Tag: wordpress

  • 84% of the WordPress site can be hacked: What’s Next?

    CleanTalk is a SaaS spam protection service for Web-sites. CleanTalk uses protection methods which are invisible for site visitors. Connecting to the service eliminates needs for CAPTCHA, questions and answers and other methods of protection, complicating the exchange of information on the site.

    f3ca345cc7ed3cf2bb0e3396a0596528

    If you often read IT-news, you probably already tired of the horror stories about another vulnerability that was found in the popular OS / database / CMS / coffee maker. Therefore, this post is not about the vulnerability and about monitoring how people react to it.

    But first – a few words about “the villain of the peace”. Critical vulnerabilities in popular WordPress blogging engine was found in September by the Finnish specialists from companies with funny name Klikki Oy. Using this hole, the hacker can lead as a comment to the blog a special code that will be executed in the browser of the site administrator when reading comments. Attack allows you to secretly take over the site and do unpleasant things under the admin access.

    Here’s how easy it looks like in practice. Go to the blog by WordPress and enter a bad comment:

    8758dfb3bad2ce0e7a14dd14cdd535db

    Next we see a specially crafted comment allows to bypass checks and conduct XSS-attack:

    b76d8a02ea439497f939a01fd973e02a

    After capturing admin permissions an attacker can run their code on the server that is hosting the attacked blog, that is, can develop an attack on a broad front. Now is the time to remember that just recently 800,000 credit cards were stolen by a bank trojan which was distributed across WordPress sites.

    This vulnerability applies to all versions of WordPress 3.0 and higher. Problem can be solved upgrade engine to version 4, where no such problem.

    And now about the actual reaction. Finnish security experts discovered a vulnerability reported it to the vendor on September 26. At the time of this writing, that is, two months later after finding renewed no more than 16% of users of WordPress (see diagram on the title picture post). What Finnish experts concluded that all the other 84%, that is tens of millions of users of this engine in the world, stay potential victims.

    In fact, the victims will certainly be less because there is a small additional condition for the operation – need the opportunity to comment on posts or pages (default is available without authorization). However, we are interested in here is the lifetime of vulnerability, and in this case it is possible to observe in real time – to monitor the statistics update WordPress here. Although you probably already understand the meaning of these figures: don’t lock the barn door after the horse is stolen.

    We also follow the intruders attempt to exploit this vulnerability “in the wild”. To do this, use a network attack detection based applications PT Application Firewall. The mechanism of intrusion detection based on the analysis of anomalies in this case worked well, and we did not have to add the signature. In other words, PT AF elicited this “0 day” from the very beginning:

    7cb201b9b1a2dd366483e30842c7c00f

    At the moment, the vulnerability exploitation attempts is already found. They can not be called mass – but if you have an older WordPress, should still be updated.

    This text is a translation of article “84% сайтов на WordPress могут быть взломаны: что дальше?” by ptsecurity published on habrahabr.ru.

    Forums and blogs without spam

    CleanTalk is a SaaS spam protection service for Web-sites. CleanTalk uses protection methods which are invisible for site visitors. Connecting to the service eliminates needs for CAPTCHA, questions and answers and other methods of protection, complicating the exchange of information on the site.

  • Accelerate WordPress

    CleanTalk is a SaaS spam protection service for Web-sites. CleanTalk uses protection methods which are invisible for site visitors. Connecting to the service eliminates needs for CAPTCHA, questions and answers and other methods of protection, complicating the exchange of information on the site.

    WordPress in the standard setting is quite slow. By default, the engine does not use some features of modern web for significant acceleration. There are a whole bunch of plugins to optimize WordPress. Let’s put things in order and undergo a major optimization to accelerate WordPress.

    Before we begin, let’s see what shows raw installing WordPress on Pagespeed:

    Result 76 out of 100 is pretty low. Let’s see how you can increase this figure.

    Server part

    Ngnix

    If you’re not already using Nginx, it’s time to move on it. Simple and powerful solution. Configuration for supporting permalinks and static caching:

    server {
            server_name wp.com;
            root /var/www/wp; # way to WP
            index index.php;
    
            location ~* ^.+\.(ogg|ogv|svg|svgz|eot|otf|woff|mp4|ttf|rss|atom|jpg|jpeg|gif|png|ico|zip|tgz|gz|rar|bz2|doc|xls|exe|ppt|tar|mid|midi|wav|bmp|rtf)$ {
                    access_log off;
                    log_not_found off;
                    expires max; # statistics caching 
            }
    
            location / {
                    try_files $uri $uri/ /index.php?$args; # permalinks
            }
    
            location ~ \.php$ {
                    fastcgi_pass unix:/var/run/php5-fpm.sock;
                    fastcgi_index index.php;
                    include fastcgi_params;
            }
    }
    

    PHP cach

    If you do not have any special reasons why you can not install APC, turn it necessarily. Checks for APC (in response to obtain a list of settings APC):

    php -i | grep apc

    In PHP versions after 5.5 has a built-in module opCache, so it will not have to put the APC.

    Tuning Mysql

    WordPress uses InnoDB, which means we can significantly increase productivity of MySQL, adjust the number of parameters (file my.cnf) under our hardware:

    The size of the buffer InnoDB is better to put in half the available RAM:

    innodb_buffer_pool_size = 256M
    

    Do not forget to include the caching of MySQL:

    query_cache_size = 32M
    query_cache_limit = 1M
    

    Caching

    This is the most important point. Caching can give a significant acceleration of the site and save server resources. For clarity, we will use ab from Apache. Verify the standard install WordPress without caching. The request is sent through a local network, so the delay is nothing but itself does not create a WordPress:

    ab -c 10 -n 500 https://wordpress/

    Obtain the average time of about 50ms on request:

    Total transferred:      4183000 bytes
    HTML transferred:       4074500 bytes
    Requests per second:    17.62 [#/sec] (mean)
    Time per request:       567.421 [ms] (mean)
    Time per request:       56.742 [ms] (mean, across all concurrent requests)
    Transfer rate:          143.98 [Kbytes/sec] received
    

    Chrome shows the average wait for the response at 150 ms (the server is in the Netherlands):

    WP Super Cache

    This plugin allows you to enable caching literally in one action. Besides the default settings, it contains a large number of settings for tuning the cache. Download plugin, activate it in the control panel and turn on the cache

    With the included WP Super Cache obtain a reduction of the average time per query 25 times (!):

    Total transferred:      4293500 bytes
    HTML transferred:       4146500 bytes
    Requests per second:    499.01 [#/sec] (mean)
    Time per request:       20.040 [ms] (mean)
    Time per request:       2.004 [ms] (mean, across all concurrent requests)
    Transfer rate:          4184.61 [Kbytes/sec] received
    

    Average absorption waiting for reply in Chrome decreased by 3 times:

    As an alternative to server-WP Super Cache can use Varnish. It reduces the time to process a request for nearly an order of magnitude, but the solution is less flexible (well suited for blogs without elements of dynamics).

    Styles, scripts and images

    Minification and Compression

    Minification CSS / JS can save 10 … 15% of their size. To enable a module minification statics WP Minify. Download it, activate, and the module starts. Gzip will reduce the size of the text files into several times. In Nginx activated as follows:

    server {
    ...
    gzip on;
    gzip_disable "msie6";
    gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript application/javascript;
    ...
    }
    

    Optimizing images

    Pictures can be very large part of the overall page size. Lossless compression of images can save 30 … 40% of their size. This module is able to do EWWW Image Optimizer. For it to work you will need to install imagemagick and library gd:

    apt-get install imagemagick php5-gd
    

    Good practice and experience

    • It is best to choose a VPS hosting for WordPress. Shared hosting on many of the above can be done. In addition, VPS now cheap enough
    • Check the topics using Pagespeed before use
    • Clean trash
    • Delete old revisions of posts
    • Remove spam comments
    • Unplug trackbacks to moments when everything becomes very slow
    • Share RSS via feedburner

    As a result

    We’ve got a raw install WordPress to disperse about 100 times on the page generation time (we included Varnish) and increase the rate at Pagespeed from 76 to 93:

    This text is a translation of article “Ускоряем WordPress” by golotyuk published on habrahabr.ru 

    Forums and blogs without spam

    CleanTalk is a SaaS spam protection service for Web-sites. CleanTalk uses protection methods which are invisible for site visitors. Connecting to the service eliminates needs for CAPTCHA, questions and answers and other methods of protection, complicating the exchange of information on the site.

  • Anti-spam plugin for WordPress, version 2.33 on Feb 13, 2014

    Anti-spam plugin for WordPress, version 2.33 on Feb 13, 2014

    Ready to use the updated version of the anti-spam plugin for WordPress, changes,

    • Added notice about automatically approved comment. The notice shows only for first approved comment and only for new commentators (without approved comments) of the blog.
    • At WordPress console added banner for system notices.

    Archive with the plugin cleantalk-spam-protect.2.33.zip.

  • Updated anti-spam plugin for WordPress on Jan 29, 2014

    Updated anti-spam plugin for WordPress on Jan 29, 2014

    Ready to use the updated version of the anti-spam plugin for WordPress, changes,

    • added protection from spam to form comments JetPack.
    • fixed cURL error «Expect: 100-continue» when connecting to servers automatic moderation.

    Archive with the plugin cleantalk-spam-protect.2.31.zip.

  • Updated Anti-Spam plugin CleanTalk for WordPress

    Updated Anti-Spam plugin CleanTalk for WordPress

    In the new version of anti-spam plugin for WordPress made the following changes:

    • fixed bug with displaying PHP warning for sites with PHP version 5.4.
    • fixed bug with checking comments Administrators, Authors and Editors of this blog.
    • plugin settings «Filter messages containing stop-words», «Language system messages» removed from the control menu plugin. These settings are now available in the control Panel service.

    Archive cleantalk-spam-protect.2.4.10.zip.

    PS
    We welcome Your feedback and are estimated plugin CleanTalk on the website wordpress.org (registration required)!