Securing phpMyAdmin in a WordPress Jail

This post assumes you’ve run at least version 1.3.0 of the Scripted WordPress Installation. In the post WordPress Script: Post-Installation Tasks, I suggest that a way of securing phpMyAdmin in a WordPress jail is to disable it when not in use. One way to disable phpMyAdmin is to unlink it in the jail rm /usr/local/www/wordpress/phpmyadmin. This …
Continue reading Securing phpMyAdmin in a WordPress Jail

Wordfence: Site Compromised

So, while I’ve been busy hardening my blog site blog.udance.com.au, by stealth, hackers appear to have been busy on the WordPress site attached to the main domain udance.com.au. The tell-tale signs suggest that the site appears to be compromised. As there’s no content yet on this site, the easiest thing to do is blow it …
Continue reading Wordfence: Site Compromised

Wordfence: “You keep on knockin’ but you can’t come in”

Here’s a little something to listen to while you read this post. It’s appropriate for this post. Wordfence is effectively blocking blocking attempts to log in using invalid usernames. Refer to the post WordPress Plugin: Wordfence logging lots of failed login attempts for further details. However, there’s someone sneaky who is quietly trying to log …
Continue reading Wordfence: “You keep on knockin’ but you can’t come in”

Incident Management

Gone are the days when I could shout out to the family ‘I’m just going to reboot the server. Get off now!’ Since exposing several LAN resources such as Nextcloud and WordPress to the internet, I’ve come to realise there’s a whole customer base who have to be considered prior to causing any disruption to …
Continue reading Incident Management

WordPress: A Disaster Recovery Strategy

The infographic below describes a streamlined approach to WordPress disaster recovery that minimises the room for error, and maximises the chances of fully restoring a WordPress site under a wide range of WordPress disaster scenarios. I’ve tested the approach against my own blog site and apart from a minor tweak of WP Super Cache, a WordPress …
Continue reading WordPress: A Disaster Recovery Strategy

WordPress Plugin: Wordfence logging lots of failed login attempts

It’s scary to see a WordPress site being probed for vulnerabilities Dashboard > Wordfence > Tools > Live Traffic Most are for invalid users blog and admin. As part of tuning Wordfence, block these immediately Dashboard > Wordfence > All Options > Brute Force Protection Activity detail reflects the change:

WordPress Plugin: A Marriage made in Heaven for UpdraftPlus and FreeNAS

The goal here is to use FreeNAS storage to store UpdraftPlus backups of WordPress sites. Local user authentication is assumed for FreeNAS. Outline of the basic steps: A. Set up the UpdraftPlus storage root. Set aside storage space on FreeNAS for UpdraftPlus. Create the UpdraftPlus user and group on FreeNAS. Configure and start the FTP …
Continue reading WordPress Plugin: A Marriage made in Heaven for UpdraftPlus and FreeNAS

Scripted WordPress Installation

If the statistics are to be believed, in 2020: WordPress powers 35% of the internet. Around 60% of CMS sites are WordPress. Around 28% of WordPress sites run e-commerce. Around 75% of hacked CMS sites were built on WordPress 😢 There are few current guides in the iXsystems Community Forum for setting up WordPress and none …
Continue reading Scripted WordPress Installation

WordPress Plugin: WP Super Cache

When installing and activating, you will see the following errors: Assuming your jail name is wordpress, enter the jail from a terminal iocage console wordpress. To resolve the first issue, enter the following commands in the terminal: cd /usr/local/www/wordpress/wp-content cp plugins/wp-super-cache/wp-cache-config-sample.php wp-cache-config.php chown www:www wp-cache-config.php Refreshing WP Super Cache on the dashboard: Edit wp-config.php ee …
Continue reading WordPress Plugin: WP Super Cache

WordPress: PHP Dependencies

Tabled below is a list of PHP dependencies for WordPress and some of its more popular plugins. Interestingly, the plugin PHP dependencies are not well documented anywhere. WordPress & Plugins PHP Dependencies References WordPress 5.5.1 and higher php, curl, dom, exif, fileinfo, json, mbstring, mysqli, pecl-libsodium, openssl, pecl-imagick, xml, zip, filter, gd, iconv, pecl-mcrypt, simplexml, …
Continue reading WordPress: PHP Dependencies