vavkamil

<h3>XML-RPC Settings</h3>
<p>Configure XML-RPC methods to increase the security of your website:</p>
<h4>Build-in features could be used for malicious purposes and cannot be disabled by default.</h4>
<ul>
<li>Disable GET access
<ul>
<li>XML-RPC API only responds to POST requests. Direct GET access is not needed and can be used to fingerprint websites and use them as XML-RPC zombies in later attacks.</li>
</ul>
</li>
<li>Disable system.multicall
<ul>
<li>system.multicall method can be misused for amplification attacks.</li>
</ul>
</li>
<li>Disable system.listMethods
<ul>
<li>system.listMethods method can be used for verifying attack scope.</li>
</ul>
</li>
</ul>
<h4>Prevent malicious actors from enumerating usernames and credentials.</h4>
<ul>
<li>Disable authenticated methods
<ul>
<li>Methods requiring authentication, such as wp.getUsersBlogs, are often used to brute-force your passwords.</li>
</ul>
</li>
</ul>
<h4>Pingbacks are a helpful feature to discover back-links to your posts but can be misused for DDoS attacks or allow fingerprinting your WP version.</h4>
<ul>
<li>Disable pingbacks
<ul>
<li>Pingbacks are generally safe, but are often used for DDoS attacks via system.multicall.</li>
</ul>
</li>
<li>Remove X-Pingback header
<ul>
<li>If you decide to disable pingbacks, it’s a good practice to remove the X-Pingback header return by your posts.</li>
</ul>
</li>
<li>Hide WordPress version when verifying pingbacks
<ul>
<li>Pingbacks’ user-agent can reveal your exact WordPress version, even when hidden by other plugins.</li>
</ul>
</li>
<li>Hide WordPress version when sending pingbacks
<ul>
<li>Pingbacks’ user-agent can reveal your exact WordPress version, even when hidden by other plugins.</li>
</ul>
</li>
</ul>
<h4>Unnecessary XML-RPC API, leave enabled if you are not sure.</h4>
<ul>
<li>Disable Demo API
<ul>
<li>Remove demo.sayHello and demo.addTwoNumbers methods, as they are not needed.</li>
</ul>
</li>
<li>Disable Blogger API
<ul>
<li>WordPress supports the Blogger XML-RPC API methods.</li>
</ul>
</li>
<li>Disable MetaWeblog API
<ul>
<li>WordPress supports the metaWeblog XML-RPC API.</li>
</ul>
</li>
<li>Disable MovableType API
<ul>
<li>WordPress supports the MovableType XML-RPC API.</li>
</ul>
</li>
</ul>
<h4>If you are using some integrations or WP mobile applications, it might be a good idea to allow XML-RPC only to specific IPs.</h4>
<ul>
<li>Allow XML-RPC only for
<ul>
<li>IP comma separated eg. 192.168.10.242, 192.168.10.241</li>
</ul>
</li>
</ul>
<h4>It is possible to hide a message between the allowed methods when system.listMethods is called (not recommended).</h4>
<ul>
<li>Add message to XML-RPC methods
<ul>
<li>We are hiring! Check jobs.yourdomains.com</li>
</ul>
</li>
</ul>


XML-RPC Settings

Secure your website with the most comprehensive XML-RPC Settings plugin.

Andrea Ercolino

<p>Login Dongle protects your login by means of a <a href="http://en.wikipedia.org/wiki/Security_question" rel="nofollow ugc">security question</a><br />
(AKA challenge/response) as an extra security layer. A bookmark is your login dongle.</p>
<h4>How it works</h4>
<ol>
<li>Go to your standard login page, fill in the form as usual, and click the bookmark.</li>
<li>A prompt asks the challenge. Fill in the response, and accept.
</li>
</ol>
<p>https://www.youtube.com/watch?v=9zejJewYVi4</p>
<h4>Why it works</h4>
<ul>
<li>Under the hood, the bookmark submits login data, together with the challenge and response.</li>
<li>If both challenge and response validate on the server, the login process goes on as usual, otherwise it dies.</li>
<li>The login page stays exactly the same as usual, so attackers won’t know how to guess challenge and response.</li>
<li>Only you know the response to the challenge, so nobody but you will be able to use the bookmarlet.</li>
<li>People using your PC won’t be able to login even if your browser fills in the login form with your password.</li>
</ul>
<p>Login Dongle is compatible with any other login plugin.</p>
<p>For more info, please refer to the <a href="https://wordpress.org/extend/plugins/login-dongle/faq/" rel="ugc">FAQ</a><br />
and the user’s instructions you’ll find on the settings page after activating the plugin.</p>
<h4>User Guides</h4>
<ul>
<li>Dutch: http://www.wpsitemaken.nl/login-dongle</li>
<li>English: http://www.itechdestiny.com/wordpress-security-with-login-dongle-plugin/</li>
<li>English: http://www.shoutmeloud.com/secure-wordpress-login.html</li>
<li>French: http://neosting.net/comment-securiser-acces-login-wordpress-2-etapes</li>
<li>German: https://wordpress.org/support/topic/excellent-plugin-110</li>
<li>Japanese: http://wp.8jimeyo.info/plugin/login-dongle/</li>
<li>Turkish: http://hakanertr.wordpress.com/2012/07/24/login-dongle/</li>
</ul>
<h4>Quick Reviews</h4>
<ul>
<li>http://forum.ait-pro.com/forums/topic/compatibility-question-for-custom-login/</li>
<li>http://webscripts.softpedia.com/script/Modules/WordPress-Plugins/Login-Dongle-80067.html</li>
<li>https://wordpress.org/support/topic/plugin-login-dongle-clever-plugin</li>
<li>http://www.evohosting.co.uk/blog/web-development/wordpress-web-development/6-of-the-best-wordpress-security-plugins/</li>
<li>http://www.labnol.org/internet/improve-wordpress-security/24639/</li>
<li>https://www.linkedin.com/groups/Security-suggestions-1482937.S.199139568#commentID_110730071</li>
<li>http://www.practicalwp.com/login-dongle-login-bookmarklet-for-wordpress/</li>
<li>http://www.wtfdiary.com/2012/08/8-ways-to-secure-your-wordpress-blog.html</li>
</ul>
<h4>Available translations</h4>
<ul>
<li>English (Andrea Ercolino)</li>
<li>Serbian (Borisa Djuraskovic)</li>
<li>Spanish (Andrea Ercolino)</li>
<li>Turkish (Hakan Er)</li>
</ul>
<p>NOTE: Here ‘bookmark’ and ‘bookmarklet’ are used interchangeably.</p>
<h3>Uninstall Instructions</h3>
<ol>
<li>Click the <em>Delete</em> button in the <em>Plugins/Installed Plugins</em> list.</li>
</ol>
<p>If you manually removed the <em>login-dongle</em> plugin directory, or if your version was prior to 1.4.0,<br />
some garbage is left into your database. It’s harmless, but if you still want to clean it up, access<br />
the <em>options</em> table and remove all the rows whose <em>option_name</em> column start with <em>login_dongle</em>.</p>
<p>If your version was prior to 1.1.0, edit the <em>wp-login.php</em> file in the root<br />
directory of your blog and remove the line that begins with <code>do_action('login-start');</code></p>
<h3>Banner</h3>
<p>From <a href="http://www.flickr.com/photos/fotologic/4891100379" rel="nofollow ugc">Rusty door</a>, taken by<br />
<a href="http://www.flickr.com/photos/fotologic/" rel="nofollow ugc">fotologic</a> on August 14, 2010 in Penbryn, Wales, GB.</p>


Login Dongle

The bookmark to login nobody but you. Simple and secure.

XML-RPC Settings vs Login Dongle