Skip to main content

General

Fluent Auth

I discovered FluentAuth purely by chance. Do you have any other hidden Fluent family plugins? 😂

You should at least link to all of them, Shahjahan Jewel :)

  • 1 like
  • 3 comments

Mat ‎

Linda Rando there are many of Fluent Plugins - some are in development stage (secret/surprise) and some very old haha

Check the WP repo to find some examples like fComments haha and GDPR Cookie Consent (a little bit old)

I hope you know about: Fluent Snippets already - here is a link how to use it:

https://youtube.com/watch?v=-bQPZ23LSdQ

Jorge de los Reyes

Hey Mat ‎ , would you mind letting me know if Fluent Auth will be enough for a site security or if Wordfence or any other Firewall is recommended? I have been using both Wordfence and Fluent Auth for a while, being aware they have duplicated functions 😅

Mat ‎

Jorge de los Reyes 

I can suggest to use Cloudflare (Free Tier) and it might be enough for most regular cases to stop bad actors/scanning bots (CF has 5x WAF rules you can configure additionally but also it is a CDN. For example you can set WAF rule where /wp-admin or/phpmyadmin url can be blocked outside your country or IP etc).

If you use a VPS and CF it is recommended to allow traffic only from CF IP range (so it won't be possible to skip CF routing). If you don't want to use CF because you have a local hosting and local users only then you need to have a good hosting (with great hosting support and hosting WAF)

FluentAuth with 2FA enabled is a must (at least for the elevated access accounts like: Admin).

I think Wordfence can be disabled remotely if you know the special link - so I am not sure it this is a good WAF or a security plugin.

Anyway.. Hosting with good firewall is a good way to go.

If you are looking for a plugin other then Wordfence (I don't use it) then you might check: BBQ Pro (LTD)

If you open your WP to external users (other then your stuff) then it might be hard to prevent some listings, enumerations etc and it all depends on your WP users hacking skills - frequent backup will give you a chance to restore WP fast.

Example: try to use the /wp-json url with yourDomain.com to check some listings:

Users list:

yourDomain.com/wp-json/wp/v2/users

Plugin list:

yourDomain.com/wp-json

Ps. If any bad actor will get your users logins/emails then phishing might be much easier then breaking in to your wordpress for example via installed plugins and/or wp db.

Ps2. Basic WP hardening link