New answers tagged

0

I recently updated our /robots.txt file and removed most of it, including wp-admin. Bad idea. I don't use wordpress myself, but I know from scanning server logs dozens of times in a month that wp-admin is something not to make public on any site. You have a couple of options here: modify the server configuration setup so any reference to wp-admin ...


0

It depends on your site. If you run a special site involving high security and you want only select individuals located in several different countries with certain browsers to access your site and a login (or something unique to the user) is required to access the majority of the content on the site, then I'd say go for HTTPS. If you have a generic site ...


2

Security issue? Doubt it. It just makes your site more visible to people who likes to attack wordpress sites. Other than the visibility everything is the same, security through obscurity is not something you should rely on anyway. Useless? Definitely. There is no reason to allow indexing of your admin login in your site. You don't want your users finding a ...


4

When a new bug is found, in this case in wordpress, the first thing hackers will do is try to find vulnerable sites that use wordpress. A good way of doing it is trying to find wp-admin pages on google. Maybe will even use automated tools to find-and-exploit sites based on that. Avoiding that would be the main security reason for doing it. If you have no ...


2

If an attacker is able to put himself between your origin server and CloudFront endge location - it won't be so difficult for him to capture your HTTP traffic and extract your information. Theoretically, it can be done on side of your ISP. It is called as a "Man-in-the-middle" attack: https://en.wikipedia.org/wiki/Man-in-the-middle_attack If you trust your ...


2

Google doesn't want to index non-content pages including admin pages and pages that ask you to login. Putting wp-admin in robots.txt is better for SEO because it will usually prevent the page from being indexed. It is possible that an attacker will do a Google for all sites that have wp-admin in the URL. Keeping that page on your site out of the Google ...


2

wp-admin on wordpress is direct entry to your admin panel. That's why google wants you to disallow it. And... in this case, listen to google and srsly, disallow it. It's good practice :)


1

I was in a trouble last few days since my web host was hacked for POST on PHP files. I've been dealing with files with .png extension that have PHP code inside. This is why error checking should be implemented in your upload script, that way, you can test the uploaded file to ensure the data is valid and if the data is not valid, then discard the file ...


1

I had the same problem last week: My amazon server was somehow compromised. I received an abuse report from amazon stating my server was being used in a DDOS attack on a website. When I logged in I found an application /usr/share/tomcat7/breeb was running in memory. I expect there is a weakness in tomcat 7 which means a remote user is able to upload a spam ...


1

Your site is hacked. Somebody likely installed software on your site that is doing the redirects. It is probably also showing some content only to Googlebot. You need to clean up your hacked website. Google has an entire webmaster help section dedicated to hacked sites: https://www.google.com/webmasters/hacked/


5

Reset the account password Since you are the owner of the e-mail account you can always try to reset the password for that Google Apps account. Support center pages There are many pages on Google's support center that deals with this kind of stuff: Reporting Abuse Incidents Deals with this kind of stuff. It says: If you believe that someone else has ...


2

Try this if you have rewrite module installed: RewriteEngine On RewriteCond %{REQUEST_URI} ^(.*)wp-login.php$ RewriteCond %{REMOTE_ADDR} !^xxx\.xxx\.xxx\.xxx$ RewriteRule ^(.*)$ - [R=403,L] replace the xxx's with each octet of your IP address. For example, if your IP address is 111.222.333.444, then replace RewriteCond %{REMOTE_ADDR} ...



Top 50 recent answers are included