Credits: Video Training produced by Brian Teeman
Transcript of this course
Probably the most important part of AdminTools is the Web Application Firewall, as this provides a suite of tools to protect your web site.
We can configure it from the Security section by selecting "Web Application Firewall".
Here you can see several options.
The most important one (and the one we will concentrate on is this video) is Configure WAF.
WAF is just an abbreviation for Web Application Firewall.
Click on the Configure WAF icon.
The first part covers the Basic Protection Features.
whether we should allow administrators access to the web site based on an IP address or whether we should use a custom admin url.
(This is covered in more detail in the video “restricting access to WordPress” Moving on to the Request Filtering.
This is the important stuff that protects your web site from malicious people.
I strongly recommend that you stick to these defaults settings.
You can read all about these options in the information areas and you will find even more details in the documentation section at the akeebabackup.com web site.
With this default setting your web site is being protected from many of the most common types of vulnerability that exist on the web.
The next tab covers Hardening options.
The first of these, when enabled, will warn users when they register if they are using a well known password.
and you can limit this warning to different user groups.
The next two will remove links in the header of your site for RSS or remote blog clients If you are at all unsure I recommend that you leave these at the default of no.
By default WordPress sets session duration to 48 hours or 2 weeks if the option remember me is checked.
This is a very long time and you can change the duraation here.
The most importaant option on this page is whether we treat failed logins as security exceptions.
By default this is set to Yes and you shoyuld leave it at this.
We will talk about security exceptions later.
Finaly we can prevent anyone from signing up to our web site from a domain. Perhaps you want to block anyone using a disposable email address such as those from mailinator.
Simply enter the domains you wish to block here.
In the cloaking tab you will find some options to hide the type of web site that you are running.
Many people believe that it's good to hide the fact that you are using WordPress for your web site.
There are many ways you can identify a web site as running WordPress, one of which is the metagenerator tag.
If you wish to you can hide or customise this tag by setting this to "yes" and setting your own generator tag here if you so wish Perhaps as a joke you might want to set it to Joomla.
Project Honeypot is an external application.
It is designed to prevent people using contact forms for spam.
You can find out more about Project Honeypot at their website following the link from here.
The final sections cover logging and blocking repeat offenders.
Before blocking anyone you might want to ensure that users from a certain IP address or domains are never blocked by adding them to a whitelist.
Each time someone makes a failed attempt we log it, and after a defined number of attempts we block them from accessing our web site completely.
The way to do this is by IP address.
An IP address is a unique number assigned to every internet connection.
Of course this isn't perfect because a good hacker may well be using a randomised IP address, but it does prevent the script kiddie.
So I recommend that you set this to yes.
Now we need to decide - do we want to email someone to say that there there has been an automatic ban.
I'd like to know that something is going on so I'm going to put my own email address in there.
I can now choose what the trigger is for the ban.
By default it is 3 attacks in 1 minute, but you can change that to whatever criteria you want.
Then it's how long you want to ban that person for.
I usually set that to 1 day.
We can additionaly permanently block an ip address if it is a repeat offender.
When a person tries to access your site from a blocked IP the onlly thing they will see is this message which you can customise if you wish.
There are a few different types of logging that AdminTools offers you.
First it is possible to add a note for every single user to store the IP address that they used when they signed up.
You may need to log this for regulatory purposes if so you should enable it.
Now is the main one which is logging the security exceptions.
Obviously we want to log them so this should remain set to yes.
Again we can choose to send an email on every single security exception.
If you want to apply this just enter your email address in here.
Personally I don't bother setting this, as there can be quite a lot of exceptions they just mean someone has tried and failed.
I only know want to know if someone has been blocked.
However, you might want to choose to enable the next one - to send an email every time somebody logs in to your administrator.
Now if you've got a lot of administrators you probably don't want to set this.
But if you are the only one and somebody is able to log in then that's a security issue and I'd want to know about it.
So I'm going to enter my email address in there so that now if anybody logs in to the administrator of this web site I will be notified.
Once you've configured the Web Application Firewall exactly how you want it and made sure that you've read the documentation to understand what the settings are, press Save Changes and all those configured options for the Web Application Firewall are now in operation.