Tag Info

New answers tagged

2

No, the requests will still happen, even if it results in a 404. If you keep logging, you'll also notice attempts to log in to Drupal, Joomla, and other major CMS, including server exploits for IIS Apache and Nginx This is because they're automated opportunistic requests, they're not actually looking at your site, they're only looking for successful logins. ...


0

A Google search for the IP showed, this IP is known as a spammer IP. A quick check on MXtoolbox shows, it is blacklisted by blocklist.de, CBL and Spamhouse ZEN. I would suggest to ban the IP. Some interesting suggestions, how to prevent wp-login.php from a brute force attack can be found on MNX Solutions.


3

Just to add to the answer by @birgire, check this post on how to hide the fact that you are using Wordpress. I also think that no post basically covers this, but it really help nothing following and applying everything to hide the fact you are using Wordpress and to secure Wordpress, and your code in itself is a security risk. Hackers are stubborn and ...


3

So you're asking if you install WordPress in a subdirectory, like example.tld/secretwp/ and have the site pointing to example.tld, it will keep "evil" users and bots from knowing about the subdirectory? I don't think it will hold as a security advise, because your site can give away the subdirectory name in many ways. For example from: the use of ...


1

(Partial answer as I'm familiar with AWS, not Google Drive.) Having a WordPress DB stored somewhere on a cloud service is, in my opinion, no worse that hosting the site on a virtual or cloud server (given virtualisation platforms all allow you to reset the server's root password - albeit typically with a reboot - so your entire machine is at risk if someone ...


3

The password strength meter in the latest versions of WordPress uses a library called "zxcvbn", made by Dropbox in 2012. The library is available for free on Github: https://github.com/dropbox/zxcvbn An explanation of the library is here: https://blogs.dropbox.com/tech/2012/04/zxcvbn-realistic-password-strength-estimation/ But the short version is that it ...


0

Try adding this to your .htaccess file wherever the install is located. ErrorDocument 403 /specific_page.html Order Allow,Deny Allow from 111.222.333.444 you of course are changing that ip address to your own. if you already have an htaccess file containing info, add it to the top.


0

You should check out the Force Login plugin; it's lightweight, simple, and does exactly what you want to do.


1

You can add this to .htaccess file, it will redirect all author requests looking for a number ( Author ID ) to the homepage: #Disable Author Pages <IfModule mod_rewrite.c> RewriteEngine On RewriteBase / RewriteCond %{REQUEST_URI} ^/$ RewriteCond %{QUERY_STRING} ^/?author=([0-9]*) [NC] RewriteRule ^(.*)$ http://%{HTTP_HOST}/? [L,R=301,NC] ...


0

I don't want to repeat the coding options since they have been exhaustively covered, the other option I know that works is using a plugin that hides wp. I have used this plugin before to satisfactory standards. Its called hide my WordPress.


1

Why not make a new account for this user which will generate a new database ID. Then delete the user with the ID of 1 and attribute all posts / content to the new user you created for them? Then you don't have to worry about queries or messing up your database. Also, as said before this makes absolutely no sense from a security standpoint as it's pointless. ...


0

The zxcvbn software does not use any standardised rules in the way that a traditional password checker does, but the zxcvbn tester's score rating of 0 to 4 maps to the WordPress ratings as shown below; so from this it should be possible to use the official tester to test out and practice creating the types of passwords which will achieve a "strong" rating, ...


0

this is really not related to wordpress, but since it is already have an upvoted answer I might as well add mine.... For most people strong passwords are not required. I am using a soft password for many services I don't care much about and so far my accounts haven't been hacked (AFAIK of course ;) ). Strong passwords are needed to deflect a targeted ...


0

A phrase consiting of words separated by spaces ("apples ocean barbarians") can be easy to remember and type, yet strong due to the number of characters. Such a password works on WP, but not all web apps will accept this method.


2

The internet is a big mash of services communicating with each other. Semi dropping out of the network might have been a valid idea in 2000 but it sounds like a stupid idea in 2015 but the amount of damage depends on your site's functionality. If you don't need any 3rd party service on server side then you can do it, but as I said it is a very unlikely ...


2

WordPress uses an HTTP class to make outbound requests. These requests are mainly for plugin, themes and core updates; pull news/rss content; and make third party API requests. There may be many different reasons for disabling outbound requests, security is the primary one. A WP instance with disabled outbound requests is more secure. Many institutions ...



Top 50 recent answers are included