Tag Info

New answers tagged

1

Your risk is greater than if the files were completely outside the webroot simply because they are accessible on the web. This means you are relying on the web server to secure something which would otherwise be freely available to anyone with the correct URL. This results in an increased attack surface with exposure to web server vulnerability exploits, ...


3

XML-RPC is Being Used to Brute Force Passwords Aside from the security issues mentioned in the other answers, there has been an uptick in brute-force attacks against xmlrpc.php. These attacks are trying to gain passwords. Sucuri has some nice documentation on this. This is not a bug in the software. WP's XML-RPC implementation includes authentication ...


2

I study and research advanced processes for defense and detection for such things. The answer from Rarst is technically correct. No question. However, this smells of what is extremely typical- let me explain. A number of systems were compromised and Wordpress sites were likely bulk attacked and are now targeting known vulnerabilities almost randomly. It ...


3

This was only a DDoS attack or they were trying to hack my site? There is no way to tell the functional aspect of it without seeing POST payload. Since it was aimed at interactive endpoint I would assume that had some point, other than simply exhausting your resources. Although they might have been trying (succeeding? no way to tell without seeing ...


0

You can put this script into you're .htaccess file on root directory of you're website: ## block IP access ## order allow,deny deny from 81.17.31.162 deny from 81.17.31.164 allow from all ## block IP access ## In this case make all IP Address unless 81.17.31.162 and 81.17.31.164 to access you're website


2

As of August 2014 Google has officially indicated that HTTPS will be used as a ranking signal. This means that even if your website is a completely static website, if you care about SEO you should at least consider setting up an SSL certificate. Of course HTTPS is just one ranking signal out of hundreds, so there are probably more important things you can ...


0

I've been using the Wordfence Security plugin for Wordpress, as it: Allows you to ban certain IP addresses via Wordpress. Can be configured to block IP addresses after too many failed Wordpress logins. It will also email you whenever somebody has been locked out (or if somebody has logged in). Typically speaking, I get at least 10+ emails a day as bots ...


0

From the OWASP The referrer field (actually spelled 'referer') in HTTP requests can be easily modified and, as such, is not a valid means of message integrity checking. The OWASP actually regards this as vulnerability when used as the sole integrity or authentication method. Increasingly, I've observed bots no longer use blank referrers but use ...


1

We've made a tool for that – SslCheck. We've got tired of checking every web page manually and created a crawler. It goes through all pages and shows you which ones have "non-secure" content. All you need to do is enter you root URL. Hope it saves someone some time.



Top 50 recent answers are included