To secure my Wordpress sites from SQL injection and folder browsing I've used these htaccess rules after installing Wordpress. These htaccess rules do not break your Wordpress site or interfere with the database in any way. Use these htaccess rules to secure your Wordpress site from attack in addition to your other security plugins and measures. # Enable rewrite engine RewriteEngine On # Prevent folder browsing Options All -Indexes # Disable server signature ServerSignature Off # Block suspicious request methods RewriteCond %{REQUEST_METHOD} ^(HEAD|TRACE|DELETE|TRACK|DEBUG) [NC] RewriteRule ^(.*)$ - [F,L] # Block WP timthumb hack RewriteCond %{REQUEST_URI} (timthumb\.php|phpthumb\.php|thumb\.php|thumbs\.php) [NC] RewriteRule . - [S=1] # Block suspicious user agents and requests RewriteCond %{HTTP_USER_AGENT} (libwww-perl|wget|python|nikto|curl|scan|java|winhttp|clshttp|loader) [NC,OR] RewriteCond %{HTTP_USER_AGENT} (<|>|'|%0A|%0D|%27|%3C|%3E|) [N...