@todditron,
We just are working with monstrous Frankenstein-like abomination of a site that we inherited from another developer. My guess is the plugin would work great on any site that vaguely resembled a traditional WordPress site.
LOL, priceless description. ?? I hear you. Definitely have worked on a few of those. No worries…let us know if you ever do need help.
@ericr23:
The bottom line in preventing the vulnerability, is to make sure that your site does not allow requests to your site with bad ‘Host’ headers (IP address, secondary domains, etc). If you can’t do it any other way, you can add the following 3 lines to your main site’s .htaccess file. (This is an old trick used for SEO, but it also takes care of this security issue, so it kills two birds with one stone.)
First, decide what your site’s canonical hostname is, that is, whether you want people to access it via the www or non-www version.
If your site’s canonical hostname is www.yourdomain.com, the code would look like this:
RewriteEngine On
RewriteCond %{HTTP_HOST} !=www.yourdomain.com
RewriteRule ^/?(.*)$ https://www.yourdomain.com/$1 [R=301,L]
Notes:
- Place this code near the top of your
.htaccess file, and before the WordPress code block starts. # BEGIN WordPress
- Replace
www.yourdomain.com with your sites preferred (canonical) domain. (www vs. non-www)
- If your site does not use https (SSL/TLS), then replace the “https” with “http”.
- If your
.htaccess already has RewriteEngine On, then you can skip that line, as it only needs to be included once, before the first RewriteCond/RewriteRule set. (Having it twice should not cause errors — it just isn’t necessary, so it’s more efficient to only include it once.)
That’s all. It’s a pretty easy fix. The best way is to set the UseCanonicalName directive in your Apache config, but if you don’t have access to that (eg on shared hosts), or isn’t working, this will work in pinch.
Hope that helps!
– Steven
