| Network | DDoS/CC | Set DNS record to gov site |
| MITM | HTTPS（SSLLabs Test Score A+）; HSTS; HSTS Preload |
| Application | XSS | Security Header(CSP/X-XSS-Protection) |
| iFrame | Security Header(X-Frame-Options) |
| MIME Sniffing | Security Header(X-Content-Type-Options) |
| Fronted Backdoor | Security Header(Permissions-Policy) |
| SQLi | Change Database Prefix; No sensitive data; |
| Brute-force login accound | Custom username; Strong password; 2FA; Disable xmlrpc; Hidden login url; Automatic IP Blocking Brute-Force |
| Sensitive data leakge | DEBUG False; Disable PHP Error; Hidden PHP/Wordpress/Nginx Version; Automatic IP Blocking Vulnerability Detection |
| Trojan/Mining/Webshell | DISALLOW_FILE_EDIT; Separate user group for static/php files, read-only permissions, no write access except in upload directory; |
| 0day | Separate user WP-CLI mode for automatic updates of Core/Plugin/Theme to latest version; inotify www directory; Automatic IP Blocking When Web attack; |
| Ransomware | Daily Backup of files and database to remote server; Daily backup of ECS Image; |
| Server | Service Brute-force/Vulnerability | Only 80/443 ports opened; Automatic IP Blocking When Port Scan; Private IP Login with Key; Outbound Internet Access Restriction; |
