xlightwaverx

Phew, thanks.

Simply just use Mod Security along with CSF OR setup a password protected /wp-login.php and forget about all this nonsense ??

This will work for Mod Security

SecUploadDir /tmp
SecTmpDir /tmp
SecDataDir /tmp

SecRequestBodyAccess On

SecAction phase:1,nolog,pass,initcol:ip=%{REMOTE_ADDR},initcol:user=%{REMOTE_ADDR},id:5000134
<Locationmatch "/wp-login.php">
    # Setup brute force detection.

    # React if block flag has been set.
    SecRule user:bf_block "@gt 0" "deny,status:401,log,id:5000135,msg:'ip address blocked for 5 minutes, more than 10 login attempts in 3 minutes.'"

    # Setup Tracking.  On a successful login, a 302 redirect is performed, a 200 indicates login failed.
    SecRule RESPONSE_STATUS "^302" "phase:5,t:none,nolog,pass,setvar:ip.bf_counter=0,id:5000136"
    SecRule RESPONSE_STATUS "^200" "phase:5,chain,t:none,nolog,pass,setvar:ip.bf_counter=+1,deprecatevar:ip.bf_counter=1/180,id:5000137"
    SecRule ip:bf_counter "@gt 10" "t:none,setvar:user.bf_block=1,expirevar:user.bf_block=300,setvar:ip.bf_counter=0"
</locationmatch>

ErrorDocument 401 default

Set your 401 error (via .htaccess) to goto a html file that tells the hacker to p*ss off ??

Does it happen to turn the background blue on all the links that deal with WHMCS?

I’m not sure if it is just me, but ever since 3.9.2 every PHP action seems to be 10x slower where after a while, the site just gives a PHP timeout error. Especially with Bulk Delete plugin, but it does it for everything after the update.

Should be somewhat simple:

1. Make WordPress skip sending Activation Email.
2. Make WordPress send email stating that you are in the system, but just need to be activated by an admin (also state that a random password would be generated unless you can save the one the user puts in which would be ideal).
3. Done.

I am having trouble with just the twentyfourteen child theme let alone another theme.

I set up the template like the codex says, but I end up only getting a few posts to show and not the 6000 that are there. Kinda upsetting, but search works, tags works, etc.

All I did was switch things to excerpt only for is_home, is_archive, is_category, is_search, etc etc. Might be something in 3.9.1

Though Fourteen Extended is a viable solution to get the Excerpt to show instead of the whole post, as of WordPress 3.9, it fails with WP-CLI with this error:

PHP Fatal error: Call to undefined function wp_is_mobile() in /home/sitename.com/wp-content/plugins/fourteen-extended/inc/fourteenxt-customizer.php on line 633

Deactivating Fourteen Extended allows WP-CLI to work again.

Just letting you know so you don’t bork your sites after the 3.9 upgrade.