security on {bjørn:johansen}

How to mitigate CVE-2018-6389 – the load-scripts.php DoS “attack” in WordPress

Mon, 12 Feb 2018 22:38:40 +0000

A little sensationalist written blog post by Barak Tawily claims that WordPress is vulnerable to a DoS attack because of the load-scripts.php file which concatenates JavaScript files on the fly.

Another day, another “WordPress security vulnerability”

Sat, 27 Jan 2018 00:36:35 +0000

OMFG, BREAKING NEWS: Thousands of WordPress sites affected by some vulnerability.{{ double-space-with-newline }}

WordPress security for the casual blogger or small business with limited resources

Thu, 10 Aug 2017 16:37:51 +0000

The resources you have available to spend on WordPress security for your website usually vary vastly whether you’re an international corporation or just a hobbyist blogger. But since most attacks are automated by bots looking for vulnerabilities, a lot of the threats are the same. Here are some WordPress security measures that bloggers and small business with limited resources easily can take.

Secure email: Encrypt and sign your emails with PGP/GnuPG

Thu, 25 May 2017 11:49:24 +0000

Email is fundamentally insecure. There are such a plethora of issues with it, it is crazy to think about the kind of information sent with it. It is probably even crazier when you realize we’ve had a solution for sending secure email since 1991.

How to perform and mitigate a WordPress session donation attack

Wed, 22 Mar 2017 15:16:56 +0000

WordPress doesn’t use a nonce for the login form, which opens up for you to perform a WordPress session donation attack.

How CloudFlare handled CloudBleed

Fri, 24 Feb 2017 09:27:05 +0000

Tavis Ormandy from Google’s Project Zero contacted Cloudflare to report a security problem with their service. It turned out that in some unusual circumstances, they would bleed memory that contained private information.

Giving users a helping hand when authorizing them in WordPress

Tue, 24 Jan 2017 07:17:14 +0000

Inspired by how Facebook assists their users when they log in, I decided to implement something like the same for WordPress.

To www or not to www – Should you use www or not in your domain?

Fri, 20 Jan 2017 17:49:52 +0000

For 20 years or so, there has been the debate over whether you should use www or not in your web site’s canonical hostname. So should you use www or not?

Encrypt and decrypt a file using SSH keys

Thu, 05 Jan 2017 17:25:41 +0000

If you have someone’s public SSH key, you can use OpenSSL to safely encrypt a file and send it to them over an insecure connection (i.e. the internet). They can then use their private key to decrypt the file you sent.

SVG uploads in WordPress (the Inconvenient Truth)

Thu, 26 May 2016 20:02:07 +0000

Enabling uploads of SVG files in WordPress is quite easy, and there is a tonne of posts on the Interwebs explaining how you do it. Usually along the lines of:

function add_svg_to_upload_mimes( $upload_mimes ) {
	$upload_mimes['svg'] = 'image/svg+xml';
	$upload_mimes['svgz'] = 'image/svg+xml';
	return $upload_mimes;
}
add_filter( 'upload_mimes', 'add_svg_to_upload_mimes', 10, 1 );

And that’s pretty much it.

Except it is not.

Let’s Encrypt for Nginx

Thu, 31 Mar 2016 20:48:31 +0000

Let’s install an SSL-certificate from Let’s Encrypt for Nginx.

Restrict allowed HTTP methods in Nginx

Wed, 21 Oct 2015 18:22:11 +0000

Security vulnerabilities are often exploits of software that fails when trying to deal with unexpected input. Other times they are exploits of a misconfiguration or a service that unintentionally was open to the public.

For the above reasons, we should limit as much as possible what services are exposed to the public and limit as much as possible what they do and accept from the visitors. To follow those security principles, we should only allow the HTTP methods for which we, in fact, provide services. Under all normal circumstances, that would be the methods GET, POST and HEAD.

Block access to PHP files on your WordPress site with Nginx

Mon, 19 Oct 2015 20:43:56 +0000

In your WordPress site, there are directories that include PHP files that visitors should never be able to access directly. They are only there for WordPress to function as an application that runs on your server. But because of WordPress’ directory and file structure, they are kind of accessible to the public. All of them are meant to be part of a larger application – WordPress, that is – and should not cause any harm if called directly – that we know. Some of the files execute some code even when ran standalone. An attacker might know of a clever way to make that code run in an unexpected manner, causing harm. To be on the safe side, we should deny access to all these PHP files from the outside world. Since we block access to them in our Nginx configuration, PHP will still run them as usual and WordPress will work just fine.

Optimizing HTTPS on Nginx

Sat, 18 Jan 2014 23:49:30 +0000

Now that you have secured Nginx with HTTPS and enabled SPDY enabled HTTP/2, it’s time to improve both the security and the performance of the server.

Restricting access to WordPress login by IP address

Sat, 20 Apr 2013 20:15:34 +0000

If you have a static IP address, like from your own VPN, it is very easy to increase your security tremendously. Simply restrict all logins to that IP address.

Setting up your own PPTP VPN

Sat, 20 Apr 2013 19:04:23 +0000

When it comes to VPNs, there is the choice between PPTP and OpenVPN. PPTP is pretty quick to setup and works out of the box with most (all?) OSes and devices.