Wordpress: Difference between revisions
From DWIKI
m →FAQ Tag: wikieditor |
Tag: wikieditor |
||
| Line 41: | Line 41: | ||
Require all denied | Require all denied | ||
</Files> | </Files> | ||
===In nginx=== | |||
location /xmlrpc.php { | |||
deny all; | |||
return 404; | |||
} | |||
to keep it out of logs | |||
location /xmlrpc.php { | |||
deny all; | |||
log_not_found off; | |||
access_log off; | |||
return 404; | |||
} | |||
=FAQ= | =FAQ= | ||
Revision as of 10:41, 7 January 2026
Links
Documentation
- http://codex.wordpress.org/Main_Page
- https://plugins.svn.wordpress.org/wp-fail2ban/trunk/filters.d/wordpress-hard.conf
Howto
Brute force monitoring
Check CSF
Make slugs work
In setttings->permalinks select custom structure /%postname%/ and make sure you have AllowOverride All in apache config
Get wordpress version on CLI
grep wp_version wp-includes/version.php
Show successful logins
grep 'wp-login.* 302 ' accesslog
Stop xmlrpc scanning
In .htaccess
# Block WordPress xmlrpc.php requests <Files xmlrpc.php> order deny,allow deny from all allow from 111.222.333.444 </Files>
or
<Files xmlrpc.php>
Require all denied
</Files>
In nginx
location /xmlrpc.php {
deny all;
return 404;
}
to keep it out of logs
location /xmlrpc.php {
deny all;
log_not_found off;
access_log off;
return 404;
}
FAQ
What is this /wp-cron.php?doing_wp_cron in logs?
Access denied for user 'username_here'@'localhost'
Someone trying to access config-sample.php
Stop prompting for credentials on updates
In wp-config.php:
define('FS_METHOD', 'direct');
Upload or install keeps giving "Connection Information" dialog
Seems to mean wordpress can't write somewhere, so it prompts for user with write access rights Check at least:
wp-content/plugins wp-content/themes
multiple sidebars
The ssh2 PHP extension is not available
Install https://en-ca.wordpress.org/plugins/ssh-sftp-updater-support/
How to log in?
In /wp-admin/ !
Upload file and add link to it
Posts->Add new, in editor use "add media"
command line management tool
CLI upgrade
wp core update
Could not fully remove the plugin
Check logs :)
user login history
Settings > User Login History
stop backtrack spam
Or just deselect Allow link notifications from other blogs (pingbacks and trackbacks) on new posts and in database update existing entries:
update wp_posts set ping_status = 'closed';
Error messages
AjaxURL has NOT been defined
fastest cache bug?
