6. securing xmlrpc.php
secure your login page
monitor changes on the filesystem
run updates
get a secure hostingprovider
other considerations
dinsdag 25 oktober 16
7. why are we doing this?
DDoS via XML-RPC pingbacks
brute force attacks via XML-RPC
dinsdag 25 oktober 16
10. securing xmlrpc.php
secure your login page
monitor changes on the filesystem
run updates
get a secure hostingprovider
other considerations
dinsdag 25 oktober 16
12. securing xmlrpc.php
secure your login page
monitor changes on the filesystem
run updates
get a secure hostingprovider
other considerations
dinsdag 25 oktober 16
13. Use inotify to monitor your filesystem
access
modify
attrib
open
create
delete
watch for files being accessed
watch if files are being written to
watch if metadata is altered
watch if a file is opened
watch if a file is created
watch if a file is deleted
dinsdag 25 oktober 16
14. securing xmlrpc.php
secure your login page
monitor changes on the filesystem
run updates
get a secure hostingprovider
other considerations
dinsdag 25 oktober 16
15. securing xmlrpc.php
secure your login page
monitor changes on the filesystem
run updates
get a secure hostingprovider
other considerations
dinsdag 25 oktober 16
16. support recent versions of PHP
offer SSL
good customer service
regular and tested backups
DDOS prevention & intrusion detection
dinsdag 25 oktober 16
17. securing xmlrpc.php
secure your login page
monitor changes on the filesystem
run updates
get a secure hostingprovider
other considerations
dinsdag 25 oktober 16
18. username and password
disable file editor
least privileged principles
know your code
delete unused plugins/themes
obscure the login page
dinsdag 25 oktober 16
19. Thank you for your time
Pieter Daalder
@w1zz
Vevida
WordPress expert
cooking (esp. bbq)
gardening
videogames
dinsdag 25 oktober 16