Using an Open Source CMS with open-source plugins and themes it’s giving a hard time preventing all the hack attacks to your WordPress site.
Many plugins are created by authors who don’t know how to completely secure them. The same with the themes’ authors.
Fortunately, there are security plugins that are built to help you protect your website and prevent hack attacks. Some of them are popular on WordPress: Wordfence, iThemes, Sucuri, etc.
Most of these plugins are working to identify if your website was already hacked but what’s also important is to add a layer on your WordPress site to proactively stop a virus.
The best and simplest way to do this is to change all the known vulnerable paths for all plugins and themes. To do this, you can install Hide My WP Ghost free plugin.
Hide My WP Ghost works together with other security plugins and hides the paths from hackers’ bots, stopping all Script and SQL injections. You can also include Brute Force protection to your login page if you want to use only one security plugin for your website.
Even if both plugins are considered WordPress Security plugins, WordFence and Hide My WP work together without any issue and both will add security layers on your websites, stopping the hackers’ attacks and preventing data loss.
Wordfence runs at the endpoint, your server, providing better protection than cloud alternatives. Cloud firewalls can be bypassed and have historically suffered from data leaks. Wordfence firewall leverages user identity information in over 85% of our firewall rules, something cloud firewalls don’t have access to. And our firewall doesn’t need to break end-to-end encryption like cloud solutions.
Hide My WP Ghost works as security through obscurity solution for WordPress websites.
Security through obscurity is one of the best solutions against hacker bots and one of the best ways to protect vulnerable plugins and themes.
Compatible with: WP Multisite, Apache, Litespeed, Nginx and IIS.
Plugins Compatibility updates: W3 Total Cache, WP Super Cache, WP Fastest Cache, Cache Enabler, CDN Enabler,
WOT Cache, Autoptimize, Jetpack by WordPress, Contact Form 7, bbPress, All In One SEO, Yoast SEO, Squirrly SEO,
WP-Rocket, Minify HTML, iThemes Security, Sucuri Security, Back-Up WordPress, Elementor Page Builder,
Weglot Translate, AddToAny Share Btn
Hosting Compatibility checked: WP Engine, Inmotion Hosting, Hostgator Hosting, Godaddy Hosting, Host1plus,
Payperhost, Fastcomet, Dreamhost, Bitnami Apache, Bitnami Nginx, Google Cloud Hosting
Let us know what you think about these plugins.
If you deploy a WordPress website on Google Cloud Hosting you should know that the AllowOverwrite is None by default and you can’t use the .htaccess for caching and security filters.
In order to make Hide My WP Ghost work on Google Cloud Platform just follow the next steps to activate the rewrite rules:
(more…)
We made Hide My WP Ghost compatible with Godaddy and with some minor settings your website is secure.
First, make sure you don’t use the Godaddy CDN service to avoid any style loading issue. We recommend you to use external CDN services if you need CDN for your website.
To switch off the Godaddy CDN service, go to Godaddy > Managed WordPress > Overview
(more…)
Hiding the wp-admin and wp-login.php paths from source code it’s important especially when you use obscurity through security solution like Hide My WP Ghost.
The fastest way to change it is to use the mapping feature from Hide My WP Ghost. This way you can simply change the /wp-admin to a random name which will redirect the user to a page or to a 404 page.
(more…)
Everybody knows that Zapier is a great tool when you need to create automated tasks on your WordPress site or to trigger an action when you create new posts or pages
We recently tested Zapier to create new posts in WordPress while Hide My WP Ghost plugin is activated.
We noticed that Zapier needs the xml-rpc.php file to work properly and we switched off the option Hide My WP > Tweaks > Disable XML-RPC access. With this option off we were able to create and promote our posts on Social Media.
Having this option on it’s not safe for your website. Many brute force attacks are made through this URL. Sometimes you need to make compromises in order to prevent functionality issues.
The Advanced Access Manager is a great plugin which lets you customize the users rights when it comes to access the backend of your website.
It’s also a good security plugin which protects your personal information when you want to limit the access to developers who sometimes have to work on your live website.
We tested Hide My WP Ghost together with AAM plugin and we noticed that with small adjustments, the two plugins are working beautifully together.
(more…)
If WPPlugins founds any security issue, it means that your WordPress CMS is detected and hackers will find these breaches.
If you don’t act NOW, the hacker’s bots will get into your website sooner or later. If they do, they usually remove the website content entirely and steal your database information. The loss and recovery costs can be … oh well … you do the math.
Below you will find more details and solutions for each security breach we found:
(more…)You can do that. Follow the pictures:
In the “Privileges” tab which list your users click the “Edit Privileges” of the user.
Then select the database:
After that specific the privileges by checking them and then select your table as shown in the picture:
After you select your table, you can define the operations in detailed:
If you followed all the Hide My WP Ghost indications, probably it’s a .htaccess file issue.
Please check the .htaccess file and look for
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress
(more…)
Please follow this tutorial step by step to set up the Hide My WP Ghost for Nginx server:
If your server is a Linux server, the main path to the nginx.conf file is /etc/nginx/nginx.conf (or /etc/nginx/conf/nginx.conf if you’re using Arch Linux). If the server is a Windows server your nginx.conf file will be located at C:/nginx/conf/nginx.conf)
If your nginx doesn’t have sites-enabled option activated (check for sites-enabled subdirectory in the same directory with nginx.conf file), you will find the server configuration in nginx.conf file like in the below example:
server {
server_name [your domain name];
root [path to the website root];
index index.php;
location / {
try_files $uri $uri/ /index.php?$args;
}
}
(more…)
Step1: Install, Setup Hide My WP Ghost Plugin and click the Save button with the new paths.
Step2: Copy the rewrite rules from Hide My WP Ghost into Bitnamy config file
Bitnami uses “htaccess.conf” files by default instead of “.htaccess” files for security and performance reasons. You can find more info at https://docs.bitnami.com/general/apps/redmine/administration/use-htaccess/
(more…)