Seeking Recommendations for Securing Public EC2 Hosting WordPress Sites Without ALB/CloudFront

Question

Hi all,

We currently have an EC2 instance hosting multiple publicly accessible WordPress websites, configured using nginx virtual hosts. There’s no Load Balancer or CloudFront in the current architecture.

To strengthen our security posture, we’ve taken the following measures:

* Restricted inbound traffic in the Security Group to specific IP ranges, keeping ports 80 and 443 open to the public.

* Added NACL rules to block known suspicious IP addresses.

* Installed Fail2Ban for basic intrusion prevention.

* Actively monitoring logs and system activity.

We’re now exploring additional AWS-native services that can further enhance protection in this setup. AWS WAF looks promising, but without using an ALB or CloudFront, it seems less applicable at this stage.

**Would appreciate any suggestions on:**

AWS services can help monitor or block malicious activity at the edge or network level.

Architectural adjustments that would improve security while keeping the setup relatively simple.

Thanks in advance!
Balu.

Riku_Kobayashi · Answer

Hello.

Although it's a little different from WordPress security protection, why not consider installing Amazon Inspector and configuring it to detect OS vulnerabilities, etc.?  
https://docs.aws.amazon.com/inspector/latest/user/scanning-ec2.html

I think it may be possible to further tighten traffic management by introducing the AWS Network Firewall.  
https://docs.aws.amazon.com/network-firewall/latest/developerguide/firewalls.html

It would be a good idea to introduce AWS WAF, but since this cannot be introduced without using ALB or CloudFront, you may want to consider using a WAF other than that available from an AWS product.

Seeking Recommendations for Securing Public EC2 Hosting WordPress Sites Without ALB/CloudFront

Add your answer

Relevant content