1,111 reputation
21735
bio website artlung.com
location San Diego, CA
age 45
visits member for 5 years
seen May 15 at 23:52

I am a web developer and some-time designer, blogger. Tech interests: PHP, MySQL, JavaScript, especially OO, jQuery, Flash, Open Source libraries of all kinds, WordPress, SilverStripe, Drupal, and more. I like to make web things.

You can reach me at joe@artlung.com

On twitter @artlung

See also: joecrawford.com


Mar
9
comment Side effects of disallowing *.php requests in production environment?
wp-admin is indeed removed. database is indeed firewalled. whole site has a load balancing infrastructure in front of it with intrusion detection included.
Mar
9
accepted Mechanism to send to users of secured WordPress install new notifications by SMS or email?
Mar
9
accepted Side effects of disallowing *.php requests in production environment?
Mar
9
comment Side effects of disallowing *.php requests in production environment?
Yes, I've looked at some of the plugins we're using and we appear not to be using anything that has a "public-facing" .php file. I'll have to look at all of them a bit closer. Thanks for the coherent answer!
Mar
9
comment Side effects of disallowing *.php requests in production environment?
"If you code correctly, simply calling a PHP file is not enough to hack your site" yes, but WordPress and plugins are third party code. Saving to static files is not a bad idea, but for a site with a great deal of content, this has a different downside, that of a much larger file to be replicated. I appreciate the thought though. Ultimately most people are finding the premise of my question bizarre. :-( Hah! So bizarre someone felt the need to downvote. How helpful!
Mar
9
comment Side effects of disallowing *.php requests in production environment?
@Wyck, I assure you we have operations people who understand security. They deal with tens of thousands of concurrent connected users and devices continuously in other parts of our business. This is the real deal. What I'm trying to understand it myself, thus the question. :-)
Mar
9
comment Side effects of disallowing *.php requests in production environment?
@Steven, yes, AJAX calls to wp-admin/admin-ajax.php would not be possible given this configuration. This ie mentioned at: codex.wordpress.org/Hardening_WordPress#Securing_wp-admin
Mar
9
comment Side effects of disallowing *.php requests in production environment?
Grabbing the feed from another WordPress site leaves 2 open and potentially insecure instances of WordPress on the internet. That's not an answer. And no, posting and comments do not work on this published WordPress instance. This is a feature not a bug, and questioning this aspect of the question means you are not understanding the basis of my question so can't help me. I appreciate you chiming in, but it's not helpful.
Mar
9
comment Side effects of disallowing *.php requests in production environment?
Let's say plugin "Foo" has a vulnerability -- preventing direct calls to say wp-content/plugins/foo/Foo.php would allow the plugin to run only when called from inside other content, but would disallow direct calls to the file. The reason I'm asking about .php file disallow is because I don't really have a good answer for how or why it works either. But my "Foo" example is the best of my knowledge.
Mar
9
comment Side effects of disallowing *.php requests in production environment?
To address the issue of why you might secure or remove wp-admin/ see: codex.wordpress.org/Hardening_WordPress#Securing_wp-admin
Mar
9
asked Side effects of disallowing *.php requests in production environment?
Jan
26
awarded  Popular Question
Sep
14
awarded  Nice Question
Aug
12
awarded  Yearling
Jun
18
comment Mechanism to send to users of secured WordPress install new notifications by SMS or email?
That sounds pretty good. I was hoping there was a solution, but the pieces seem straightforward enough that I can make a go of building this for myself. I probably will end up, rather than using "official" SMS, just using the "email" equivalents for cell numbers like networking.ringofsaturn.com/Telecommunications/… - not as nice as SMS, but simpler from my perspective. If I were commercializing it, it would be great to allow them to turn on and off alerts via SMS.
Jun
18
asked Mechanism to send to users of secured WordPress install new notifications by SMS or email?
Jun
14
awarded  Citizen Patrol
Mar
15
answered New Admin Bar Not Functioning
Feb
8
accepted Is there a theme function for is_password_protected()?
Feb
8
comment Is there a theme function for is_password_protected()?
Doh! How'd I miss that? Thanks for speedy answer!