4 ms·

That’s good info, thanks. I just happen to be looking into WP security right now. Would you recommend wordfence in addition to the changes you mentioned?

xenospn 7y ago
I highly recommend wordfence. I have it set to immediately block anyone after a single failed login attempt.
- kijin 7y ago
  It's fairly resource-intensive, though. I've seen whole servers brought to their knees because of plugins like WordFence -- an unintentional DoS, so to speak. Many of the defenses employed by WordFence would be orders of magnitude more efficient if implemented at the level of the http daemon or firewall. Unfortunately, WordPress plugins must cater to the lowest common denominator, shared hosting.
  - xenospn 7y ago
    If what you’re dealing with is thousands of attempted brute force attacks on a daily or weekly basis, a wordpress plugin might not be the solution.
    - kijin 7y ago
      Sure, but you don't know that until the attacks actually begin, and anyone can attack any site for any reason these days. Meanwhile, most people who run WordPress sites don't know how to do anything more complicated than installing a plugin. Being a developer who caters to that market has its own charms and challenges.
- HNthrow22 7y ago
  to offer a counter opinion I found wordfence highly obtrusive, annoying and full of dark patterns in an attempt to upsell you to premium. They present in their dashboard ALL attacks within their entire network as if those were attacks on your site in particular which is misleading. If the project permits the best practice is to convert the site into fully static HTML (WP2Static, SimplyStatic) and keep the backend site/database separate and local only.
- onion2k 7y ago
  So if I know the username of someone who admins your website I could shut them out with a single POST request? Seems a bit risky.
  - xenospn 7y ago
    It's a small site. Not a concern.
kabes 7y ago
I'm really happy with ninjafirewall. Here's a comparison: https://translate.googleusercontent.com/translate_c?depth=1&hl=en&nv=1&prev=search&rurl=translate.google.com&sl=de&sp=nmt4&u=https://www.damianschwyrz.de/content/schuetzen-wordfence-ithemes-security-meine-wordpress-seite-so-gut-wie-alle-behaupten-nein&xid=17259,15700021,15700043,15700186,15700191,15700253,15700256,15700259&usg=ALkJrhjpvQD4DE2rohaqg09rig53_jn5YA https://translate.googleusercontent.com/translate_c?depth=1&...

xenospn 7y ago

I highly recommend wordfence. I have it set to immediately block anyone after a single failed login attempt.

kijin 7y ago
It's fairly resource-intensive, though. I've seen whole servers brought to their knees because of plugins like WordFence -- an unintentional DoS, so to speak. Many of the defenses employed by WordFence would be orders of magnitude more efficient if implemented at the level of the http daemon or firewall. Unfortunately, WordPress plugins must cater to the lowest common denominator, shared hosting.
- xenospn 7y ago
  If what you’re dealing with is thousands of attempted brute force attacks on a daily or weekly basis, a wordpress plugin might not be the solution.
  - kijin 7y ago
    Sure, but you don't know that until the attacks actually begin, and anyone can attack any site for any reason these days. Meanwhile, most people who run WordPress sites don't know how to do anything more complicated than installing a plugin. Being a developer who caters to that market has its own charms and challenges.
HNthrow22 7y ago
to offer a counter opinion I found wordfence highly obtrusive, annoying and full of dark patterns in an attempt to upsell you to premium. They present in their dashboard ALL attacks within their entire network as if those were attacks on your site in particular which is misleading. If the project permits the best practice is to convert the site into fully static HTML (WP2Static, SimplyStatic) and keep the backend site/database separate and local only.
onion2k 7y ago
So if I know the username of someone who admins your website I could shut them out with a single POST request? Seems a bit risky.
- xenospn 7y ago
  It's a small site. Not a concern.

kabes 7y ago

I'm really happy with ninjafirewall. Here's a comparison: https://translate.googleusercontent.com/translate_c?depth=1&hl=en&nv=1&prev=search&rurl=translate.google.com&sl=de&sp=nmt4&u=https://www.damianschwyrz.de/content/schuetzen-wordfence-ithemes-security-meine-wordpress-seite-so-gut-wie-alle-behaupten-nein&xid=17259,15700021,15700043,15700186,15700191,15700253,15700256,15700259&usg=ALkJrhjpvQD4DE2rohaqg09rig53_jn5YA https://translate.googleusercontent.com/translate_c?depth=1&...