gcaleval

@mosso, presumably @webbrewers last response is a backhanded way of telling you CGI is not required to run WordPress.

I’d caution you though that you may find other things that are not directly connected to WP that DO need CGI and troubleshooting after months or a couple of years could be prove difficult.

I honestly don’t know if there are currently any plugins or other WP-related functionalities that depend on CGI. Try disabling it and see what happens.

But be sure to remember that you have it disabled if something comes up in future.

@pubwvj The following htaccess rule will prevent any access to the xmlrpc file from any IP other than your own (obviously you need to swap in your own proper IP address). But if you are using a mobile app to admin your site, you’d have the problem of knowing all the possible IP addresses that may be signed to your phone or device over time. In theory that’s possible, but I don’t know enough about how cell providers assign IPs.

So if you are actually using a mobile app to administer your web site, htaccess rules are not a viable solution. If you are using Windows Live Writer from your home system, then this will work fine until your IP changes at which time you have to FTP in and change the rule for the new IP.

RewriteCond %{REMOTE_ADDR} !^999.999.999.999
RewriteCond %{REQUEST_URI} /xmlrpc\.php
RewriteRule .* - [F]

A better solution to the problem you faced may well be ZBBLock. It does a very good job of catching bad IPs and blocking them from ever getting into WordPress, but manual installation is necessary as no one has created a plugin for it yet.

RE: “does the choice of service provider have any say in whether your site gets hacked or not?”

It’s a controversial issue partly because so many people involved in the WordPress community are also involved in, even employed by, hosting companies, and partly because different people have had very different experiences with different hosts.

My personal experience is that it matters quite a lot.

I have received sustatined attacks on or originating from Dreamhost, GodDadday, Linode and many others — all companies that are generally promoted as being reputable.

The best solution for me was to go to a fully managed VPS with a VPS hosting company.

BUT, with a VPS more responsibility falls on you to ensure security. For example, when you set up WHM, you need to have your checklist that includes enforcing jailed shells, locking down ssh, setting AllowSymLinksIfOwned and numerous other hardening features. With good fully managed VPS host, you will get a lot of key security taken for you just by asking, including installation of mod_security with core rules, mod_evasive to degrade ddos attacks and so on.

Whether or not you are on your own VPS, it is just absolutely vital that you

• keep core, plugins and themes up to date, use WP Updates Notifier
• monitor file changes on the system, use WordPress File Monitor Plus
• control your uploads directory with htaccess to prevent access to non-image files (or other formats you allow)
• use a root htaccess to secure your entire file space

But honestly, the very most important and best strategy is:

1. Expect to be hacked
2. Have a disciplined back up routine that backups up your site and database daily and stores them offline
3. Keep good logs so you can identify when the hack took place.

With just those three things, you can revert your entire site back to a day or three before the attack — and still go through the traditional steps in the links routinely offered by esmi, Jan and others. Do not rely on your host’s promised backup features. Very few of them are accurate. With Hostv, you can configure your own backups which will be stored outside the web space, but could still be compromised if some gains root access privileges. Use that feature, but also do your own backups to your own local desktop or an offsite repository like Drop Box or Google+.

This way you may loose a few days of work that you have to rebuild or abandon, but the bulk of your site will be fine. (Note: if you have basic unix skills, it is very easy to use rsync to backup from your site to your linux box, even if linux is running on a virtual machine on your Windows computer).

Note: I have no connection to Hostv other than as a customer and speak only for my own experience.

If you really want to get fully managed/full administered hosting, you can opt for one of the services that does everything, but typically your design and functionality choices are extremely limited.

+1 MickeyRoush

If the hosting environment is such that user accounts are “being cleared every day” the problem, aside from not being about WordPress, may be about the hosting environment itself.

@technopolic you may find this thread informative:

http://wordpress.org/support/topic/hacked-by-hacker-1?replies=47

Topic title is flatly wrong.

If someone’s WordPress site is down every month because of hacking, it is either (a) a matter of the craftsman and not the tools or (b) there is something about the site content that is particularly inviting to hackers.

Regarding (a)

Of the web site tools available, WordPress is easily the best for security, particularly for the non-technical web admin. Alternatives such as Joomla may have their place, but they do get hacked and often the consequences are sweeping.

If you are a person who wants to do absolutely nothing with your site, nothing such as keeping it updated or subscribing to relevant news feeds for the occasional notice, then you should not operate a web site. Use something like Google Sites or WordPress.com. They give you free blogs and maintain all the code for you, for heaven’s sake. For free.

There are lots of WordPress security hardening tools that require very minimal effort to use and LOTS of free help in using them. I recommend ZBBlock for its extensive security capabilities, but there are easier ones like the recently much discussed Bullet Proof.

So @amarbir, when you change to an alternate platform, please come back and report on the decrease in attacks. I predict there will be none. I own quite a few domains myself with more than a dozen set up purely as traps. They host no WordPress or other actual web site code. Just an index.php page and ZBBlock. They get hit with the same number of attacks as the domains running WordPress. This is not an abstract speculation, it is my real world experience. Certainly lots of the attacks are against wp-login.php, but many target Joomla, lots against phpmyadmin and a dizzy array of form submission attack types.

WordPress is the most widely used so it is to be expected that hackers will include it most heavily in their hacking campaigns. So it’s just factually wrong to talk about

alternative blogging scripts that are not that hacker friendly and are more secure

There are none that accurately fit those criteria.

The 3.5 upgrade did throw one significant curve ball, which was the introduction of square brackets [] into http strings. Which the team identified in the update checklist: http://wordpress.org/support/topic/troubleshooting-wordpress-35-master-list, although one might skip over by accident as it titles that segment as “PerishablePress “5G” blacklist.” Some of my own custom htaccess rules broke as well so some other internals may have changed too. But it was enough to know to trial those rules and I was fully operational in perhaps half an hour.

Regarding (b)

Sites that actively host web mail are highly prized by hackers and therefore highly targeted. Sites that run file sharing are highly prized by hackers and therefore highly targeted. URLs that are posted to Facebook or Twitter result in an immediate flood of automated bot attacks.

Even certain keywords trigger sustained hacking attacks. For example on a site I host there is a mildly amusing article detailing the historical view of garlic as an aphrodisiac. About two months after that article went live, Russian- and Chinese-origin bots starting flocking to the url. It’s been up for a year and they still come even though they are invariably redirected to their localhost. My speculation is that the bots use the results of search engine queries and one of their included triggers is “aphrodisiac.”

Conclusion

There could be a number of reasons why WordPress may not be the right platform for a given person, but security is not one of them.

How do you protect against this vulnerability?

The link I shared from esmi explains how to disable xlmrpc, which is complete protection against the kinds of probes being descrived.

What ticks me is that this is all being presented as a “new” threat. The DoS attack was completely viable against any site allowing pingbacks before 3.5. So was trackback spam. XML-RPC also always supported user credentials — that’s how remote blogging tools like LiveWriter and ScribeFire work — they use XML-RPC to authenticate you into the site.

The only one I’m not sure about is the internal network mapping.

What’s really new is just the fact that it is turned on by default now and you have to take an extra manual step to disable it.

But as someone who watches security threads and has vulnerability alert notices coming from many sources, I get a little angry that some “security” sites take any opportunity to trump up something into a “threat” when it really is at most an annoyance.

I’m convinced that there are many self-proclaimed security experts out there who are more interested in “scaring” up traffic to their sites or selling their services than they are in monitoring, reporting and defending against actual threats.

Here’s a link from esmi explaining how to disable xml-rpc:

http://wpengineer.com/2484/xml-rpc-enabled-by-default-in-wordpress-3-5/

I don’t know if it’s really accurate to call the situation a “vulnerability” since the code is doing exactly what it is designed to do. Trackback spam has always been a concern and there have been countermeasures available.

What I notice is that about a day after the new WordPress core release came out turning xml-rpc on by default the web started getting dotted with all these claims about a “new” vulnerability.

My philosophy is that if you do not need a functionality, then, to the extent possible, you should not have code for that functionality on your site. As more and more gets bolted on to the core, it becomes increasingly difficult or impossible to “only keep what you use.”

Heck, I think lots of what’s in core should be outsourced to addons — like the whole Media Library should be a plugin. But woe betide the community if that were the approach; much tearing of hair and gnashing of teeth would ensue! <chuckle>.

Well I’m pretty that koolwaters is using the NexGen Gallery plugin to display that page. Whether or not not NexGen does what you’re describing, don’t know.

The way I’m understanding your description now does not sound like an easy piece of coding. Essentially you want to create a post, add an image while creating that post and have the image from that post populated to a completely different post, page or gallery, with a backlink to the original post?

Maybe some gallery plugins allow for automatically adding all images from a specified category — that would be one way to get there.

Another would be to use Gravity forms, but that would involve some upfront overhead in coding the form that would replace your post edit screen.

Sorry I couldn’t be of any help. Your question is a good one and if you find an answer please be sure to share it here so the rest of us may benefit from your search.