Suggestions and BWPS 4.0

  • Resolved Bit51 (part of the iThemes family)

    (@bit51)


    11 years, 2 months ago

    Hi everyone,

    Thank you all for the support of this plugin! I am working hard on the next major release which I hope to have out by WordCamp Miami in early April. So far I have the folloing on the feature list:

    * Import-export function
    * Better division of basic/advanced options
    * Two-factor auth
    * Admin action logging
    * Improved documentation and commenting
    * Improved performance of existing features
    * A new way of providing support

    As for the latter, it’s no secret that I haven’t been monitoring these forums often and, frankly, I do not plan to change that in the future. What I will be moving to will be a paid support option similar to the models in place by W3 Total Cache and other plugins. In this scenario the forums themselves will continue to function as a community supported knowledge base with this single suggestions thread monitored by me.

    In addition, if anyone would like to contribute features, code, etc I am in particular need of IIS compatibility as I don’t have the experience with IIS to add it myself. I’ve moved development of the project to GitHub at https://github.com/ChrisWiegman/Better-WP-Security and will gladly include any provide patches or additions while providing proper recognition to those who contribute.

    Finally, Please keep your comments in this thread to suggestions only. If you are stuck search the forums, look at the faq, or get in touch with me outside of the forums. I’ve been hard at work providing free support to anyone who asks and I do not plan on changing that model until the 4.0 comes out.

    Sincerely,
    Chris Wiegman
    Developer
    Better WP Security

    http://wordpress.org/extend/plugins/better-wp-security/

Viewing 15 replies - 31 through 45 (of 81 total)
1 2 3 4 5 6
  • Viktor Nagornyy

    (@viktorix)

    11 years ago

    Hey Chris,
    We might be able to help with IIS integration. One of our clients uses IIS based hosting, so we had to figure out a way to re-write htaccess to be compatible with web.config rules. We did get it to work with custom login url and blocking bad agents. Now trying to figure out how to integrate it with BWPS.

    What’s the best way to get in touch with you once we have a working solution for IIS? Github forum maybe?

    Thanks,
    Viktor

    benbritten

    (@benbritten)

    10 years, 12 months ago

    I just wanted to second archerdata’s suggestion that if anyone tries to log in using the ‘admin’ username then their IP should be immediately banned for some period of time.

    Thread Starter Bit51 (part of the iThemes family)

    (@bit51)

    10 years, 12 months ago

    Hi viktorix,

    I would love the help on this (and would of course offer proper credit). Please email me via the contact form at bit51.com and we can discuss it further.

    Plippers

    (@plippers)

    10 years, 11 months ago

    I’d like to throw a vote in for a means of stopping the apple touch icon lockout fun and games.
    I test the responsiveness of a few sites and as I have a dynamic IP, pretty much daily lock myself out of a site.

    The solution that immediately comes to mind would be (like the IP 404 Whitlist) to have a 404 error whitelist so we could list all the junk apple (now android too?) portable devices search for.

    They aren’t security related 404’s and as there is no real solution round them. It kinda leave the two choices as: Disable/slacken 404 detection (less security) or, live with it (More visitors locked out) Neither is great.

    This is all to the best of my knowledge, I stand corrected regularly… 🙂

    originalconcept

    (@originalconcept)

    10 years, 11 months ago

    Suggestion:

    Add hotlinking protection is .HTACCESS

    RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)?mydomain.com/.*$ [NC]
RewriteRule \.(gif|jpg|js|css)$ - [F]

    And you should add definitely all features of this plugin, some you dont have:

    you would be invincible.

    muerta

    (@muerta)

    10 years, 11 months ago

    suggestion:

    dunno if it’s possible but a whitelist for specified files or plugins in the option “Display random version number to all non-administrative users” would be great, because it removes the google api key, on the other hand its handy to not display version numbers.

    as usual, thanks for your time and work 🙂

    W-P-Zar

    (@carbashop)

    10 years, 11 months ago

    suggestion:
    When installing WordPress in a directory (not root)
    Example: http://www.example.com/directory/

    according http://codex.wordpress.org/Giving_WordPress_Its_Own_Directory

    You have to copy the htaccess to the root
    Ok?
    Better WP Security does not modify the .htaccess in root
    Just edit the .htaccess in the WP installation directory
    Does that not right?

    other plugins (wp-super-cache) if they perform that task!

    When I change something in Better WP Security, I have to connect the 2 .htaccess and place it in root

    Is that correct?

    jpw94

    (@jpw94)

    10 years, 11 months ago

    Great plugin.

    I would love to see the backup feature to be able to upload the back automatically to Amazon S3 or to another destination.

    inthylight

    (@inthylight)

    10 years, 11 months ago

    A suggestion for the two-factor authentication feature you mentioned: add Clef integration as one of your two-factor options.

    Thanks for the great plugin!

    inthylight

    (@inthylight)

    10 years, 11 months ago

    A small “bug” report: the Site Lockout Notification e-mail contains two typos (i.e., missing a space before the opening parens around the IP and “parmenently”).

    RobinInTexas

    (@robinintexas)

    10 years, 11 months ago

    My suggestion is to change the last line of the htaccess blacklist from

    RewriteRule ^.* – [F,L]

    to

    RewriteRule ^.* http://%{REMOTE_ADDR} [L]

    Because it puts a little less load on the server:

    1. Just a header message sent
    2. No error page sent
    3. No entry to the Apache error log
    merlin_ulg

    (@merlin_ulg)

    10 years, 11 months ago

    Hello! Good plugin!
    My suggestion: now i changed administrator login “admin” to other. And my login nickname hidden anywhere on site. But in RSS feed name is shown. I will hide or replace this by some string (e.g. “Author” or “Freddy”).
    Thanks in advance.

    wp.Man

    (@wpman-1)

    10 years, 11 months ago

    FEATURE REQUESTS…

    i think several of the features contained in ecSTATic would make very good additions to a security plugin, particularly…

    * detection, logging and banning of long URI’s to help fight injections
    * detection, logging and banning of requests, such as ‘/wp-login.php’
    * detection, logging and banning of multiple requests from the same IP within a specified time in seconds (flooding, DOS)

    in addition i think better logging would be a good idea…

    * ability to sort log data by clicking on column header
    * new column added to log data with button to ban IP

    again, i think it would be well worth checking out ecSTATic for its detection and blacklisting features which i think are really quite good

    Michael Ecklund

    (@michaelecklund)

    10 years, 11 months ago

    Incorporate The Ultimate htaccess Blacklist from Perishable Press.

    GermanKiwi

    (@germankiwi)

    10 years, 11 months ago

    I would like the “Enable strong password enforcement” setting on the Tweaks tab, to be configurable to alternatively allow “Enable medium password enforcement”.

    In other words, I can decide if the minimum password strength should be strong or medium. For my own personal needs, “strong” is a bit too strong, and medium is quite sufficient; in any case, I feel that this should be my choice as the administrator. 🙂

Viewing 15 replies - 31 through 45 (of 81 total)
1 2 3 4 5 6
  • The topic ‘Suggestions and BWPS 4.0’ is closed to new replies.