Yeah, will do. I actually realized that some of the plugins are not exactly ideal as they block some important parts of your website's functionality. I should create another thread with a proper walkthrough today.
All of my site's are routed through Cloudflare. I still didn't prevent them from getting hacked.All Security plugins are USELESSSSS, depending on who is targeting you.. Yea that's right!
Learn how to use Cloudflare to protect your website and sleep with your 2 eyes closed
You need to bind your VPS to Cloudflare through IPTables rules by creating a rules set for a tunnel, this way crawlers like censys.io etc aren't able to see your real IP address in very first place!
Not properly so, what about HTTP Request Smuggling attacks?All Security plugins are USELESSSSS, depending on who is targeting you.. Yea that's right!
Learn how to use Cloudflare to protect your website and sleep with your 2 eyes closed
Plugins are useful, a good web server configuration following proper hardening best practices even more (i.e. IPTabes Rules, Strict CSP, etc.), especially while using HTTP/3 QUIC. I use apache include file to block at server level, so xmlrpc will be blocked in all sites.
<Files xmlrpc.php>
Order allow,deny
Allow from 192.0.64.1/192.0.127.254
Deny from all
Satisfy All
ErrorDocument 403 http://127.0.0.1/
</Files>
Bro,
check your dns zone, set up properly
intodns.com
https://censys.io
https://developer.shodan.io
https://dns.bufferover.run
https://index.commoncrawl.org
https://riddler.io
https://api.certspotter.com
https://api.hackertarget.com
https://api.threatminer.org
https://community.riskiq.com
https://crt.sh
https://dnsdumpster.com
https://docs.binaryedge.io
https://securitytrails.com
https://graph.facebook.com
https://otx.alienvault.com
https://rapiddns.io
https://spyse.com
https://urlscan.io
https://www.dnsdb.info
https://www.virustotal.com
https://threatcrowd.org
https://web.archive.org
