Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WordPress 5.2: Mitigating Supply-Chain Attacks

paragonie.com

Post reply on HN
Print view View original

1–10 of 39 posts

Re: WordPress 5.2: Mitigating Supply-Chain Attacks

#5

Post by someexgamedev »

I set up a WordPress site for a family member a couple years ago and threw wordfence on there just to see what the ecosystem is like. I get near daily alerts of attempted hacks mostly from Eastern Europe. Most common thing is trying to brute force the login page.

Any improvements to WordPress security are welcome. It's got such a huge target painted on its back. Reminds me of windows in the 90s.

As for what I learned, I would move the admin login page and disable common usernames like admin and anything derived from the site url. Probably stop 90% of attacks just with that.

Re: WordPress 5.2: Mitigating Supply-Chain Attacks

#6

Post by zigzaggy »

someexgamedev wrote: post #5

I set up a WordPress site for a family member a couple years ago and threw wordfence on there just to see what the ecosystem is like. I get near daily alerts of attempted hacks mostly from Eastern Europe. Most common thing is trying to brute force the login page. Any improvements to WordPress security are welcome. It's got such a huge target painted on its back. Reminds me of windows in the 90s. As for what I learned…

That’s good info, thanks. I just happen to be looking into WP security right now.

Would you recommend wordfence in addition to the changes you mentioned?

Re: WordPress 5.2: Mitigating Supply-Chain Attacks

#8

Post by xenospn »

zigzaggy wrote: post #6
someexgamedev wrote: post #5

I set up a WordPress site for a family member a couple years ago and threw wordfence on there just to see what the ecosystem is like. I get near daily alerts of attempted hacks mostly from Eastern Europe. Most common thing is trying to brute force the login page. Any improvements to WordPress security are welcome. It's got such a huge target painted on its back. Reminds me of windows in the 90s. As for what I learned…

That’s good info, thanks. I just happen to be looking into WP security right now. Would you recommend wordfence in addition to the changes you mentioned?

I highly recommend wordfence. I have it set to immediately block anyone after a single failed login attempt.

Re: WordPress 5.2: Mitigating Supply-Chain Attacks

#9

Post by kijin »

xenospn wrote: post #8
zigzaggy wrote: post #6

Earlier quoted context omitted.

That’s good info, thanks. I just happen to be looking into WP security right now. Would you recommend wordfence in addition to the changes you mentioned?

I highly recommend wordfence. I have it set to immediately block anyone after a single failed login attempt.

It's fairly resource-intensive, though. I've seen whole servers brought to their knees because of plugins like WordFence -- an unintentional DoS, so to speak. Many of the defenses employed by WordFence would be orders of magnitude more efficient if implemented at the level of the http daemon or firewall. Unfortunately, WordPress plugins must cater to the lowest common denominator, shared hosting.

Re: WordPress 5.2: Mitigating Supply-Chain Attacks

#10

Post by xenospn »

kijin wrote: post #9
xenospn wrote: post #8

Earlier quoted context omitted.

I highly recommend wordfence. I have it set to immediately block anyone after a single failed login attempt.

It's fairly resource-intensive, though. I've seen whole servers brought to their knees because of plugins like WordFence -- an unintentional DoS, so to speak. Many of the defenses employed by WordFence would be orders of magnitude more efficient if implemented at the level of the http daemon or firewall. Unfortunately, WordPress plugins must cater to the lowest common denominator, shared hosting.

If what you’re dealing with is thousands of attempted brute force attacks on a daily or weekly basis, a wordpress plugin might not be the solution.
Post reply on HN