Featured Articles
Useful
Are you in my blocklist?
With just a few manual steps you create your own little IP blocklist for WordPress in .htaccess or web.config. Here are the IP addresses I blocked.
Latest articles
apache
GNU/Linux, Web applications
Last updated:
Blocking bad bots and search engines using .htaccess
Take control of your server resources by learning how to block aggressive bots and unwanted search engines using .htaccess and mod_rewrite. This guide provides copy-paste ready configurations to prevent bandwidth theft, stop scrapers, and ensure that only relevant search engines crawl your website.
GNU/Linux
Last updated:
Force HSTS in Apache .htaccess
Learn how to enable HSTS (HTTP Strict Transport Security) in Linux Apache .htaccess. I wrote about enabling HTTP Strict Transport Security (HSTS) in IIS earlier. But what about enabling HSTS in Apache .htaccess? Here is how.
WordPress
Last updated:
Disallow direct access to PHP files in wp-content/uploads/
Securing the WordPress uploads folder is important. In many hacked WordPress sites, a PHP backdoor is found within the WP_CONTENT_DIR/uploads directory. Often because this is the location where uploads are placed automatically. From the backdoor within wp-content/uploads other backdoors are uploaded to various locations, and scripts are injected with malware.
Security
Last updated:
.htaccess security best practices in Apache 2.4.6+
Since Apache 2.4.6, a new module is used to configure and set up access control for websites: mod_authz_core. This means you have to use a different syntax for allowing or blocking hosts and IP addresses to your website. Apache Access Controle done right in WordPress .htaccess.
WordPress
Last updated:
Benchmarking WordPress, simple load & speed testing with ApacheBench
Learn how to benchmark WordPress using simple load and speed testing with ApacheBench.
WordPress
Last updated:
SSL in WordPress: how to move WordPress to HTTPS? The definitive guide
Move WordPress to HTTPS correctly. Learn the Site Health switch, database search and replace, IIS/Apache redirects, HSTS hardening, and OpenSSL verification.
Security
Last updated:
Joomla websites abused as open proxy for Denial-of-Service attacks
Joomla websites with the vulnerable Googlemaps plugin are abused as open proxy for DoS attacks. Here is how to block plugin_googlemap2_proxy.php.
WordPress
Last updated:
Huge increase in WordPress xmlrpc.php POST requests
How to identify, block, mitigate and leverage xmlrpc.php scans, brute-force, and user enumeration attacks on WordPress sites... Secure WordPress xmlprc.php interface and reduce service disruption.
Useful
Last updated:
Redirect HTTP to HTTPS
In this post I provide you various HTTP to HTTPS redirection methods, for Windows Server IIS and Linux Apache. Use these examples to your advantage to secure the traffic between your visitors and your website.
Windows Server
Last updated:
How to use .htaccess files on Windows Server IIS
Learn how to use .htaccess in Windows Server IIS. Before IIS 7 and the URL Rewrite module, you had to rely on third party extensions to IIS for URL rewriting with .htaccess files.