Off
disable_functions=popen,passthru,escapeshellarg,escapeshellcmd,exec,passthru,proc_close,proc_get_status,proc_nice,proc_open, proc_terminate,shell_exec,system,blob,exec,escapeshellarg,pfsockopen,stream_get_transports,stream_set_blocking
and to help prevent XSS attacks, add the following lines of code to your .htaccess file :
Options +FollowSymLinks
RewriteEngine On
RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [OR]
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} (\<|%3C).*iframe.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
RewriteRule ^(.*)$ index_error.php [F,L]
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
RewriteRule .* - [F]
