I have a Wordpress website from a client that was hacked (website is clean now). The Wordpress is version 3.3.1 and it has 42 active plugins. It's a nightmare in that installation, after many tries updating the Wordpress core, plugins and fixing parts of code it still breaks the website.
From what I've seen I have two options:
- remake the entire website from scratch
- place it on a read-only folder on the server and restrict every write to it.
The client wants to keep the actual site in its current form so I need option 2
My question is what steps should I make to protect the outdated Wordpress and plugins on the server site? (I have access to the server CentOS7 that has installed and enabled selinux, mod_security and firewall-cmd)