[Terry]

The Wordfence plugin is apparently blacklisted on the default blacklist, and I’m not an expert but what sort of security is included by default? Are there other security plugins you recommended using or not needed?

[Joan]

It has A+ security HTTP headers for starters

https://www.quora.com/Does-SlickStack-really-achieve-A-security-headers

Nice little out of the box feature, makes clients happy too

[Timothy]

Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy

All of these headers are hardened for you already, with HTTPS/SSL enforced by default so SlickStack does not allow any non-HTTPS requests to go through.

[Victoria]

Related

Do I really need security plugin for WordPress?

[Michael]

https://github.com/littlebizzy/slickstack/blob/master/docs/security.md

You can browse this, it’s pretty detailed

[Jerry]

I asked Gemini, it had some good overview of the included security in SlickStack:

SlickStack implements server-level and application-level security mechanisms designed to harden WordPress deployments without relying on traditional third-party security plugins.

HTTP & Nginx Hardening

• A+ Security Headers: Pre-configured Nginx response headers designed to achieve top ratings on security benchmark tools. Includes Content Security Policy (CSP), X-Frame-Options (clickjacking prevention), X-Content-Type-Options (MIME-sniffing protection), Referrer-Policy, and Permissions-Policy.
• Enforced HTTPS & HSTS: Forces HTTPS-only traffic with pre-configured HTTP Strict Transport Security (HSTS) headers enabled by default.
• PHP Execution Restrictions: Prevents execution of arbitrary PHP scripts inside public directories, such as /wp-content/uploads/, eliminating common webshell upload vectors.
• Cache Bypass Protections: FastCGI caching is explicitly disabled across administrative routes and database tools to prevent sensitive session data from leaking.

Network & Firewall Defense

• Iptables Firewall Policy: Establishes automated, persistent Iptables rules (rules.v4 / rules.v6) that restrict incoming server ports and enforce rate-limiting on SSH connection attempts.
• Fail2ban Intrusion Prevention: Monitors Nginx access logs and SSH login attempts to automatically ban malicious IP addresses performing brute-force attacks.
• Cloudflare Origin Security: Built with native support for Cloudflare proxying, including Authenticated Origin Pulls (AOP) to block traffic attempting to bypass Cloudflare and hit the server’s IP directly.

System Permissions & Isolation

• Protected System Configuration: The central configuration file (/var/www/ss-config) is owned by root:root with strict 0700 permissions, ensuring it cannot be read or modified by SFTP users or the web server user.
• User Privilege Separation: Separates system duties across dedicated SFTP users, restricted database accounts, and isolated Linux system users.
• Automated Permission Audits: Built-in maintenance scripts run regularly to reset file and directory modes across the stack, correcting unsafe permissions.

WordPress Application Security

• Plugin Blacklisting: Automatically blocks or flags known high-risk, unmaintained, or bloated plugins—especially backup plugins that leave insecure file archives in web-accessible folders.
• Restricted WP-CLI Capabilities: Hardcodes custom restrictions on select WP-CLI commands to prevent risky system calls or arbitrary code invocation.
• Dashboard Hardening: Restricts file editing within the WordPress Admin dashboard (DISALLOW_FILE_EDIT) to prevent code modification if an admin account is compromised.

Database & Backup Security

• Obfuscated Database Tools: Database utilities like Adminer are stored outside the public document root (/var/www/meta/), accessed via randomized secret URLs, and can be entirely disabled via configuration (ADMINER_PUBLIC=false).
• Out-of-Web-Root Backups: Database export scripts (ss-dump) store backups in protected directories completely isolated from public HTTP requests.

SSL/TLS Certificate Management

• Modern Encryption Protocols: Enforces modern TLS versions while disabling deprecated SSL protocols and weak cipher suites.
• Automated SSL Renewal: Integrates natively with OpenSSL self-signed certificates for Cloudflare setups or automated Let’s Encrypt (Certbot) issuance.

[Charlotte]

nice… is there more info about blacklisted WP plugins somewhere?

[Linda]

Some info about plugin blacklist here:

Blacklisted WordPress Plugins

[Author]

Posts