Wordpress Security Plugins

shop deals on amazon
Advertise with us
Shop deals on ebay
Bed & Breakfast / Short Term Rental Host Forum

Help Support Bed & Breakfast / Short Term Rental Host Forum:

This site may earn a commission from merchant affiliate links, including eBay, Amazon, and others.
Generic

Generic

Well-known member
Joined
Feb 24, 2011
Messages
7,728
Reaction score
281
Just looked at how many the security guy installed for me....
Anti-Malware Security and Brute-Force Firewall
BruteProtect
BulletProof Security
and

Wordfence Security
Really? DO I actually need 4 of them to protect my wordpress website? I trying to figure out what's spiking my CPU usage.
 
NO you don't need all of them. Wordfence is all I ever use. They will probably work against each other.
 
True.
WordFence can be configured to handle most of the stuff. From my experience the most important thing is to block the log-in attempts. The default configuration doesn't put restrictions in place for that (like a user lock-out for 24 hours).
 
dumitru said:
True.
WordFence can be configured to handle most of the stuff. From my experience the most important thing is to block the log-in attempts. The default configuration doesn't put restrictions in place for that (like a user lock-out for 24 hours)..
Click to expand...
dumitru said:
The default configuration doesn't put restrictions in place for that (like a user lock-out for 24 hours).
Click to expand...
I found mine was set to lock people out after 20 login failures. I changed it to 7. Don't want to lock myself out if I make my famous mistake of leaving caps lock on!
Mine was set to lock people out after 20 forgot password attempts. I changed it to 7.
Mine was set to lock people out for 5 minutes when they do get locked out. I changed it to 1 day.
 
Arks said:
dumitru said:
True.
WordFence can be configured to handle most of the stuff. From my experience the most important thing is to block the log-in attempts. The default configuration doesn't put restrictions in place for that (like a user lock-out for 24 hours)..
Click to expand...
dumitru said:
The default configuration doesn't put restrictions in place for that (like a user lock-out for 24 hours).
Click to expand...
I found mine was set to lock people out after 20 login failures. I changed it to 7. Don't want to lock myself out if I make my famous mistake of leaving caps lock on!
Mine was set to lock people out after 20 forgot password attempts. I changed it to 7.
Mine was set to lock people out for 5 minutes when they do get locked out. I changed it to 1 day.
.
Click to expand...
I set everything to 1 attempt and simply whitelisted my own IPs: the one from the office and the one from home.
As I don't have an account with the username "admin", I have configured it to automatically lock-in anyone trying a non-existing username.
Combined with a .htaccess password protection for the /wp-admin/ folder, I basically forgot about most problems with spam and brute-force.
 
dumitru said:
Arks said:
dumitru said:
True.
WordFence can be configured to handle most of the stuff. From my experience the most important thing is to block the log-in attempts. The default configuration doesn't put restrictions in place for that (like a user lock-out for 24 hours)..
Click to expand...
dumitru said:
The default configuration doesn't put restrictions in place for that (like a user lock-out for 24 hours).
Click to expand...
I found mine was set to lock people out after 20 login failures. I changed it to 7. Don't want to lock myself out if I make my famous mistake of leaving caps lock on!
Mine was set to lock people out after 20 forgot password attempts. I changed it to 7.
Mine was set to lock people out for 5 minutes when they do get locked out. I changed it to 1 day.
.
Click to expand...
I set everything to 1 attempt and simply whitelisted my own IPs: the one from the office and the one from home.
As I don't have an account with the username "admin", I have configured it to automatically lock-in anyone trying a non-existing username.
Combined with a .htaccess password protection for the /wp-admin/ folder, I basically forgot about most problems with spam and brute-force.
.
Click to expand...
I like blocking the use of an unknown user name.
 
So if you check your Wordfence stats and you see the same IP address keeps trying to login, do you block that ip or just let wordfence do its job?
 
Let me ask this one - if I set word fence to lock out attempts using invalid user names does that encourage hackers to try different names rather than just different passwords?
I mean if they just keep trying the same 2 user names that keeps them amused without them ever getting to the right username. But, if I tell them they got the wrong name by immediately locking them out didn't that encourage trying other names?
BTW, the two usernames are 'test' and the actual domain name. Don't use those!
 
One more - word fence tells me that one of my files is altered from the last time it did a scan. I checked the files side by side (nice feature). It's the file that sets up the email. It is completely different. New owner name, new code, but I can't tell if it's just an update to the plug in or what.
Can someone explain how my own email keeps ending up as blocked spam in my email program? (Probably not related to the issue of the file I mentioned above.)
 
Morticia said:
One more - word fence tells me that one of my files is altered from the last time it did a scan. I checked the files side by side (nice feature). It's the file that sets up the email. It is completely different. New owner name, new code, but I can't tell if it's just an update to the plug in or what.
Can someone explain how my own email keeps ending up as blocked spam in my email program? (Probably not related to the issue of the file I mentioned above.).
Click to expand...
I'd go back to your backup file and replace it with the old file. Then change your passwords.
I had someone hack my site 2 years ago and was sending spam through it, which almost got my domain blacklisted. Better safe than sorry.
 
Morticia said:
Let me ask this one - if I set word fence to lock out attempts using invalid user names does that encourage hackers to try different names rather than just different passwords?
I mean if they just keep trying the same 2 user names that keeps them amused without them ever getting to the right username. But, if I tell them they got the wrong name by immediately locking them out didn't that encourage trying other names?
BTW, the two usernames are 'test' and the actual domain name. Don't use those!.
Click to expand...
Morticia said:
Let me ask this one - if I set word fence to lock out attempts using invalid user names does that encourage hackers to try different names rather than just different passwords?
I mean if they just keep trying the same 2 user names that keeps them amused without them ever getting to the right username. But, if I tell them they got the wrong name by immediately locking them out didn't that encourage trying other names?
BTW, the two usernames are 'test' and the actual domain name. Don't use those!
Click to expand...
Since last night I have received 20 emails from wordfence letting me know there were 20 attempts to logon using non existent account names. I guess I will turn the email notification feature off!
 
Morticia said:
Morticia said:
Let me ask this one - if I set word fence to lock out attempts using invalid user names does that encourage hackers to try different names rather than just different passwords?
I mean if they just keep trying the same 2 user names that keeps them amused without them ever getting to the right username. But, if I tell them they got the wrong name by immediately locking them out didn't that encourage trying other names?
BTW, the two usernames are 'test' and the actual domain name. Don't use those!.
Click to expand...
Morticia said:
Let me ask this one - if I set word fence to lock out attempts using invalid user names does that encourage hackers to try different names rather than just different passwords?
I mean if they just keep trying the same 2 user names that keeps them amused without them ever getting to the right username. But, if I tell them they got the wrong name by immediately locking them out didn't that encourage trying other names?
BTW, the two usernames are 'test' and the actual domain name. Don't use those!
Click to expand...
Since last night I have received 20 emails from wordfence letting me know there were 20 attempts to logon using non existent account names. I guess I will turn the email notification feature off!
.
Click to expand...
And there are hundreds more that the Hosting company blocks. I got sick of getting them so I just turned it off. I don't want all these emails.
 
Morticia said:
So if you check your Wordfence stats and you see the same IP address keeps trying to login, do you block that ip or just let wordfence do its job?.
Click to expand...
Most of these IPs are dynamic or coming through a proxy. Manually taking actions against them is time-consuming and wouldn't help much. Set some strict rules and let WordFence do its job.
 

Latest posts

Back
Top