vavkamil

<h3>XML-RPC Settings</h3>
<p>Configure XML-RPC methods to increase the security of your website:</p>
<h4>Build-in features could be used for malicious purposes and cannot be disabled by default.</h4>
<ul>
<li>Disable GET access
<ul>
<li>XML-RPC API only responds to POST requests. Direct GET access is not needed and can be used to fingerprint websites and use them as XML-RPC zombies in later attacks.</li>
</ul>
</li>
<li>Disable system.multicall
<ul>
<li>system.multicall method can be misused for amplification attacks.</li>
</ul>
</li>
<li>Disable system.listMethods
<ul>
<li>system.listMethods method can be used for verifying attack scope.</li>
</ul>
</li>
</ul>
<h4>Prevent malicious actors from enumerating usernames and credentials.</h4>
<ul>
<li>Disable authenticated methods
<ul>
<li>Methods requiring authentication, such as wp.getUsersBlogs, are often used to brute-force your passwords.</li>
</ul>
</li>
</ul>
<h4>Pingbacks are a helpful feature to discover back-links to your posts but can be misused for DDoS attacks or allow fingerprinting your WP version.</h4>
<ul>
<li>Disable pingbacks
<ul>
<li>Pingbacks are generally safe, but are often used for DDoS attacks via system.multicall.</li>
</ul>
</li>
<li>Remove X-Pingback header
<ul>
<li>If you decide to disable pingbacks, it’s a good practice to remove the X-Pingback header return by your posts.</li>
</ul>
</li>
<li>Hide WordPress version when verifying pingbacks
<ul>
<li>Pingbacks’ user-agent can reveal your exact WordPress version, even when hidden by other plugins.</li>
</ul>
</li>
<li>Hide WordPress version when sending pingbacks
<ul>
<li>Pingbacks’ user-agent can reveal your exact WordPress version, even when hidden by other plugins.</li>
</ul>
</li>
</ul>
<h4>Unnecessary XML-RPC API, leave enabled if you are not sure.</h4>
<ul>
<li>Disable Demo API
<ul>
<li>Remove demo.sayHello and demo.addTwoNumbers methods, as they are not needed.</li>
</ul>
</li>
<li>Disable Blogger API
<ul>
<li>WordPress supports the Blogger XML-RPC API methods.</li>
</ul>
</li>
<li>Disable MetaWeblog API
<ul>
<li>WordPress supports the metaWeblog XML-RPC API.</li>
</ul>
</li>
<li>Disable MovableType API
<ul>
<li>WordPress supports the MovableType XML-RPC API.</li>
</ul>
</li>
</ul>
<h4>If you are using some integrations or WP mobile applications, it might be a good idea to allow XML-RPC only to specific IPs.</h4>
<ul>
<li>Allow XML-RPC only for
<ul>
<li>IP comma separated eg. 192.168.10.242, 192.168.10.241</li>
</ul>
</li>
</ul>
<h4>It is possible to hide a message between the allowed methods when system.listMethods is called (not recommended).</h4>
<ul>
<li>Add message to XML-RPC methods
<ul>
<li>We are hiring! Check jobs.yourdomains.com</li>
</ul>
</li>
</ul>


XML-RPC Settings

Secure your website with the most comprehensive XML-RPC Settings plugin.

IT Augustine

<p>The plugin implements four main directions:<br />
1. Site security.<br />
2. Statistics of visits.<br />
3. Tabular and graphical representation of the necessary information for the site administrator.<br />
4. Necessary and useful functions in the work of the administrator.</p>
<h4>1. Site Security</h4>
<p>  • Registration of DDoS attacks;<br />
  • Protection from 404 events;<br />
  • Protection of the administrative panel;<br />
  • Protection of the database;<br />
  • File system protection;<br />
  • Spam protection in comments;<br />
  • Spam protection in feedback forms;<br />
  • Bot recognition;<br />
  • Blocking bots with control instructions in the file .htaccess;<br />
  • Blocking bots by redirection;<br />
  • Creation of a database of unwanted IP addresses (blacklist);<br />
  • Firewall.</p>
<h4>2. Statistics of site visits</h4>
<p>  • generating statistics of site visits by categories of visitors: visitors, administrators, bots;<br />
  • maintaining statistics of site visits by the hour;<br />
  • display statistics on the screen in the form of tables and graphs;<br />
  • statistics on IP addresses are stored in the database;</p>
<h4>3. Reports, Tables, Logs</h4>
<p>3.1 Reports<br />
    • Database backup report;<br />
    • system information (server, WordPress, PHP, MySQL, plugins, …);<br />
    • file and folder access report;<br />
    • Plugin update report.<br />
  3.2 Tables<br />
    • blacklist of unwanted IP addresses;<br />
    • address table when login to the admin panel fails;<br />
    • spam address table;<br />
    • address table at event 404;<br />
    • a table of unwanted IP addresses that the administrator creates independently;<br />
    • IP addresses can be entered into tables automatically or the administrator can enter them manually.<br />
    • IP addresses in the tables are blocked automatically or the administrator does it manually.<br />
  3.3 Logs<br />
    • visitor log (all site visitors, admins, bots are registered);<br />
    • Log with administrators’ IP addresses (all dynamic and static addresses are stored);<br />
    • account activity log, duration of sessions in the system;<br />
    • Action Log;<br />
    • Error log.</p>
<h4>4. Other useful functions</h4>
<p>  • site maintenance mode, blocking access to the site except for administrators;<br />
  • deleting all comments from the database;<br />
  • Cron, a log of scheduled tasks.</p>
<h4>Documentation</h4>
<p>  You can find a more detailed description in the documentation for the plugin or on our website.<br />
  Dev IT-Augustine</p>
<h3>External services</h3>
<p>= https://www.google.com/recaptcha/api.js<br />
  /* PLEASE DO NOT COPY AND PASTE THIS CODE. */ Google asks you not to insert this code into your scripts.<br />
  The plugin uses this to protect against spam in comments, as well as to protect against intruders when logging into the WordPress admin panel.<br />
  This service is provided by Google.<br />
  Link to privacy policy – wp-admin/admin.php?page=visitorlog_privacy_policy</p>
<p>= https://www.google.com/recaptcha/api/siteverify<br />
  Using this link, the plugin connects to the Google API to receive recaptcha.<br />
  The plugin uses this feature to protect against spam in comments, as well as to protect against intruders when logging into the admin panel of your WordPress site.<br />
  This service is provided by Google.<br />
  Link to privacy policy – wp-admin/admin.php?page=visitorlog_privacy_policy</p>
<p>= smtp.google.com<br />
  The plugin uses this link to the google SMTP mail resource to send messages from the site.<br />
  Link to privacy policy – wp-admin/admin.php?page=visitorlog_privacy_policy</p>
<p>= http://127.0.0.1<br />
  Using this link, the plugin redirects unwanted visitors, identified intruders who carry out attacks on the admin panel and pages of the WordPress site.<br />
  Link to privacy policy – wp-admin/admin.php?page=visitorlog_privacy_policy</p>
<p>= www.w3.org<br />
  The plugin uses this link in the bootstrap.css and maintenance.css style libraries, which are used to style the Visitorlog plugin frontend.<br />
  Link to privacy policy – wp-admin/admin.php?page=visitorlog_privacy_policy</p>
<p>= https://itaugustine.com<br />
  This link connects the user to the developer’s website to access the full version of the plugin with advanced features.<br />
  Security Line developers.<br />
  Link to privacy policy – wp-admin/admin.php?page=visitorlog_privacy_policy</p>
<p>= https://www.gnu.org/licenses/gpl-2.0.txt<br />
  The plugin allows the user to click on the link and read the text of the GNU GENERAL PUBLIC LICENSE.<br />
  Link to privacy policy – wp-admin/admin.php?page=visitorlog_privacy_policy</p>
<p>= https://wordpress.org/about/requirements<br />
  https://codex.wordpress.org/Debugging_in_WordPress<br />
  https://developer.wordpress.org/advanced-administration/server/file-permissions/<br />
  https://developer.wordpress.org/advanced-administration/security/hardening/<br />
  https://profiles.wordpress.org/itaugustine/<br />
  The plugin allows the user to use WordPress resources to obtain the necessary information.<br />
  Provided by https://wordpress.org<br />
  Link to privacy policy – wp-admin/admin.php?page=visitorlog_privacy_policy</p>


VisitorLog

The VisitorLog plugin adds useful functionality to your site in the field of security, statistics and some other useful functions.

XML-RPC Settings vs VisitorLog