Ironically, I recently had to do just this. I had to reset WordPress admin password on a backup copy of an archived website, for which I had long forgotten the password. Since it was not a live site but only a local copy (i.e., running on localhost), I could not do the email reset. However, the stored password is hashed, so how is this supposed to work?

Fortunately, WPBeginner filled in the missing pieces on doing a password reset on a WordPress site running only on localhost:

Do you want to reset WordPress admin password on localhost? In this tutorial we will show you how to easily reset WordPress admin password on localhost.

Source: How to Reset WordPress Admin Password on Localhost

Don’t ring the ‘dorbell’; no one’s home.


I was looking through my logwatch log one day, and I came across some of the strangest looking hits I’ve ever seen.

/!: 1 Time(s)

Looking at the original other_vhosts_access.log file, I saw: - - [12/Jul/2015:10:30:31 -0600] "GET /! HTTP/1.0" 404 31386 "" ""

My first thought was that it was some sort of strange joke, but it occurred again the next day, and so it became obvious it was something worth looking into. As it turns out, this is an attempt at exploiting the shellshock vulnerability. Script kiddies aren’t too bright, so they just copy and paste old vulnerabilities and try over and over again. So, how best to block stupid URLs like this?

I could have elected to block the traffic by referrer, but weighing the pros and cons of this came down on the con side for me. After all, the referrer isn’t necessarily what I want to block, and the link already points out two of them. No, I want to block stupid URLs, not the referrer.

Well, a little research came up with ModSecurity, aka mod_security. It seemed like the ideal choice, and it uses Apache syntax and config files. So, I proceeded to implement it and hit a wall — hard. I banged my head here, and I banged my head there, but all I got was a headache.

That’s because I was wasting my time, at least a couple of hours. It turns out to not be so WordPress friendly. That actually makes little sense, since the examples almost always consist of using a PHP test script to block a MySQL injection! The work around is to exclude the WordPress directories! That makes absolutely no sense when WordPress is the main platform!

So, I was without a means to block stupid URLs. Fail2ban blocks IP addresses, but only after failed access attempts, particularly bad logins. However, it turns out that there still are a couple of rather reactive alternatives.

Method 1: Iptables

The best seems to be to use iptables. Granted, that is a little intimidating, but fortunately there are plenty of examples on the web.

The best one I’ve seen so far is “Linux : using iptables string-matching filter to block vulnerability scanners” at SpamCle@ner. It is easy to follow, although I’ll admit I only followed the first part of it. The downsides they point out is that it will always filter port 80, but since I use ufw and other stuff that seems like a minor downside, and “it can cause errors (“false positive”)“, which seems very unlikely for the type of junk we are talking about here.

On the upside, this blocks the traffic before it even hits the Apache server. On the downside, you have to find a way to save it, else the rules disappear upon a server reboot.

There is a workaround for this, and it involves installing iptables-persistent. Read up on this and how to save the iptables at “Saving Iptables Firewall Rules Permanently“.

2. Ban repetitive stuff from logs

If you want a lower quality type after the fact sort of ban, you could also implement a script that does some of the repetitive blocking for you. For example:

echo "Must run as root!"

   for II in $(grep "$1" /var/log/apache2/*.log | cut -d' ' -f2 | sort -u)
      ufw insert 5 deny from "$II" >> "$LOGFILE"
      echo "$II" >> "$LOGFILE"

   for II in $(grep "$1" /var/log/auth.log | cut -d' ' -f11 | sort -u)
      ufw insert 5 deny from "$II" >> "$LOGFILE"
      echo "$II" >> "$LOGFILE"

for JJ in 'POST /xmlrpc.php' '/Diagnostics.asp' '/!' \
'/wiki/Five_Weird_Tricks_for_Stair' '/wiki/What_You_Need_to_Understand_About_Cardio_Training'
   banhttp "$JJ"

for JJ in 'PaigeBiehl3540' 'Sabina27Y002' 'FrancineSmith23'
   banwp "$JJ"

In theory, this latter method might be easier to maintain for newbies, but over time I suspect that this could become unwieldy. OTOH, it requires no direct fiddling with iptables, saving them, etc.

In reality, the best approach might be a hybrid one. Some of the more obvious could go into iptables directly, especially when they are so common that you are blocking stupid stuff every day and/or they are obvious hacking attempts. Some of the less serious stupid stuff could just go into the script which will block IPs that keep banging on links that don’t exist, never have existed and just plain are tiring to look at.




Some critical #WordPress #SecurityUpdates went out yesterday, so its best to update now.

Blue WordPress logo
Blue WordPress logo

The title pretty much says it all. According to article “WordPress 4.2.1 Security Release“, “This is a critical security release for all previous versions.” Details about the vulnerability were released shortly after the update went out, so there isn’t any time to waste.

WordPress has started doing automatic updates in the last couple of major releases, but I noticed one site had not yet updated. It would be a very good idea to go out and check all of your sites.

Tightening up on #WebsiteSecurity should be the next priority for your #WordPress site.

If your WordPress site has been up more than 2 hours, you’ve probably already collected a bunch of spam attempts.  There are several tools out there to help you out with spammers and hackers, but few do better in protecting against the former category, IMO, than Anti-Spam by CleanTalk.  Straight up, it is not free, but they have a short demo period that will likely impress you.  On top of that, it is only $8.00 per year. Continue reading “Tighten Security to Finish WordPress Site Migration”

So many options!   #CreateADigitalOceanDroplet without a lot of fuss for #WordPress.

Creating a WordPress droplet on Digital Ocean is not hard. In fact, it is downright easy. That is, the actual creation of it is. Deciding how to create it took me longer than actually doing it, as I found myself creating it, messing up, destroying it, recreating it, and so on.  Once out the door, however, it wasn’t all that difficult.
Continue reading “Creating a WordPress Droplet on DigitalOcean”

Before you move, evaluate why you should so you avoid making a costly mistake.

As a business grows and/or its needs change, it isn’t unusual to begin to ponder changing hosting companies and/or even the topology of the arrangement.  However, nothing comes without drawbacks, and it is useful, and less costly, to ponder those before making a decision.
Continue reading “Before Moving WordPress to a Droplet”