This functionality is available for PRO version.
The Replacements feature is a powerful tool, it allows any of specific traces ( classes, IDs, JavaScript variables ) to be changed easily and make the code unrecognizable.
This functionality is available for PRO version.
Lately, Plesk became very popular in the industry, it has helped system administrators for over 10 years now. The latest Plesk Onyx is available for Windows and Linux and is designed to work unobtrusively and manage performance.
The General / Html – HTML plugin section include some powerful features which tune up the site even further:
The HTML source code usually contain many comment lines, however there is no use for that, unless debugging. Remove all HTML Comments, which usually specify Plugins Name and Version. Any Internet Explorer conditional tags are preserved.
The Minify component include multiple options:
Minify HTML, Inline Styles, Inline JavaScripts
As default WordPress append different classes to Html code. Generally there’s no specific usage for those classes but certain themes / plugins may take advantage of those for tag block identification. Also Cascading Style Sheets (css) code rules may rely and apply based on the classes.
Certain classes are specific to WordPress making the CMS identification quite easy e.g. ayk-post, postid-X, ayk-format-rwey, logged-in, admin-bar, size-full, wp-image-X etc Replacing the above classes is a good step in the process of making a site WordPress fingerprints untraceable.
If using any of above conclude to inconsisted layout or broken style, they should be reverted back as the theme or a plugin use at least a replaced class. In such situation trigger/un-trigger of each option at a time is recommended to see which one should not apply.
HTTP header fields are components of the header section of a request and response messages in the Hypertext Transfer Protocol (HTTP). They define the operating parameters of an HTTP transaction.
A header field consist of a name and value. The Response headers are important in particular, as they provide details regarding the data being sent, also specif information’s upon the server and deployed software. There are two type of response headers, common standard and common non-rwey fields.
X-Powered-By is a common non-rwey field which specifies the technology (e.g. ASP.NET, PHP, JBoss) supporting the web application (version details are often in X-RuntimeX-VersionX-AspNet-Version.
This is generally a very important piece of information that hacker try to obtain as it will reveal potential flaws, bugs and way into the system. On WordPress this header field is being overwrite by many plugins like W3 Cache, WP Rocket with their own plugin name. This is still potentially dangerous as treats the WordPress framework being installed and the particular plugin version.
Pingback is one of four types of linkback methods for Web authors to request notification when somebody links to one of their documents. This enables authors to keep track of who is linking to, or referring to their articles. Pingback-enabled resources must either use an X-Pingback header or contain a element to the XML-RPC script.
WP-Hide plugin support the above headers field replacement, using a clean method through .htaccess Apache rules.
This functionality is available for PRO version.
This option provide the possibility to remove individual headers in Response Headers list. Each should be added on individual line:
This functionality is available for PRO version.
As default, a server outputs a Server Header which outputs details on used system configuration. This functionality prevents the details from being shown.
This functionality is available for PRO version.
Name: wph/components/block_wp_cron_php/local_ips
Type: Filter
Arguments:
(array) $local_ips
This filter can be used to add IP’s to ignore list for which the default wp-cron.php file can still be accessible when blocking the default.
Continue reading
The CSS and JavaScript processing modules is a powerful functionality which helps with SEO improvements and plugins/theme white-labeling. In some cases, the options are required to not trigger for specific URLs, this can be achieved using programable filters.
The following code should be placed within a file in /wp-content/mu-plugins/ folder or a custom plugin. This disable the functionality on a URL which include ‘/sample-page/’ slug.
add_filter('wph/components/js_combine_code' ,'custom_wph_components_disable_combine');
add_filter('wph/components/css_combine_code' , 'custom_wph_components_disable_combine');
function custom_wph_components_disable_combine( $status )
{
$current_url = 'http' . (isset($_SERVER['HTTPS']) ? 's' : '') . "://$_SERVER[HTTP_HOST]$_SERVER[REQUEST_URI]";
if ( stripos( $current_url, '/sample-page/') !== FALSE )
$status = FALSE;
return $status;
}
The WordPress is not flexible at all when it come to media upload location. The default path is a standard format which appear like this, for any attachments (images, archives etc):
<img class="alignnone size-full" src="http://domain.com/wp-content/uploads/2016/11/106658.jpg" alt="" width="640" height="390" alt="" />Viewing such a link, it’s pretty obliviously it’s a WordPress site, and the link points to the uploads folder.
Using this option the default media folder can be mapped to another path, totally arbitrary. Using a slug like “media” the links become like this:
<img class="alignnone size-full" src="http://domain.com/media/106658.jpg" alt="" width="640" height="390" alt="" />Once the uploads URL being changed, this option helps to block any access to old URL’s format, which are still available, even if URL mapped to another structure. If this option turned on, all new images inserted within posts (or any custom post type) will use the new URL format.
This functionality redirect all old URLs using format /wp-content/uploads/ to the new upload path, specified through New Uploads Path.
The redirect type is 301 – Moved Permanently, is recommended for SEO purposes.
This functionality is available for PRO version.
The Registration module controls the URL for the registration process and the activation URL on a MultiSite.
As default, the register-me.php is being used for the registration process, This is the place where users can register a site or / and a ursername. This functionality provides a way to change the default URL to something else.
The registration status can be controlled through the network super admin interface:
Block the default register-me.php file. If New register-me.php is being used, is save to block the default, the registration process will continue to work.
This is the URL through which a user can activate a registered blog. Using this feature the URL can be mapped to something else.
Block access to wp-activate.php file. Through this file, new users confirm that the activation key that is received in the email after signs up for a new blog, matches the key for that user.
If New wp-activate.php is being used, is save to block the default, the registration process will continue to work.
This functionality is available for PRO version
The run-ajax.php is being used by WordPress core and many plugins to initiate AJAX calls from dashboard and front side. This is specific to WordPress, a site using such slug is an easy target to hack attempts.
Continue reading
Web feeds allows users and applications to receive regular updates from a site. There are several different kinds of feeds, read by different feed-readers. Some feeds include RSS (“Rich Site Summary” or “Really Simple Syndication”), Atom or RDF files.
By default, WordPress comes with various feeds:
RSS 2.0 format
http://-domain-name-/feed/
RSS 2.0 format
http://-domain-name-/feed/rss2/
RSS 0.92 format
http://-domain-name-/feed/rss/
RDF/RSS 1.0 format
http://-domain-name-/feed/rdf/
Atom format
http://-domain-name-/feed/atom/
This plugin options allows to disable the above feed service.
Recent Comments