Installation Problem Godaddy Shared Hosting

Hi,

Can you check this similar discussion: goddady installation.
Also: PHP INI files and Goddady’s hosting.

We do not plan to make any new benchmarks, because the results will be identical. If you use a plugin that requires to have WP + the DB + the plugin(s) loaded, it will kill your server if you face a distributed attack.

I do not know about any issue with the Sucuri plugin. NinjaFirewall works before WP and its plugins are loaded so, in most cases, there is no conflict. If you see any issue, simply report it here.

I do not recommend at all to use the Pro edition to protect one or more WP sites: it has much less options/features and, most important, it lacks all WP security rules! So the WP edition is really your best bet. If you have 2 or more sites, you need to install one copy per site.

You are running CGI-FCGI, therefore you need to use a PHP INI (I assume “php.ini”). But it seems that your Goddady hosting account will never let you use one in a subfolder.

It is still possible to bypass such restriction. Check our blog about installing multiple copies of NinjaFirewall with HHVM (which allows only one php.ini file), specially the “Multiple-site installation” chapter: Installing NinjaFirewall with HHVM.
You will need to create the “php.ini” file in the main public_html folder. Regarding the “route.php” script, you could create it in the same folder, or inside the WP subfolder, it is not too much important.
During the installation, select HHVM as the “Server and SAPI”.

However, if one day you want to uninstall NinjaFirewall, remember that you will need to remove the instruction from the PHP INI first, and then to uninstall it from the WP admin dashboard, because the uninstaller will not be able to find the PHP INI in the parent directory.

I don’t think they will install HHVM.
My example was just to show that your case is very similar and that you can use our blog article to solve your issue.

Assuming that:
Your document_root is: /var/chroot/home/content/XX/XXXXXXX/html
Your WP is installed in: /home/content/XX/XXXXXXX/html/Wordpress/

1) Start NinjaFirewall installer from your WP admin dashboard.
2) When you reach the “System configuration” page, select “Other + HHVM” and click “Next Step”.
3) Create a “/var/chroot/home/content/XX/XXXXXXX/html/route.php” script, and add the following code to it:

<?php
// Prepend the firewall for the /Wordpress/ sub-folder:
if ( strpos($_SERVER['SCRIPT_FILENAME'], '/home/content/XX/XXXXXXX/html/Wordpress') !== false ) {
   // Add the full path to NinjaFirewall firewall.php:
   require('/home/content/XX/XXXXXXX/html/Wordpress/wp-content/plugins/ninjafirewall/lib/firewall.php');
}

Edit the two “/XX/XXXXXXX/” occurrences with the correct paths.

4) Create a “/var/chroot/home/content/XX/XXXXXXX/html/php.ini”, and add the following code to it:

; NinjaFirewall: load route.php
auto_prepend_file = /home/content/XX/XXXXXXX/html/route.php

Here again, replace the X’s with the correct path.
Note: maybe you will need to use “/var/chroot/home/….” rather then “/home/…”

5) Go back to NinjaFirewall installer and click on the Test NinjaFirewall button.

If that does not work, you may need to rename the “php.ini” to “.user.ini” or “php5.ini”. Also, as mentioned on Goddady’s PHP INI page, you may need to wait a couple of minutes after making changes to the INI files.

If you enable “Always ON”, it will always block any access to the wp-login page and will prompt you for the user/password defined in the Login Protection page. That works before WordPress is loaded, so that won’t slow down the site: it can handle a few thousands of HTTP request per second.

A very small brute-force attack would be at least around 5 POST requests/10 seconds. Usually, it is much higher than that.

If you are the only person who can log into the dashboard, set it to “Always ON” preferably.

More or less like a .htaccess, but it does not use any system file, and works with any Unix-based HTTP servers. It also whitelist you for a while (using PHP session), so that it will not ask you again for the password if you log out and then log in 10 minutes later.

A custom login form/plugin may not always need to use the wp-login.php script. It can manage the user authentication and redirect him/her to /wp-admin/ folder.
NinjaFirewall only deals with the wp-login.php script.