Latest TweetsOfficial Resources for #Gutenberg Block Editor: digwp.com/2018/12/resources-gu… #WordPress
Perishable Press
Category: Security
Found 131 matching results
Page 1 of 9

Automatic IP Blacklist

Recently a reader going by the name of Rock Star sent me a cool little PHP script that automatically updates your site’s .htaccess with a current list of bad IP addresses. This is useful because it gives you better “real time” protection against attacks and malicious requests. This tutorial shares the code and explains how […] Continue »

Enable PHP fsockopen with CSF

Recently started some sites with Liquid Web hosting, everything going extremely well all around. There was one hiccup (at least for me) where PHP’s fsockopen was not working. At the time, I was trying to figure out why the Whois Lookup feature used by Blackhole Bad Bots was not working. Initial investigation revealed that fsockopen() […] Continue »

Twitter Login Verification Bug

A few days ago, I was unable to log in to my Perishable Twitter account. My login credentials simply did not work. I’ve been successfully logging into Twitter since 2007 with no problems. So it was surprising at first, and then I figured it was some sort of weird Twitter bug. So I began investigating […] Continue »

404 Fix: Block Nuisance Requests for Non-Existent Files

As I’ve written before, blocking nuisance requests can help save you money by cutting down on wasted server resources, memory, and so forth. It also saves you time, as your server access and error logs won’t be full of nuisance request spam. So you will have more resources and time for things that matter, like […] Continue »

1password vs. Dashlane

I was a 1password user for years. Thought it was great, everything I needed without not too much bloat, ads, etc. Then one day 1password locked everyone out. As in can’t log in with the master password. So no access to any passwords, notes or anything. Business shut down. Thought I was hacked. Not a […] Continue »

WordPress and the Blank Target Vulnerability

For those who haven’t yet noticed, WordPress now adds rel=”noopener” attributes for any external links added via the link Quicktag in the Visual/RTE. So if you enable the option, “Open link in a new tab”, WordPress automatically will add the rel noopener attribute to the link. This is to protect against CORS and other exploits […] Continue »

Blocking the “ReallyLongRequest” Bandit

While browsing server logs, I kept seeing these super long request URIs that begin with “YesThisIsAReallyLongRequest…” and then the request string just keeps going for like 1 kilobyte worth of characters. Not just a few times, but many. In other words, somebody is going around and repeatedly hitting servers with gigantic-size requests. Probably to test […] Continue »

Wireless Camera Notes

Momentum Cam Over the years, I’ve gone through quite a few wireless wi-fi security cameras. Not because I am a gadget/new-tech junkie, but because all of the cameras I have tried so far work for awhile and then stop working, or never work properly in the first place. So in an effort to not repeat […] Continue »

New WordPress Plugin: Banhammer!

Banhammer makes monitoring traffic and banning visitors crazy easy and fun. Say your forum is being harassed some dirtbag. Or your admin directory is crawling with bad bots. Or some script kiddie is trying to brute-force your login page. Don’t just sit there and watch it happen.. drop the Banhammer on those fools and block […] Continue »

New WordPress Security Plugin: Host Header Injection Fix

Since version 2.3, WordPress has been vulnerable to a Host Header Injection attack in certain server environments. Over the years, there has been some discussion about fixing the vulnerability, but as of WP 4.9 (beta) nothing has been implemented. So to help those in the WP community who may be concerned (including myself), I developed […] Continue »

Blackhole for Bad Bots – PHP Version

This post summarizes Blackhole for Bad Bots version 4.0+. For older versions, check out the original tutorial. Please read the original tutorial for download, demo, and important information about the standalone PHP version of Blackhole for Bad Bots. The following guide is meant to simplify things for users of Blackhole version 4.0 and better. Continue »

Detect Attacks with PHP and .htaccess

This tutorial explains how to detect and block security threats via .htaccess, and then pass that information to a PHP script for further processing. This is a powerful technique that combines the power of Apache with the flexibility of PHP. Enabling you to do things like log all unwanted traffic, send email reports for blocked […] Continue »

Watch Cyber Attacks Online

Taking a quick break to watch cyber attacks happening in real time. Continue »

Examples of Nested Encoding

Typically malicious scans use some sort of encoding to obscure their payloads. For example, instead of injecting a literal script, the attacker will run it through a PHP encoding function such as base64_encode(), utf8_encode(), or urlencode(). So if and when you need to decode some discovered payload, you can use whichever decoding function will do […] Continue »

Block Greasy Uploads Scanner

Whether you’re running WordPress or not, your site may be getting hit by endless scanning for your site’s uploaded files and similar nonexistent resources. Specifically, the “Greasy Uploads Scanner” endlessly scans sites for nonexistent resources in the /uploads/ directory, even if the directory itself doesn’t exist. Just mindless scanning for all sorts of weird files. […] Continue »

How to Block Bad Bots

Suffering from spammers, content scrapers, bandwidth leeches, and other bad bots? Got some loser stalking your chat forum? Site getting scanned by endless malicious requests? In this tutorial, you’ll learn how to block bad bots and users with minimal effort. Keeping the trash away from your site is gonna free up valuable server resources, conserve […] Continue »

« Previous Posts 1239