Barry Kooij

icyapril

Remkus de Vries

manatarms

Cloudflare

Patryk

jacobbednarz

deuill

thillcf

<h4>What this plugin can do for you</h4>
<p>https://www.youtube.com/watch?v=DWANhxoDxFI?feature=youtu.be</p>
<p><strong>Automatic Platform Optimization (APO)</strong></p>
<p>Speed up your WordPress site by up to 300% with Cloudflare’s Automatic Platform Optimization (APO) plugin. APO allows Cloudflare to serve your entire WordPress site from our edge network of over 250+ data centers worldwide ensuring fast & reliable performance for your visitors no matter where they are.</p>
<p>Optimizing your WordPress site with multiple plugins can be overwhelming. Take your WordPress site’s performance to the next level by switching to a single plugin for CDN, intelligent caching, and other key WordPress optimizations with Cloudflare (APO). Visit our <a href="https://blog.cloudflare.com/automatic-platform-optimizations-starting-with-wordpress/" rel="nofollow ugc">announcement blog</a> to learn more about APO.</p>
<p><strong>What makes APO different from other caching plugins?</strong></p>
<p>The key differentiating factor between Cloudflare APO and other traditional page caching and CDN solutions is its ability to directly cache static HTML at Cloudflare’s edge. Every other plugin and CDN will cache your static assets (images, javascript, CSS), but none help you cache the actual content on your site (the HTML) using a massive edge network like Cloudflare’s.</p>
<p>APO intelligently caches your HTML pages and will automatically purge content from the cache that you update, so users will always see the latest content without compromising the performance of pages that haven’t been recently updated</p>
<p><strong>What you get with Cloudflare APO</strong></p>
<p>APO is a $5 add-on with Cloudflare’s free plan and comes with an unlimited amount of subdomains. With APO you also get to leverage many of the other benefits of Cloudflare such as <strong>Free DNS, Free Automated SSL Certificates, Free DDoS Mitigation, and more.</strong> APO is free for all paid plan users so if you have Cloudflare Pro or Business already you can just turn it on. You can compare all our plans <a href="https://www.cloudflare.com/plans/?utm_source=promo&utm_medium=social&utm_term=&utm_content=&utm_campaign=g421o-pl-apo-wordpress-plans" rel="nofollow ugc">here</a>.</p>
<p><strong>Protect your WordPress site with Cloudflare’s Web Application Firewall (WAF)</strong></p>
<p>Cloudflare’s WAF is available on all our <a href="https://www.cloudflare.com/plans/?utm_source=promo&utm_medium=social&utm_term=&utm_content=&utm_campaign=g421o-pl-apo-wordpress-plans" rel="nofollow ugc">paid plans</a> and comes with built-in rulesets, specifically tailored to mitigate WordPress threats and vulnerabilities. These security rules are regularly updated by our team of experts. At the flip of a switch, you’ll have your WAF up and running without any difficult adjustments to your site. With over 26 million internet properties under our protection, you can sleep easy knowing Cloudflare has your back.</p>
<h4>Additional features</h4>
<ul>
<li>
<p>Header rewrite to prevent a redirect loop when Cloudflare’s Universal SSL is enabled</p>
</li>
<li>
<p>Change Cloudflare settings from within the plugin itself without needing to navigate to the cloudflare.com dashboard. You can change settings for cache purge, security level, Always Online, and image optimization</p>
</li>
<li>
<p>View analytics such as total visitors, bandwidth saved, and threats blocked</p>
</li>
<li>
<p>Support for <a href="https://blog.cloudflare.com/announcing-support-for-http-2-server-push-2/" rel="nofollow ugc">HTTP2/Server Push</a></p>
</li>
</ul>


All of Cloudflare’s performance and security benefits in a simple one-click install.

vavkamil

<h3>XML-RPC Settings</h3>
<p>Configure XML-RPC methods to increase the security of your website:</p>
<h4>Build-in features could be used for malicious purposes and cannot be disabled by default.</h4>
<ul>
<li>Disable GET access
<ul>
<li>XML-RPC API only responds to POST requests. Direct GET access is not needed and can be used to fingerprint websites and use them as XML-RPC zombies in later attacks.</li>
</ul>
</li>
<li>Disable system.multicall
<ul>
<li>system.multicall method can be misused for amplification attacks.</li>
</ul>
</li>
<li>Disable system.listMethods
<ul>
<li>system.listMethods method can be used for verifying attack scope.</li>
</ul>
</li>
</ul>
<h4>Prevent malicious actors from enumerating usernames and credentials.</h4>
<ul>
<li>Disable authenticated methods
<ul>
<li>Methods requiring authentication, such as wp.getUsersBlogs, are often used to brute-force your passwords.</li>
</ul>
</li>
</ul>
<h4>Pingbacks are a helpful feature to discover back-links to your posts but can be misused for DDoS attacks or allow fingerprinting your WP version.</h4>
<ul>
<li>Disable pingbacks
<ul>
<li>Pingbacks are generally safe, but are often used for DDoS attacks via system.multicall.</li>
</ul>
</li>
<li>Remove X-Pingback header
<ul>
<li>If you decide to disable pingbacks, it’s a good practice to remove the X-Pingback header return by your posts.</li>
</ul>
</li>
<li>Hide WordPress version when verifying pingbacks
<ul>
<li>Pingbacks’ user-agent can reveal your exact WordPress version, even when hidden by other plugins.</li>
</ul>
</li>
<li>Hide WordPress version when sending pingbacks
<ul>
<li>Pingbacks’ user-agent can reveal your exact WordPress version, even when hidden by other plugins.</li>
</ul>
</li>
</ul>
<h4>Unnecessary XML-RPC API, leave enabled if you are not sure.</h4>
<ul>
<li>Disable Demo API
<ul>
<li>Remove demo.sayHello and demo.addTwoNumbers methods, as they are not needed.</li>
</ul>
</li>
<li>Disable Blogger API
<ul>
<li>WordPress supports the Blogger XML-RPC API methods.</li>
</ul>
</li>
<li>Disable MetaWeblog API
<ul>
<li>WordPress supports the metaWeblog XML-RPC API.</li>
</ul>
</li>
<li>Disable MovableType API
<ul>
<li>WordPress supports the MovableType XML-RPC API.</li>
</ul>
</li>
</ul>
<h4>If you are using some integrations or WP mobile applications, it might be a good idea to allow XML-RPC only to specific IPs.</h4>
<ul>
<li>Allow XML-RPC only for
<ul>
<li>IP comma separated eg. 192.168.10.242, 192.168.10.241</li>
</ul>
</li>
</ul>
<h4>It is possible to hide a message between the allowed methods when system.listMethods is called (not recommended).</h4>
<ul>
<li>Add message to XML-RPC methods
<ul>
<li>We are hiring! Check jobs.yourdomains.com</li>
</ul>
</li>
</ul>


XML-RPC Settings

Secure your website with the most comprehensive XML-RPC Settings plugin.

Cloudflare vs XML-RPC Settings