WordPress is the most common content management system in the world and is widely used in the website. Its easy to setup and configure and anyone without having expert level of website development can create the pages and make the website live in a very short time. Many things in WordPress comes with default installation and needs to be secure by the admin of the website for that a very good and easy to install and configure plug-in is available which will configure the WordPress in a very secure way.
All in One WordPress Security and Firewall Plug-in can help you configure your website in a most secure way. A brief feature list of this plug-in is given as under:
User Accounts Security
- It will check if there is a user name “admin” available in the website. You have to replace it with some other name to protect it from hackers because admin is the most common administrator user name
- Identical login and display name must be replaced with some other to protect it from the hackers because if a person knows the user name can try different password combinations.
- Create a very strong password
User Login Security
- Protect against “Brute Force Login Attack”. User must be locked down after certain number of password retries.
- Force logout of all users after a configurable time period
- Monitor/View failed login attempts
- Monitor/View the account activity of all user accounts on your system
- Ability to automatically lockout IP address ranges which attempt to login with an invalid username.
- Ability to see a list of all the users who are currently logged into your site.
- Allows you to specify one or more IP addresses in a special whitelist. The whitelisted IP addresses will have access to your WP login page.
- Add security captcha to All WordPress forms like admin login, forgot password page.
- Enable manual approval of WordPress user accounts. If your site allows people to create their own accounts via the WordPress registration form, then you can minimize SPAM or bogus registrations by manually approving each registration.
- Schedule automatic backups and email notifications or make an instant DB backup whenever you want with one click.
- Prevent other sites from displaying your content via a frame or iframe.
File System Security
- Set file security
- disable file editing from the WordPress administration area.
- Secure readme.html, license.txt and wp-config-sample.php files of your WordPress site.
htaccess and wp-config.php File Backup and Restore
- backup your original .htaccess and wp-config.php files in case you will need to use them to restore broken functionality.
- Modify the contents of the currently active .htaccess or wp-config.php files from the admin dashboard with only a few clicks
Blacklist Functionality
- Ban users by specifying IP addresses or use a wild card to specify IP ranges.
- Ban users by specifying user agents.
Firewall Functionality
This plugin allows you to easily add a lot of firewall protection to your site via htaccess file. An htaccess file is processed by your web server before any other code on your site. So these firewall rules will stop malicious script(s) before it gets a chance to reach the WordPress code on your site.
- Access control facility
- Instantly activate a selection of firewall settings ranging from basic, intermediate and advanced
- Enable the famous “5G Blacklist” Firewall rules
- Forbid proxy comment posting
- Disable trace and track
- Deny bad or malicious query strings
- Protect against Cross Site Scripting (XSS) by activating the comprehensive advanced character string filter. or malicious bots who do not have a special cookie in their browser. You (the site admin) will know how to set this special cookie and be able to log into your site.
- WordPress PingBack Vulnerability Protection feature. This firewall feature allows the user to prohibit access to the xmlrpc.php file in order to protect against certain vulnerabilities in the pingback functionality. This is also helpful to block bots from constantly accessing the xmlrpc.php file and wasting your server resource.
- Ability to block fake Googlebots from crawling your site.
- Ability to prevent image hotlinking. Use this to prevent others from hotlinking your images.
- Ability to log all 404 events on your site. You can also choose to automatically block IP addresses that are hitting too many 404s.
Brute force login attack prevention
- Instantly block Brute Force Login Attacks via our special Cookie-Based Brute Force Login Prevention feature. This firewall functionality will block all login attempts from people and bots.
- Ability to add a simple math captcha to the WordPress login form to fight against brute force login attacks.
- Ability to hide admin login page. Rename your WordPress login page URL so that bots and hackers cannot access your real WordPress login URL. This feature allows you to change the default login page (wp-login.php) to something you configure.
- Ability to use Login Honeypot which will helps reduce brute force login attempts by robots.
WhoIs Lookup
- Perform a WhoIs lookup of a suspicious host or IP address and get full details.
Security Scanner
- The file change detection scanner can alert you if any files have changed in your WordPress system. You can then investigate and see if that was a legitimate change or some bad code was injected.
- Database scanner feature can be used to scan your database tables. It will look for any common suspicious-looking strings, javascript and html code in some of the WordPress core tables.
Comment SPAM Security
- Monitor the most active IP addresses which persistently produce the most SPAM comments and instantly block them with the click of a button.
- Prevent comments from being submitted if it doesn’t originate from your domain (this should reduce some SPAM bot comment posting on your site).
- Add a captcha to your wordpress comment form to add security against comment spam.
