Deploying Security Protection for WordPress

Security Design Principles

• Eliminate long-term credentials: Do not store long-term valid credentials in any resource, such as permanent AK/SKs of IAM users and database usernames and passwords.
• Rotate credentials periodically: Automatically rotate credentials (such as database passwords) on a regular schedule to mitigate the impacts of credential leakage caused by accidents or attacks.
• Fix vulnerabilities timely: Fix known OS security vulnerabilities within a specified period to meet the security patch management baseline requirements.
• Back up data periodically: Periodically back up key data (such as EVS disks and databases) to ensure that data can be restored even if unexpected data loss occurs.

Overall Solution

The following services are used to ensure security for WordPress deployment.

Deployment Architecture

During WordPress deployment, you need to create an ECS and an RDS for MySQL database. The security configurations for them are described as follows:

ECS

• Use security groups to control the inbound and outbound traffic for the ECS.

  WordPress uses port 80. Therefore, you need to configure a rule to allow access to port 80 from any source 0.0.0.0/0.

  A security group is a virtual firewall that controls inbound and outbound traffic for an ECS. Inbound rules of a security group control inbound traffic to an ECS, and outbound rules control outbound traffic from an ECS. For details, see Security Group Overview.

• Use Cloud Backup and Recovery (CBR) to periodically back up the ECS.

  CBR provides the cloud server backup function. You can configure cloud server backup for the ECS where WordPress is deployed, and set the backup time and retention rules. For details, see Creating a Server Backup.

• Obtain access credentials through an Identity and Access Management (IAM) agency.

  IAM allows you to associate an agency with the ECS so that the ECS can use temporary credentials to access APIs of other cloud services. The temporary credentials will be periodically updated. This ensures the security of the AK/SK of your cloud account (eliminating the need to store static AK/SKs in plaintext in the ECS), and also allows you to use IAM for refined control and permissions management.

  In this example, we create an agency for the ECS and grant the KMS Administrator and CSMS FullAccess permissions to the agency. For details, see Creating a User Group and Assigning Permissions.

• Domain name security management

  Registrar locks and registry locks prevent domain names from being maliciously transferred, tampered with, or deleted.

RDS database

• Periodically rotate RDS secrets.

  The leakage of secrets, including database account passwords, server account passwords, SSH keys, and access keys, is a primary threat to data security today. To mitigate the risk of data breaches, appropriate secret protection and automatic rotation are essential. You can configure dynamic RDS secrets in DEW to automatically rotate them on a regular basis, reducing security threats to service data. For details, see CSMS Overview.

  

  CSMS recommends that you use the dual-account mode to rotate RDS secrets. You can create two database accounts with identical permissions. During secret rotation, CSMS alternately updates the passwords of the two accounts and swap the active version to ensure that your application always has valid secrets available during rotation.

• Use KMS to encrypt data.

  RDS supports EVS disk encryption, which encrypts data using KMS. Even if data backups are leaked, they cannot be decrypted. For details, see Configuring Disk Encryption.