Security against hackers

  • mafe65

    (@mafe65)


    1 week, 4 days ago

    I have some own and some client WP sites running. Suddenly I got emails that for my user the password reset was requested, although nobody did this. So I started to have a look at the security.

    How comes that it is possible for hackers to get a list of users?

    After installing some plugins I realized that Vulnerability checks are done the whole time, bots are trying to log in all the time, in one event they even managed to have an application password set up and posted their stuff under a users name.

    WP seems to be so vulnarable in so many ways, why is that?

    Why do I have to avoid things myself through simple htaccess entries (block checking user IDs, switch off XML-RPC, avoid search folders, avoid XSS attacks, content sniffing and klick-jacking) or by using external plugins to block brute force or bots and to block spam?

    Why do I have to change the functions.php myself to switch off the author archive, change REST-API behavior, change login error messages (“User ID OR password is wrong”), get rid of oEmbed discovery links in the source text?

    This all should be incorporated already in a good content management system I think…

Viewing 4 replies - 1 through 4 (of 4 total)
  • Moderator t-p

    (@t-p)

    1 week, 4 days ago

    look into security plugin like https://wordpress.org/plugins/wordfence/

    Thread Starter mafe65

    (@mafe65)

    1 week, 4 days ago

    Thank you, this is exactly what I don’t want to have to do…

    attekosonen

    (@attekosonen)

    5 days, 6 hours ago

    Security plugins can be a good solution but if you do not wish to use these you should also look at hosting providers that already offer security features and security guarantees for your site.

    Thread Starter mafe65

    (@mafe65)

    5 days, 5 hours ago

    Thank you, I have a good hoster, with latest PHP and Database version, all the rest is on my own – which I definitively prefer in contrast to hosters that regulate too much and pre-setup all kind of stuff which is not needed and slows down performance.

    As written in my post, there are easy ways to stop hackers by having relevant lines in htaccess and functions.php, which should be standard, so that users don’t have to care about it and no additional plugins are needed which often slow things down or create issues with privacy.

Viewing 4 replies - 1 through 4 (of 4 total)

You must be logged in to reply to this topic.

Tags