WordPress Security Plugins?
What WordPress security plugins are the best? I've been using Wordfence for a while and don't have any complaints except for the price. However, I'm curious if any of the other ones (All In One Security, Solid Security Pro, etc.) are better.
Thanks in advance for any info!!
Most security plugins are security in name only. They also have a flaw by design. By the time they get to perform, the attacker is already on your server and site. You should start on your network edge to block undesirable traffic before it ever get to your server.
I use Cloudflare WAF rules. That doesn't mean you shouldn't or can't use something on your site, but a solid set of WAF rules will do most of the work for you.
I posted a video on YouTube about how I'm doing this if you'd like to see how it works. This requires that you use Cloudflare for DNS, but you only need the free plan for the rules I share.
https://youtu.be/-2qt31jUjN8
William Beem Thanks! Great information. Appreciate it.
Note: when incoming traffic on our server is not filltered by CF IPs then "anybody" can use Windows hosts file tick (no need for KaliLinux etc) - You can try it out and add a simple entry:
xx.xx.xx.xx YourDomain.comwhere xx.xx.xx.xx is your server IP.
In this case CF protection (WAF, ZeroTrust etc) wont work at all. If you dont have your server protection and/or wordpress basic security settings implemented then you might be "easy" target.
I am adding this info just to let other users know (not mentioning vhost and other vector attacks here).
The Windows hosts file is a plain text file that maps hostnames (like: yourDomain.com) to IP addresses. This allows your computer to resolve domain names without needing to query the internet's DNS servers. The hosts file is typically located in C:\Windows\System32\drivers\etc\hosts
Mat When is incoming traffic not filtered by CF? CF proxies the IP address, so attackers won't have that information unless you publish it somewhere.
As I said, there is nothing wrong with having a security plugin on the site as another line of defense, but I think the WAF rules are going to handle 99.999% of your attacks.
William Beem Yes. CF will stop many bots/automated tools unless someone will find the destination IP.
My main point was that when someone has the IP then CF wont help (there wont be any CF logs etc).
How to discover someone server IP?
That is another topic and there are many manual and automated ways - I could mention few hints (like CloudSniffing with "hosting" IP range - random list ex. VULTR, domain registrar DNS entries nslookup, DNS Historical entries checking, using the same hosting for email instead of external one etc but this is not a stress testing workshop). Thats not the point here...
Mat If only there were such a thing as perfect security.
William Beem My old password system was near perfect: 100% inconvenient & ultimately locked myself out! A triumph of security. 😭
Just adding awesome explanation by Andre Daus of using and configuring CF including limiting CF IPs range for incoming traffic (ex: SSH) - video starting from 21min - if anybody wants to protect SSH here is the way how to do it and why it is obligatory to prevent some vectors attack