Tag: security

  • WordPress disable XMLRPC.php for increased security

    I have recently been having a few issues with bots and malicious attacks trying to breach WordPress websites via brute force attacks. From my experience 90% of the websites, I have built or worked on never utilise the xmlrpc service, which is included with WordPress, due to this I decided to simply block any access to this service via Apache, which fixes a number of security related issues.

    Code

    Place this in your websites .htaccess file to take effect, then simply browser to domain.com/xmlrpc.php and you now get an access denied message.

    What is XMLRPC?

    The xmlrpc.php allows remote access to your WordPress site, it allows various tools and publishing applications to control and manage content from outside of the normal WordPress admin. For example, a publishing tool may allow you to write new blog posts using an alternative tool (instead of the WordPress admin).

    Do I need it?

    If you do not use any tools / services which utilise xmlrpc, then you do not need it and can apply the block in this post. For example, if you use the WordPress app to manage your website from your phone then you will need to keep XMLRPC working.

    Why block XMLRPC?

    Due to the nature of XMLRPC, it allows remote services to connect and perform actions on your website, this creates an additional security risk, and it is very common for malicious attacks to target XMLRPC with bruite-force attacks, trying to guess your password and / or access other services exposed by the XMLRPC protocol.

    This code is provided as it and may require changes to work for your needs.

  • htaccess: Block bad bots for security purposes

    Please double check any bots you wish to allow are not in the block list. This is a list of known bots, as well as default user agents.

    I have had a scenario where a website was getting scraped by a number of bots, causing excessive resource usage on the server and disrupting sales and bad experience for real customers.

    Here is a basic technique to stop those pesky bots, simply add the following to your .htaccess file. You may need to modify the exceptions at the top if you do require certain files to be accessed by bots. Currently it will allow access to robots.txt and acme-challenge for LetsEncrypt.

  • htaccess: HTTP to HTTPS redirect

    It is recommended to you SSL on your website even when not required. Google Chrome and other browsers have begun to flag non-SSL websites as insecure. Don’t lose your visitors due to appearing as an insecure website.

    With the introduction of LetsEncyrpt and other free SSL certificate providers, there is no reason for websites to not be secured. Google Chrome is now beginning to flag websites which are non-HTTPS as secure leading to your visitors and customers believe your website is insecure. Make sure your using and SSL and redirecting all non-HTTP traffic to HTTPS using the below htaccess config setting for Apache.

  • Automatic MySQL database backups and zipping on windows with a bat file

    Automatic MySQL database backups and zipping on windows with a bat file

    It is important you double check your configuration before running this script! We cannot be held responsible for any damage this may cause.

    Need to backup all your databases on a MySQL windows server? Red Olive have created a simple windows batch file to export all database tables and zip, including deleting older backups! It’s quite simple to setup look at their website.

    https://www.redolive.com/utah-web-designers-blog/automated-mysql-backup-for-windows/

    Their version is configured for a US date/time format, I am in the UK with UK based date/time formats, I have made a modified version of the script available below.

    You should setup a scheduled task to run the bat file on a regular interval, the more often you perform backups the easier it will be for you if there is a failure and you require to restore a backup.

    We also advise you look at a process for storing backups at remote location, if you backup to a Dropbox folder your backups will be uploaded to the cloud, protecting you if the server dies or has disk failure!

  • WordPress: Update user / admin password via database

    WordPress: Update user / admin password via database

    Forgot your WordPress admin login details or a previous developer is unwilling to give you the WordPress login details, well the answer is very simple. As long as you have database access you can use the website below to generate a new password hashsum, simply replace the origional password value with the new hashsum and you will have access again. (more…)