UpdraftPlus Plugin: Restoring a Site from Backup

In the post WordPress: A Disaster Recovery Strategy, I didn’t describe the restore phase. Well, it just so happened that I lost a development site mockup.udance.com.au while isolating an issue between the Simple Calendar plugin and the Pen theme (see post WordPress: Pen Theme 1.3.9 and Simple Calendar Plugin 3.1.33 Anomaly). When switching between themes, …
Continue reading UpdraftPlus Plugin: Restoring a Site from Backup

WordPress: Pen Theme 1.3.9 and Simple Calendar Plugin 3.1.33 Anomaly

There appears to be an incompatibility between the Pen theme and the popular Simple Calendar plugin. The issue is visible on the calendar schedule on site mockup.udance.com.au using the Pen theme. Summary details are missing when hovering over a calendar entry. Google Chrome version 86.0.4240.75 on both a Windows 10 desktop and Pixel 3 XL …
Continue reading WordPress: Pen Theme 1.3.9 and Simple Calendar Plugin 3.1.33 Anomaly

WordPress: Setting up a Redis Object Cache

This post assumes you’ve run at least version 1.4.2 of the Scripted WordPress Installation. Install and activate the WordPress Redis Object Cache plugin. Click on Enable Object Cache in the plugin settings. You should see the following screen: If you don’t see this screen, click on the diagnostics tab. This may provide some clues as …
Continue reading WordPress: Setting up a Redis Object Cache

Replication failure

This has happened to me a couple of times now, so I thought I’d document it. TrueCommand has indicated that replication is failing on my main server for a particular dataset. Now, I know I’ve been messing around quite a bit with WordPress, rebuilding jails and associated datasets. The UDance WordPress site has been problematical …
Continue reading Replication failure

Securing phpMyAdmin in a WordPress Jail

This post assumes you’ve run at least version 1.3.0 of the Scripted WordPress Installation. In the post WordPress Script: Post-Installation Tasks, I suggest that a way of securing phpMyAdmin in a WordPress jail is to disable it when not in use. One way to disable phpMyAdmin is to unlink it in the jail rm /usr/local/www/wordpress/phpmyadmin. This …
Continue reading Securing phpMyAdmin in a WordPress Jail

Wordfence: Site Compromised

So, while I’ve been busy hardening my blog site blog.udance.com.au, by stealth, hackers appear to have been busy on the WordPress site attached to the main domain udance.com.au. The tell-tale signs suggest that the site appears to be compromised. As there’s no content yet on this site, the easiest thing to do is blow it …
Continue reading Wordfence: Site Compromised

Wordfence: “You keep on knockin’ but you can’t come in”

Here’s a little something to listen to while you read this post. It’s appropriate for this post. Wordfence is effectively blocking blocking attempts to log in using invalid usernames. Refer to the post WordPress Plugin: Wordfence logging lots of failed login attempts for further details. However, there’s someone sneaky who is quietly trying to log …
Continue reading Wordfence: “You keep on knockin’ but you can’t come in”

Incident Management

Gone are the days when I could shout out to the family ‘I’m just going to reboot the server. Get off now!’ Since exposing several LAN resources such as Nextcloud and WordPress to the internet, I’ve come to realise there’s a whole customer base who have to be considered prior to causing any disruption to …
Continue reading Incident Management

WordPress: A Disaster Recovery Strategy

The infographic below describes a streamlined approach to WordPress disaster recovery that minimises the room for error, and maximises the chances of fully restoring a WordPress site under a wide range of WordPress disaster scenarios. I’ve tested the approach against my own blog site and apart from a minor tweak of¬†WP Super Cache, a WordPress …
Continue reading WordPress: A Disaster Recovery Strategy

WordPress Plugin: Wordfence logging lots of failed login attempts

It’s scary to see a WordPress site being probed for vulnerabilities Dashboard > Wordfence > Tools > Live Traffic Most are for invalid users blog and admin. As part of tuning Wordfence, block these immediately Dashboard > Wordfence > All Options > Brute Force Protection Activity detail reflects the change: