# How to Fix WordPress Security Vulnerabilities

> Running WordPress alongside Laravel? Common WordPress vulnerabilities like outdated plugins and exposed wp-admin need attention.

**Severity:** high | **Category:** Application Security

---

## The Issue

WordPress is the most targeted CMS on the internet, and running it alongside your Laravel application creates additional attack surface. Common vulnerabilities include outdated plugins and themes with known exploits, exposed wp-login.php to brute-force attacks, insecure file permissions, XML-RPC abuse, and default database prefixes. A compromised WordPress installation can provide lateral access to your Laravel application if they share a server.

## Steps to Fix

### 1. Update WordPress core, plugins, and themes

Run updates from the command line with WP-CLI:

wp core update
wp plugin update --all
wp theme update --all

Enable automatic security updates in wp-config.php:

define('WP_AUTO_UPDATE_CORE', 'minor');

Remove unused plugins and themes entirely (deactivating is not enough):

wp plugin delete unused-plugin
wp theme delete unused-theme

Outdated plugins are the number one cause of WordPress compromises.

### 2. Secure wp-login.php and wp-admin

Restrict access to the admin area by IP or add HTTP authentication. In Nginx:

location /wp-login.php {
    allow 1.2.3.4;  # Your office IP
    deny all;

    fastcgi_pass unix:/run/php/php-fpm.sock;
    include fastcgi_params;
}

location /wp-admin/ {
    allow 1.2.3.4;
    deny all;
}

Alternatively, use a security plugin like Wordfence or limit login attempts:

define('WP_LIMIT_LOGIN_ATTEMPTS', true);

### 3. Disable XML-RPC if not needed

XML-RPC is used for brute-force amplification attacks. Disable it if you do not use remote publishing:

In .htaccess:

<Files xmlrpc.php>
    Order Allow,Deny
    Deny from all
</Files>

In Nginx:

location = /xmlrpc.php {
    deny all;
    return 404;
}

Or with a WordPress filter in functions.php:

add_filter('xmlrpc_enabled', '__return_false');

### 4. Isolate WordPress from your Laravel application

If running both on the same server, isolate them:

1. Use separate database users with different credentials
2. Run WordPress under a different system user (PHP-FPM pool)
3. Ensure WordPress cannot read Laravel files and vice versa
4. Use separate subdomains (blog.yourdomain.com vs app.yourdomain.com)

In PHP-FPM, create separate pools:

[wordpress]
user = wp_user
group = wp_user
listen = /run/php/php-fpm-wp.sock

[laravel]
user = laravel_user
group = laravel_user
listen = /run/php/php-fpm-laravel.sock

## Verification

Scan your WordPress installation:

wp core verify-checksums
wp plugin list --status=inactive

Test XML-RPC is disabled:

curl -X POST https://yourdomain.com/xmlrpc.php

This should return 403 or 404, not an XML response.

Check for outdated plugins:

wp plugin list --update=available

## Prevention

Enable automatic updates for minor WordPress releases. Use a managed WordPress host that handles security updates. Audit plugins quarterly and remove any that are not actively maintained. Consider replacing WordPress with a static site generator or headless CMS for the blog. Use StackShield to monitor your WordPress endpoints for known vulnerabilities.

---

## Frequently Asked Questions

### Should I run WordPress on the same server as Laravel?

Ideally, no. A compromised WordPress installation can provide access to your Laravel application files and database if they share a server. Use separate servers or containers. If you must colocate them, use separate system users, database credentials, and PHP-FPM pools.

### Can I replace WordPress with Laravel for my blog?

Yes. Laravel packages like Wink, Canvas, or a simple Markdown-based blog require no additional attack surface. You can also use headless CMS services like Prismic or Storyblok with a Laravel frontend, eliminating WordPress entirely.

### How do I know if my WordPress installation has already been compromised?

Run wp core verify-checksums to detect modified core files. Check for unknown admin users: wp user list --role=administrator. Scan for malicious code: wp plugin list then inspect recently modified files with find /var/www/wordpress -name "*.php" -newer /var/www/wordpress/wp-config.php -mtime -7. Look for base64-encoded strings in PHP files: grep -rn "base64_decode" wp-content/plugins/ — malware commonly uses this to obfuscate payloads.

### What is the safest way to run WordPress on the same server as a Laravel application?

Use completely separate Linux users and PHP-FPM pools for each application (e.g., wp_user for WordPress, laravel_user for Laravel). Set file permissions so neither user can read the other's files. Use separate database users with access only to their respective databases. Run each on its own subdomain with separate Nginx server blocks. This way, a full compromise of WordPress gives the attacker access to WordPress only.

### Can Cloudflare protect my WordPress site from attacks?

Cloudflare provides meaningful protection: it blocks many brute-force attacks on wp-login.php, mitigates DDoS, and its WAF (Web Application Firewall) blocks common WordPress exploit patterns. However, Cloudflare is not a replacement for keeping WordPress and plugins updated. A vulnerable plugin can be exploited through requests that look legitimate to Cloudflare. Use Cloudflare as an additional layer, not a primary defense.