redsand

@pasmith: Sorry to hear man. One suggestion: Use the WP-Rollback Plugin, and roll WordFence back to version 6.0.25. We did that and we’re on 4.5. If that doesn’t work, then export your settings (the bottom of the WordFence options page), save that API somewhere safe, and uninstall/reinstall the plugin from scratch. Then import the API key in with your settings. (Unless you have a DB backup from yesterday or so…that would be best.)

Even with WP 4.5 we’re not thrilled with the whole new WAF, and how it takes over the admin with no way to make the nags go away (even once you deactivate). I love WF but this whole WAF feature needs a bit of tweaking before it’s ready for primetime.

Hope that helps! 🙂

@jan Dembowski: Revealing usernames actually is a security risk, and those saying that it’s 50% of what a hacker needs to access to access your site (at least that particular entry point) are 100% correct.

I’ve had to address this issue a lot lately, so here I go again. I apologize in advance if any of this offends you. Just know that I don’t mean any of it personally.

Security is not binary. It is not on or off, black or white.

Security is about reducing risk and lowering the statistical probability of a successful attack. You can never eliminate risk fully, and there is no such thing as 100% impenetrable security, even with the best measures in place.

It should never, ever be said, “that’s not a security risk,” because anything, when leveraged properly, can be a security risk.

The only way security could ever be binary, on or off, black or white, was if there were truly only one entry/exit control point, and you could devise a perfectly secure system. That will never exist. ANYTHING can be broken into…ANYTHING can be hacked. There is always someone out there with the skills to beat your best defenses. It is extremely important for system administrators, web developers, and security experts to humbly admit that.

While I was deployed, we had to be keenly aware of that fact as our lives depended on it. If we ever forgot that, or started to adopt an attitude of hubris, it would have been game over. The unit that replaced us when we came home adopted that exact attitude of hubris and ignored what we taught them, and they lost a lot of guys in the first few weeks they were there. Physical security, communications security, and IT security require understanding the exact same principles and require the same kind of vigilance.

I’ve personally discovered and reported major security flaws in tons of “secure” systems. In the last two weeks alone, 2 of those were web hosting companies.

Because it is about reducing risk, security is more accurately measured in percentages. Because it’s not possible to ever hit 100%, no system should ever be labeled “secure”.

It’s not a security flaw and has never been one.

That is absolutely incorrect, and saying it doesn’t simply make it true. If you’re going to say things like that, then you need to back it up with some references, quote some security experts with a proven track record. (And they can’t be associated with WordPRess…no cheating.) If you can find something to back that up , I will gladly eat my words and send you a case of your favorite beer. 🙂 You won’t find it though.

Think of username and password as two individual keys that are needed to access a site, because that’s exactly what they are. You have to have both to enter.

• Can you enter if you only have the password? No
• Can you enter if you only have the username? No

It’s mathematical and has to do with the probability I mentioned above.

If an attacker were trying to brute-force your site, they would have to try a nearly infinite combination of usernames and passwords. Even though there are only two keys needed, there are additional variables of each key that can change that increase the difficulty.

For one, the attacker does not know the length of the username key or the length of the password key. With each additional character added to the length, the difficulty is increased exponentially because the number of combinations to test is increased exponentially. The difficulty is also affected by what character sets are used. For example, does it use only lowercase, lowercase and uppercase, numbers, symbols, alternate alphabets and character encodings?

Without the username, it has a low probability of success, and would require too much bandwidth and time, so it’s not practical. Most brute password attempts are not doing this though. They test a combination of commonly used default usernames, and then when WordPress gives them the feedback that they hit the right one (because it does reveal this), then they go to work on the password. If it isn’t any of those, they will move on.

Once the attacker has the correct username, the difficulty has been reduced exponentially, and the likelihood of success has increased exponentially. So in reality, getting the username is closer to having 75% of what is needed to be successful.

The other thing to keep in mind is that whether in real life or the digital world, the longer an attack takes, its likelihood of success drops exponentially over time. Attackers have to get it done quick before they get discovered, blocked, caught, etc…or before it becomes too expensive (bandwidth, etc) to be practical.

Any reputable security person would tell you that the items you cannot protect have nothing to do with security.

I’m not sure what “reputable” security people you’ve been talking to, but that isn’t even close to accurate. There are no items you cannot protect. If it’s in your possession, you can protect it.

Again, if you back up a statement like that with references, please do.

Zero, that’s like arguing that your company’s address is half of letting people in the front door.

Yes and no. Technically, it is absolutely correct that limiting knowledge of a location would reduce the possibility of an attack. (I’m a combat veteran, and know what I speak of here.) Where your analogy falls short is that having an address does not provide access where username/password combos do provide access. Unless you have an unusual setup at your building, the key and door is a single key entry system. That would be like a site that required a password, but no username. (One key)

It’s the doors with locks that keep them out.

This also is a false security idea. A lock is a single key, so it is weak security. Saying that your building is secure because it is locked, makes an assumption that: 1) The door is the only way in, and 2) that the attacker is too polite to kick your door in. There are a million ways into a building (windows, conduits, etc), and attackers are never polite (whether thieves or hackers).

You don’t think a company publishing their street address is a risk, do you?

Again yes and no. When you consider that security involves probability, then technically it IS a risk, because limiting knowledge of the address would reduce the likelihood of a successful attack. But there is an opportunity cost associated with that…it would do more harm than benefit to your business because no one would know where to find you to buy your excellent wares or services. Same thing with a website. Keeping your site address secret would only harm your business, so that’s not practical. So it’s not that publishing your street address is NOT a risk, but rather, acknowledging that it IS a risk (however potentially low), deciding whether risks outweigh benefits or vice versa and then figuring out ways to mitigate that risk.

If you want to hide the author slugs and URLs then you can. But not hiding them doesn’t make anyone’s installation less secure.

Again, this is simply not true. Security best practices require preventing data leakage and limiting information to those who need it.

I realize I’ll probably get banned and exiled to the equivalent of WordPress.org Siberia, but this all needs to be said. No offense is meant.

I just find that too many people associated with WordPress have adopted some really unhealthy and inaccurate security ideas, and are passing them around like they are absolute truth and cannot be challenged.

It would be one thing for you all to keep saying these things if WordPress had a great security track record, but every single version released in the last couple years (with the exception of the very most recent minor releases in each branch) has had major security vulnerabilities discovered within weeks. So you can’t keep saying these things…they are simply not true.

It’s time for the WordPress community to start taking security much more seriously, time for some increased education on security, and time for a dramatic hardening of the WordPress core.

Come to think of it, this thread would probably make an excellent starting point for a blog post.

@12ax7: Or you could just set a proper User-Agent in wget. Problem solved. 🙂

@jeff: Determining if it’s internal isn’t too hard…usually just checking if the request is from the same IP C-block as the website IP will do the trick. (Given that you’ve got a good IP detection script that gets real IPs in cases of WAFs/proxies/etc.) Let me know if you think of a case where that wouldn’t work, or would cause an issue.