Category: WordPress

Recently has a server that would not run WordPress updates or plugin installs no matter what I did. After extensive troubleshooting, it turned out the server had SELinux enabled which disallows outbound connections from Apache. One useful tool in troubleshooting update problems is the Background Update Tester plugin: http://wordpress.org/plugins/background-update-tester/ It gives some extra detail on why updates can’t run.    

In the recent rash of wp-login.php brute force attacks, I needed a way to block access to wp-login.php on a single domain in a WordPress multi-site with many domains. The impact on customers of blocking all domains was too great so I needed a more targeted solution. Here’s what I came up with for the .htaccess file:

We’ve seen many WordPress sites being abused recently via the Pingback function in xmlrpc.php. Here are some good articles on the topic: http://www.incapsula.com/the-incapsula-blog/item/715-wordpress-security-alert-pingback-ddos http://perishablepress.com/wordpress-xmlrpc-pingback-vulnerability/ If you don’t need xmlrpc.php or Pinkbacks then we recommend that you block xmlrpc.php in your .htaccess file by adding code like this:

Or you could rename or remove the xmlrpc.php file. Here’s the config to block xmlrpc.php from Nginx: