Admin Tools for WordPress Nicholas K. Dionysopoulos Davide Tampellini Admin Tools for WordPress Nicholas K. Dionysopoulos Davide Tampellini Copyright © 2017-2021 Akeeba Ltd Abstract This book covers the use of the Admin Tools for WordPress site security plugin for WordPress™ -powered web sites. Both the free Admin Tools Core and the subscription-based Admin Tools Professional editions are completely covered. Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.3 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license is included in the appendix entitled "The GNU Free Documentation License". Table of Contents 1. Getting Started .......................................................................................................................... 1 1. What is Admin Tools? ....................................................................................................... 1 1.1. Disclaimer ............................................................................................................. 1 1.2. The philosophy ....................................................................................................... 2 2. Server environment requirements ......................................................................................... 2 3. Installing Admin Tools ....................................................................................................... 3 3.1. Updating to the latest version .................................................................................... 3 4. Upgrading from Core to Professional .................................................................................... 4 5. Requesting support and reporting bugs .................................................................................. 4 6. Quick Setup ...................................................................................................................... 4 2. Using Admin Tools ................................................................................................................... 7 1. The Control Panel ............................................................................................................. 7 2. The Plugin Params page .................................................................................................... 10 3. Fixing the permissions of files and directories ....................................................................... 12 3.1. Configuring the permissions of files and directories ..................................................... 13 4. Emergency Off-Line Mode ................................................................................................ 15 5. Protecting Admin Tools with a password (Master Password) ................................................... 17 6. Protect your WordPress administration with a password .......................................................... 19 7. The .htaccess maker ......................................................................................................... 21 7.1. Basic Security ....................................................................................................... 23 7.2. Server protection ................................................................................................... 29 7.2.1. How to determine which exceptions are required .............................................. 31 7.3. Custom .htaccess rules ............................................................................................ 32 7.4. Optimisation and utility .......................................................................................... 33 7.5. System configuration .............................................................................................. 39 8. Malware Detection (the PHP File Scanner) ........................................................................... 40 8.1. How does it work and what should I know? ............................................................... 42 8.2. Configuration ........................................................................................................ 43 8.3. Scanning and administering scans ............................................................................ 45 8.4. Reading the reports ................................................................................................ 47 8.5. Automating the scans (CRON jobs) .......................................................................... 49 8.6. Automating the scans (scheduling URL) .................................................................... 49 9. Web Application Firewall .................................................................................................. 51 9.1. How WAF works and optimization .......................................................................... 54 9.2. Configure ............................................................................................................. 57 9.2.1. Basic Protection Features ............................................................................. 58 9.2.2. Request Filtering ......................................................................................... 63 9.2.3. Hardening Options ...................................................................................... 65 9.2.4. Cloaking .................................................................................................... 68 9.2.5. Project Honeypot ........................................................................................ 69 9.2.6. Exceptions ................................................................................................. 71 9.2.7. Auto-ban ................................................................................................... 73 9.2.8. Logging and reporting ................................................................................. 75 9.2.9. Customisation ............................................................................................. 78 9.3. WAF Exceptions ................................................................................................... 79 9.4. Administrator IP Whitelist ...................................................................................... 81 9.5. Site IP Blacklist .................................................................................................... 84 9.6. Anti-spam Bad Words ............................................................................................ 87 9.7. Geographic blocking .............................................................................................. 88 9.8. Security Exceptions Log ......................................................................................... 89 9.8.1. List of blocking reasons ............................................................................... 89 9.9. Auto IP Blocking Administration ............................................................................. 91 9.10. Auto IP Blocking History ...................................................................................... 92 9.11. Email templates ................................................................................................... 93 10. WordPress tools ............................................................................................................. 96 iii Admin Tools for WordPress 10.1. Update WordPress salts ........................................................................................ 97 10.2. Password expiration ............................................................................................. 98 10.3. Advanced WordPress options ................................................................................. 98 10.3.1. Post settings ............................................................................................. 99 10.3.2. System settings ....................................................................................... 100 11. Database tools .............................................................................................................. 101 12. HTTPS Tools ............................................................................................................... 102 13. URL Redirection .......................................................................................................... 102 14. Import and Exporting Settings ........................................................................................ 105 A. GNU General Public License version 3 ..................................................................................... 106 B. GNU Free Documentation License ........................................................................................... 115 iv Chapter 1. Getting Started 1. What is Admin Tools? Admin Tools is a security plugin, a software solution which will help you tighten the security of your WordPress site. Moreover, it has several features which will help you enhance the performance of your site and make your life administering the site a bit easier. Admin Tools is written with PHP and WordPress best practices in mind. It uses a native WordPress plugin to apply its security and performance enhancing features. It does not modify WordPress' core files ("core hacks"), therefore allowing you to update WordPress trouble-free. In fact, we only