Discovering what life is about

Wordpress Security

 

 

Wordpress Security

 

 

 


 

PROTECTION        HARDENING            DETECTION
FIREWALL                   UTILITIES                       ANTIVIRUS

NINJAFIREWALL                 AIO WP SECURITY                WORDFENCE

 

 

 

 


 

 

NinjaFirewall (WP Edition) - Web Application Firewall

 

NinjaFirewall can hook, scan, sanitise or reject any HTTP/HTTPS request sent to a PHP script before it reaches WordPress or any of its plugins. All scripts located inside the blog installation directories and sub-directories will be protected, including those that aren't part of the WordPress package. Even encoded PHP scripts, hackers shell scripts and backdoors will be filtered by NinjaFirewall.

 

Some of its features are:

 

Full standalone web application firewall. Works before WordPress is loaded.

Protects against remote file inclusion, local file inclusion, cross-site scripting, code execution, SQL injections, brute-force scanners, shell scripts, backdoors etc.

Scans and sanitises GET/POST requests, HTTP/HTTPS traffic, cookies, server variables (HTTP_USER_AGENT, HTTP_REFERER, PHP_SELF, PATH_TRANSLATED, PATH_INFO).

Sanitises variables names and values.

Advanced filtering options to block ASCII control characters, NULL bytes and PHP built-in wrappers.

Decodes and scans Base64-encoded POST requests to detect backdoors and code injection attempts.

Hooks and secures HTTP reponse headers to prevent XSS, phishing and clickjacking attempts (X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, Strict-Transport-Security).

Hooks and modifies cookies to set the HttpOnly flag.

Blocks username enumeration scanning attempts through the author archives and the login page.

Blocks/allows uploads, sanitises uploaded file names.

Blocks suspicious bots and scanners.

Hides PHP error and notice messages.

Blocks direct access to PHP scripts located inside specific directories (e.g., /wp-content/uploads/).

Protects WordPress XML-RPC API.

Whitelist option for WordPress administrator(s), localhost and private IP address spaces.

Configurable HTTP return code and message.

Rules editor to enable/disable built-in security rules.

Activity log and statistics.

Debugging mode.

 

 


 

 

All In One WP Security

All In One WP Security also uses an unprecedented security points grading system to measure how well you are protecting your site based on the security features you have activated.

Our security and firewall rules are categorized into "basic", "intermediate" and "advanced". This way you can apply the firewall rules progressively without breaking your site's functionality.


Below is a list of the security and firewall features offered in this plugin:
User Accounts Security

Detect if there is a user account which has the default "admin" username and easily change the username to a value of your choice.
The plugin will also detect if you have any WordPress user accounts which have identical login and display names. Having account's where display name is identical to login name is bad security practice because you are making it 50% easier for hackers because they already know the login name.
Password strength tool to allow you to create very strong passwords.
Stop user enumeration. So users/bots cannot discover user info via author permalink.

User Login Security

Protect against "Brute Force Login Attack" with the Login Lockdown feature. Users with a certain IP address or range will be locked out of the system for a predetermined amount of time based on the configuration settings and you can also choose to be notified via email whenever somebody gets locked out due to too many login attempts.

As the administrator you can view a list of all locked out users which are displayed in an easily readable and navigable table which also allows you to unlock individual or bulk IP addresses at the click of a button.
Force logout of all users after a configurable time period

Monitor/View failed login attempts which show the user's IP address, User ID/Username and Date/Time of the failed login attempt

Monitor/View the account activity of all user accounts on your system by keeping track of the username, IP address, login date/time, and logout date/time.
Ability to automatically lockout IP address ranges which attempt to login with an invalid username.
Ability to see a list of all the users who are currently logged into your site.
Allows you to specify one or more IP addresses in a special whitelist. The whitelisted IP addresses will have access to your WP login page.
Add captcha to WordPress Login form.
Add captcha to the forgot password form of your WP Login system.

User Registration Security

Enable manual approval of WordPress user accounts. If your site allows people to create their own accounts via the WordPress registration form, then you can minimize SPAM or bogus registrations by manually approving each registration.
Ability to add captcha to the WordPress user registration page to protect you from spam user registration.

Database Security

Easily the default WP prefix to a value of your choice with the click of a button.
Schedule automatic backups and email notifications or make an instant DB backup whenever you want with one click.

File System Security

Identify files or folders which have permission settings which are not secure and set the permissions to the recommend secure values with click of a button.
Protect your PHP code by disabling file editing from the WordPress administration area.
Easily view and monitor all host system logs from a single menu page and stay informed of any issues or problems occurring on your server so you can address them quickly.
Prevent people from accessing the readme.html, license.txt and wp-config-sample.php files of your WordPress site.

htaccess and wp-config.php File Backup and Restore

Easily backup your original .htaccess and wp-config.php files in case you will need to use them to restore broken functionality.
Modify the contents of the currently active .htaccess or wp-config.php files from the admin dashboard with only a few clicks

Blacklist Functionality

Ban users by specifying IP addresses or use a wild card to specify IP ranges.
Ban users by specifying user agents.

Firewall Functionality

This plugin allows you to easily add a lot of firewall protection to your site via htaccess file. An htaccess file is processed by your web server before any other code on your site. So these firewall rules will stop malicious script(s) before it gets a chance to reach the WordPress code on your site.

Access control facility.
Instantly activate a selection of firewall settings ranging from basic, intermediate and advanced.
Enable the famous "5G Blacklist" Firewall rules courtesy of Perishable Press
Forbid proxy comment posting.
Block access to debug log file.
Disable trace and track.
Deny bad or malicious query strings.
Protect against Cross Site Scripting (XSS) by activating the comprehensive advanced character string filter. or malicious bots who do not have a special cookie in their browser. You (the site admin) will know how to set this special cookie and be able to log into your site.
WordPress PingBack Vulnerability Protection feature. This firewall feature allows the user to prohibit access to the xmlrpc.php file in order to protect against certain vulnerabilities in the pingback functionality. This is also helpful to block bots from constantly accessing the xmlrpc.php file and wasting your server resource.
Ability to block fake Googlebots from crawling your site.
Ability to prevent image hotlinking. Use this to prevent others from hotlinking your images.
Ability to log all 404 events on your site. You can also choose to automatically block IP addresses that are hitting too many 404s.
Ability to add custom rules to block access to various resources of your site.

Brute force login attack prevention

Instantly block Brute Force Login Attacks via our special Cookie-Based Brute Force Login Prevention feature. This firewall functionality will block all login attempts from people and bots.
Ability to add a simple math captcha to the WordPress login form to fight against brute force login attacks.
Ability to hide admin login page. Rename your WordPress login page URL so that bots and hackers cannot access your real WordPress login URL. This feature allows you to change the default login page (wp-login.php) to something you configure.
Ability to use Login Honeypot which will helps reduce brute force login attempts by robots.

WhoIs Lookup

Perform a WhoIs lookup of a suspicious host or IP address and get full details.

Security Scanner

The file change detection scanner can alert you if any files have changed in your WordPress system. You can then investigate and see if that was a legitimate change or some bad code was injected.
Database scanner feature can be used to scan your database tables. It will look for any common suspicious-looking strings, javascript and html code in some of the WordPress core tables.

Comment SPAM Security

Monitor the most active IP addresses which persistently produce the most SPAM comments and instantly block them with the click of a button.
Prevent comments from being submitted if it doesn't originate from your domain (this should reduce some SPAM bot comment posting on your site).
Add a captcha to your wordpress comment form to add security against comment spam.

Front-end Text Copy Protection

Ability to disable the right click, text selection and copy option for your front-end.

Regular updates and additions of new security features

WordPress Security is something that evolves over time. We will be updating the All In One WP Security plugin with new security features (and fixes if required) on a regular basis so you can rest assured that your site will be on the cutting edge of security protection techniques.

Works with Most Popular WordPress Plugins

It should work smoothly with most popular WordPress plugins.

Additional Features

Ability to remove the WordPress Generator Meta information from the HTML source of your site.
Ability to prevent people from accessing the readme.html, license.txt and wp-config-sample.php files
Ability to temporarily lock down the front end of your site from general visitors while you do various backend tasks (investigate security attacks, perform site upgrades, do maintenance work etc.)
Ability to export/import the security settings.
Prevent other sites from displaying your content via a frame or iframe.


Wordpress Security

 

 


 

 

 

WordFence : Files Scan + File change alert + Cache + limit login attempts

Scan - Detect - Protect - Block - Repair


https://wordpress.org/plugins/wordfence/

Wordfence starts by checking if your site is already infected. We do a deep server-side scan of your source code comparing it to the Official WordPress repository for core, themes and plugins. Then Wordfence secures your site and makes it up to 50 times faster.

 

WORDFENCE WORDPRESS SECURITY FEATURES
Blocking Features

Real-time blocking of known attackers. If another site using Wordfence is attacked and blocks the attacker, your site is automatically protected.
Block entire malicious networks. Includes advanced IP and Domain WHOIS to report malicious IP's or networks and block entire networks using the firewall. Report security threats to network owner.
Rate limit or block security threats like aggressive crawlers, scrapers and bots doing security scans for vulnerabilities in your site.
Choose whether you want to block or throttle users and robots who break your security rules.
Premium users can also block countries and schedule scans for specific times and a higher frequency.

Login Security

Sign-in using your password and your cellphone to vastly improve login security. This is called Two Factor Authentication and is used by banks, government agencies and military world-wide for highest security authentication.
Includes two-factor authentication, also referred to as cellphone sign-in.
Enforce strong passwords among your administrators, publishers and users. Improve login security.
Checks the strength of all user and admin passwords to enhance login security.
Includes login security to lock out brute force hacks and to stop WordPress from revealing info that will compromise security.

Security Scanning

Scans for the HeartBleed vulnerability - included in the free scan for all users.
Scans core files, themes and plugins against WordPress.org repository versions to check their integrity. Verify security of your source.
See how files have changed. Optionally repair changed files that are security threats.
Scans for signatures of over 44,000 known malware variants that are known security threats.
Scans for many known backdoors that create security holes including C99, R57, RootShell, Crystal Shell, Matamu, Cybershell, W4cking, Sniper, Predator, Jackal, Phantasma, GFS, Dive, Dx and many many more.
Continuously scans for malware and phishing URL's including all URL's on the Google Safe Browsing List in all your comments, posts and files that are security threats.
Scans for heuristics of backdoors, trojans, suspicious code and other security issues.

WordPress Firewall

Includes a firewall to block common security threats like fake Googlebots, malicious scans from hackers and botnets.

Monitoring Features

See all your traffic in real-time, including robots, humans, 404 errors, logins and logouts and who is consuming most of your content. Enhances your situational awareness of which security threats your site is facing.
A real-time view of all traffic including automated bots that often constitute security threats that Javascript analytics packages never show you.
Real-time traffic includes reverse DNS and city-level geolocation. Know which geographic area security threats originate from.
Monitor your DNS security for unauthorized DNS changes.
Monitors disk space which is related to security because many DDoS attacks attempt to consume all disk space to create denial of service.

 

 

 

 

 

 

 


 

 

http://www.itworld.com/article/2833430/security/improving-wordpress-security-with-wordfence-and-wp-security.html

 


 

 

 

doc/w/o/wordcamp-en-150515131214-lva1-app6892.pptx

 

 


 

 

 

Wordpress Security

 

 

Wordpress Security

 

 

 

 



 

 

Wordpress Security

 

 

Wordpress Security

 

 

 

 

Wordpress Security

 

 

Wordpress Security

 

 


 

 

Website Firewalls: What They Are & How to Set One Up for WordPress
https://www.elegantthemes.com/blog/tips-tricks/website-firewalls-what-they-are-how-to-set-one-up-for-wordpress


WordPress Security: The Ultimate Guide

https://premium.wpmudev.org/blog/keeping-wordpress-secure-the-ultimate-guide/

 

One Best Security Plugin For WordPress or Combination of Plugins?

http://researchasahobby.com/best-security-plugin-for-wordpress-combination/

 

Features comparisons

https://docs.google.com/spreadsheets/d/1Z5haAzRooBxFEXU6OK4xi_kkiyxYB0_UkrNCyUvPK9M/edit#gid=835953270

 

 


 

 

Our Choice :

 

WordFence : Files Scan + File change alert + Cache + limit login attempts

https://wordpress.org/plugins/wordfence/

Wordfence starts by checking if your site is already infected. We do a deep server-side scan of your source code comparing it to the Official WordPress repository for core, themes and plugins. Then Wordfence secures your site and makes it up to 50 times faster.

 

 

Acunetix WP Security - Security Hardening - Change file and folder permissions.

https://wordpress.org/plugins/wp-security-scan/

Acunetix WP Security plugin is a free and comprehensive security tool that helps you secure your WordPress installation and suggests corrective measures for: securing file permissions, security of the database, version hiding, WordPress admin protection and lots more.

Acunetix WP Security checks your WordPress website/blog for security vulnerabilities and suggests corrective actions such as:

Passwords

File permissions

Database security

Version hiding

WordPress admin protection/security

Removes WP Generator META tag from core code

 

 

 


 

 

Checking website reputation :

 

BLACKLIST CHECK : http://mxtoolbox.com/blacklists.aspx

 

 

REPUTATION CHECK : http://www.brightcloud.com/tools/url-ip-lookup.php

 

 

 

 

---
Categories : Online business    Themes : Security Tools
Share |
add a comment...

0 Comment

Leave a Comment