Ninja Firewall with Wordfence and AIOWP

Hi,

A. Brute-force protection:
1. If you are the only person to log in to your admin console, then “Always ON” is your best choice. Otherwise, “Yes, if under attack” should be selected.

2. Renaming the login page does not help at all against a medium/large attacks because, unlike NinjaFirewall, this protection relies on WP which means that it will still need to load WP and the DB during the attack. Also, you really don’t need it with NinjaFirewall.
The firewall will protect wp-login.php and xmlrpc.php too (if the option is enabled).

3. You do have the possibility to select the duration and threshold if you choose “Yes, if under attack”.

B. Firewall:

1.The firewall will block an IP only if it does something wrong. If there is nothing suspicious/dangerous about it, it will not block it.
If you want to block IPs or even add your own code, use the .htninja file for that purpose.

2. You will not need those .htaccess rules because most of them aren’t really useful. For instance, your HTTP server (Apache), will never let anyone accessing a file whose name starts with ‘.ht’. Therefore, there is really no need to add a rule to protect the .htaccess! The wp-config is already protected by NinjaFirewall too.

C. Block PHP access:
It is recommended to keep at least the /wp-content/uploads/*, because that is often the directory where hackers can uploads PHP backdoors through vulnerable plugins.

D. XML-RPC API
It is mostly used by bloggers managing their site from mobile phones for instance (add/edit/update post etc). Because it works exactly like wp-login.php, i.e. it requires a username and password to log in, that makes it vulnerable to brute-force attack too. If you don’t need it, you can block it.

E. File Guard
As indicated in the contextual help, it detects in real time someone accessing a PHP that was modified or created N hour(s) ago.
For instance:
1.upload a new PHP script to your site, then access it with your browser. You will receive an alert immediately.
2. modify an existing PHP script from your site, then access it with your browser. You will receive an alert immediately too.

That is useful because if hackers uploaded a backdoor to your site, they would be detected as soon as they would try to access it.

Hi,

Thanks for the answers.

B. Firewall
2. But WordPress in its official ‘Hardening WordPress’ guide suggests to move the wp-config.php up one directory outside the public_html folder.

C. Block PHP access
I mean protecting everything in the wp-contents folder and the folder itself, as there are themes, plugins etc. in it. And by put protection over will the site work and will people be able to access the website? And how do I add the wp-content folder through the Ninja interface?

E. File Guard
I did create a php file and uploaded into the public_html folder and accessed it through the browser. There was no alert at all.

Kind regards
Ed

Hi,

You can move the wp-config.php wherever you want, but if you do that, you will need to use the .htninja file to tell NinjaFirewall where the file is located.

The protected directories should not block anyone except non-admin user trying to use the TinyMCE WYSIWYG editor.
If you want to add the whole /wp-content/ folder, use the .htninja file. But you will need to be really careful, because blocking that folder is likely going to block plugins or themes.

If you want to test File Guard (or any other security options), you must first log out of WordPress, because the administrator is never blocked by the firewall.

Regarding fileguard, there is a message in the firewall log, Is that the one you are referring to?

By the way I am able to see the files listed in wp-includes folder via the url even though that option is checked for protection.

Thanks

There should be a message written to the log, but also an alert sent to the email address defined in “NinjaFirewall > Event Notifications > Contact email”. But it will send only one email per incident and within the time frame indicated in the File Guard menu page ( N hour(s) ).

If your server is set up to view the directories content, the firewall will not change this behavior. However, if you try to click on any PHP scripts, you will be blocked. The option label is: “Block direct access to any PHP file located in one of these directories”.