BlogSafe.org

BlogSafe Honeypot is a ‘lite’ version of our private research tool. It’s purpose is to track two types of information.
<ul>
<li>Failed URL requests.</li>
<li>Failed login attempts.</li>
</ul>
By analyzing data collected by BlogSafe Honeypot, you will gain an insight into attempts to access known vulnerabilities as well as emerging 
threats. You’ll also be able to analyze which usernames and passwords brute-force agents are using in attempts to force their way into your site.
Main Features
<ul>
<li>Records information about connections incoming to your WordPress site that have no valid destination.</li>
<li>Records failed username and password attempts. Useful for analyzing brute-force attacks.</li>
</ul>
Other Features
<ul>
<li>IP and URL White-listing to prevent known requests and logins from being recorded.</li>
</ul>
Options
<ul>
<li>Can be configured to detect incoming The Onion Router (TOR) connections.</li>
<li>Can be configured to automatically delete requests and login attempts after 1 year.</li>
</ul>
Third Party Notice 
If the optional TOR detection is enabled, BlogSafe Honeypot will make a 3rd party connection to the TOR exit node list maintained by TOR. 
You can manually view this list here: <a href="https://check.torproject.org/exit-addresses" rel="nofollow ugc">TOR Exit List</a>

BlogSafe Honeypot

BlogSafe Honeypot is a 'lite' version our private research tool. Instead of tracking where visitors…

Jesin A

This plugin adds an additional layer of protection for the wp-login.php page using <a href="http://en.wikipedia.org/wiki/Digest_access_authentication" rel="nofollow ugc">HTTP Digest Authentication</a> with the PHP <a href="http://php.net/header" rel="nofollow ugc">header()</a> function. 
So it doesn’t require configuring web server files like .htaccess or <a href="https://websistent.com/tools/htdigest-generator-tool/" rel="nofollow ugc">.htdigest</a> and works on all web hosting environments.
Important: If you already have a plugin which does HTTP Authentication please deactivate it before activating this plugin. Similarly if you have configured your web server to do HTTP authentication on the wp-login.php file please remove it before using this plugin.
If you are using FastCGI PHP this plugin may keep prompting for the credentials even if you enter the right pair, in this case use the following in your <code>.htaccess</code> file
<pre><code><IfModule mod_setenvif.c>
SetEnvIfNoCase ^Authorization$ "(.+)" PHP_AUTH_DIGEST=$1
</IfModule>
</code></pre>
<h4>Advantages of HTTP Digest Authentication</h4>
<ul>
<li>Digest Authentication is very much safer than HTTP Basic Authentication whose credentials can be easily decoded with a <a href="http://www.base64decode.org/" rel="nofollow ugc">base64 decoder</a>.</li>
<li>From Wikipedia on <a href="http://en.wikipedia.org/wiki/Basic_access_authentication" rel="nofollow ugc">HTTP Basic Authentication</a>:</li>
</ul>
<blockquote>
The BA (Basic Authentication) mechanism provides no confidentiality protection for the transmitted credentials. They are merely encoded with BASE64 in transit, but not encrypted or hashed in any way.
</blockquote>
<ul>
<li>Digest Authentication on the other hand uses <a href="https://websistent.com/tools/md5-encryption-tool/" rel="nofollow ugc">MD5</a> on the credentials making it “one way” </li>
<li>Uses server and client <a href="http://en.wikipedia.org/wiki/Cryptographic_nonce" rel="nofollow ugc">nonce</a>s to prevent replay attacks</li>
</ul>
<h4>Features of the HTTP Digest Auth plugin</h4>
<ul>
<li>Works using PHP header() function and doesn’t require modification of service config files (like .htaccess, nginx.conf etc)</li>
<li>Supports HTTP credentials for each WordPress user</li>
<li>Clears the HTTP Digest credentials when the user logs out of WordPress (more on this in the FAQ)</li>
<li>Verifies if both the HTTP and WordPress credentials are of the same user (this is the default behavior and can be changed)</li>
<li>Works on all major Web Servers (Tested on Apache, Nginx and Lighttpd)</li>
</ul>
<h4>Plugin Behavior</h4>
<ul>
<li>When this plugin is activated for the first time all WordPress users will have the following Digest credentials 
Username: <WordPress username> 
Password: password 
This can be changed from Users > Your Profile.</li>
<li>After activating this plugin for the first time you’ll be prompted for HTTP credentials when you logout</li>
<li>Similarly if you change your HTTP username or password you’ll be prompted for this when you logout</li>
</ul>
<h4>Available languages</h4>
<ul>
<li>English</li>
<li>Serbo-Croatian by <a href="http://www.webhostinghub.com/" rel="nofollow ugc">Borisa Djuraskovic</a></li>
</ul>
The <a href="https://websistent.com/wordpress-plugins/http-digest-authentication/" rel="nofollow ugc">HTTP Digest Authentication Plugin</a> official homepage.

HTTP Digest Authentication

Protect your wp-login.php page with HTTP Digest Authentication without the need of adding web server modules or changing config files.

BlogSafe Honeypot vs HTTP Digest Authentication