Reputation
1,166
Top tag
Next privilege 2,000 Rep.
Edit questions and answers
Badges
3 18 36
Impact
~82k people reached

Mar
10
awarded  Nice Question
Mar
10
awarded  Announcer
Mar
10
comment Local copy of WordPress Codex?
Is it possible to store into a static set of html, or do I need to be running Apache/PHP (or whatever current MediaWiki requirements are) on the target device? The Implementation details lack a simple set of instructions, they instead point to other solutions in various stages of completeness. sciencemedianetwork.org/wiki/…
Mar
9
comment Side effects of disallowing *.php requests in production environment?
wp-admin is indeed removed. database is indeed firewalled. whole site has a load balancing infrastructure in front of it with intrusion detection included.
Mar
9
accepted Mechanism to send to users of secured WordPress install new notifications by SMS or email?
Mar
9
accepted Side effects of disallowing *.php requests in production environment?
Mar
9
comment Side effects of disallowing *.php requests in production environment?
Yes, I've looked at some of the plugins we're using and we appear not to be using anything that has a "public-facing" .php file. I'll have to look at all of them a bit closer. Thanks for the coherent answer!
Mar
9
comment Side effects of disallowing *.php requests in production environment?
"If you code correctly, simply calling a PHP file is not enough to hack your site" yes, but WordPress and plugins are third party code. Saving to static files is not a bad idea, but for a site with a great deal of content, this has a different downside, that of a much larger file to be replicated. I appreciate the thought though. Ultimately most people are finding the premise of my question bizarre. :-( Hah! So bizarre someone felt the need to downvote. How helpful!
Mar
9
comment Side effects of disallowing *.php requests in production environment?
@Wyck, I assure you we have operations people who understand security. They deal with tens of thousands of concurrent connected users and devices continuously in other parts of our business. This is the real deal. What I'm trying to understand it myself, thus the question. :-)
Mar
9
comment Side effects of disallowing *.php requests in production environment?
@Steven, yes, AJAX calls to wp-admin/admin-ajax.php would not be possible given this configuration. This ie mentioned at: codex.wordpress.org/Hardening_WordPress#Securing_wp-admin
Mar
9
comment Side effects of disallowing *.php requests in production environment?
Grabbing the feed from another WordPress site leaves 2 open and potentially insecure instances of WordPress on the internet. That's not an answer. And no, posting and comments do not work on this published WordPress instance. This is a feature not a bug, and questioning this aspect of the question means you are not understanding the basis of my question so can't help me. I appreciate you chiming in, but it's not helpful.
Mar
9
comment Side effects of disallowing *.php requests in production environment?
Let's say plugin "Foo" has a vulnerability -- preventing direct calls to say wp-content/plugins/foo/Foo.php would allow the plugin to run only when called from inside other content, but would disallow direct calls to the file. The reason I'm asking about .php file disallow is because I don't really have a good answer for how or why it works either. But my "Foo" example is the best of my knowledge.
Mar
9
comment Side effects of disallowing *.php requests in production environment?
To address the issue of why you might secure or remove wp-admin/ see: codex.wordpress.org/Hardening_WordPress#Securing_wp-admin
Mar
9
asked Side effects of disallowing *.php requests in production environment?
Jan
26
awarded  Popular Question
Sep
14
awarded  Nice Question
Aug
12
awarded  Yearling
Jun
18
comment Mechanism to send to users of secured WordPress install new notifications by SMS or email?
That sounds pretty good. I was hoping there was a solution, but the pieces seem straightforward enough that I can make a go of building this for myself. I probably will end up, rather than using "official" SMS, just using the "email" equivalents for cell numbers like networking.ringofsaturn.com/Telecommunications/… - not as nice as SMS, but simpler from my perspective. If I were commercializing it, it would be great to allow them to turn on and off alerts via SMS.
Jun
18
asked Mechanism to send to users of secured WordPress install new notifications by SMS or email?
Jun
14
awarded  Citizen Patrol