Thomas Günther
80fb6cd452
xmlrpc deaktivieren Autorenscan deaktivieren Scripting in /wp-content/uploads/ deaktivieren Zugriff auf potenziell sensible Dateien blockieren Dateieditor im WP Dashboard deaktivieren Skriptverkettung deaktivieren Skriptausführung im Include-Verzeichnis deaktivieren Zugriff von ungewollten Bots verbieten Auflistung von Verzeichnissen deaktivieren Debug-Ausgaben deaktivieren Login-URL ändern
118 lines
8.8 KiB
PHP
118 lines
8.8 KiB
PHP
<h2><?= __('Extended Security', BDP_LV_PLUGIN_SLUG); ?></h2>
|
|
|
|
<div class="bdp_setting_box">
|
|
<input <?php if (is_xmlrpc_disabled()) {echo ' checked';} ?> type="checkbox" id="sec_mod_1" name="security_settings[]" value="option_disable_xmlrpc" />
|
|
<label for="sec_mod_1">
|
|
<?= __('Disable xmlrpc', BDP_LV_PLUGIN_SLUG); ?><br />
|
|
<span>
|
|
<?= __('By introducing the REST API in WordPress, xmlrpc. However, php is no longer needed to communicate outside of WordPress, which is why there is no longer any reason to leave it active or use it. Therefore, for the security of your site, it is better to deactivate or delete it.', BDP_LV_PLUGIN_SLUG); ?>
|
|
</span>
|
|
</label>
|
|
</div>
|
|
<div class="bdp_setting_box">
|
|
<input <?php if (is_authorscan_blocked()) {echo ' checked';} ?> type="checkbox" id="sec_mod_2" name="security_settings[]" value="option_block_authorscan" />
|
|
<label for="sec_mod_2">
|
|
<?= __('Disable Authorscan', BDP_LV_PLUGIN_SLUG); ?><br />
|
|
<span>
|
|
<?= __('The author page in WordPress typically displays a list of all posts by a specific author on your website. Unfortunately, Google also records the page and to prevent this, we can deactivate the author page. When a visitor clicks on an name of an author, they are redirected to the author page. This page contains a list of posts written by this author, as well as possibly a brief description of the author and a photo. It is also possible to record which user names have been created.', BDP_LV_PLUGIN_SLUG); ?>
|
|
</span>
|
|
</label>
|
|
</div>
|
|
<div class="bdp_setting_box">
|
|
<input <?php if (is_execution_in_uploads_blocked()) {echo ' checked';} ?> type="checkbox" id="sec_mod_3" name="security_settings[]" value="option_block_execution_in_uploads" />
|
|
<label for="sec_mod_3">
|
|
<?= __('Disable scripting in /wp-content/uploads/', BDP_LV_PLUGIN_SLUG); ?><br />
|
|
<span>
|
|
<?= __('Disabling scripting in /wp-content/uploads/ can be a security measure to protect your WordPress website from potential threats. The /wp-content/uploads folder is usually the default folder where WordPress stores uploaded files, such as images, videos, and other media files.', BDP_LV_PLUGIN_SLUG); ?>
|
|
</span>
|
|
</label>
|
|
</div>
|
|
<div class="bdp_setting_box">
|
|
<input <?php if (is_access_for_special_files_prohibited()) {echo ' checked';} ?> type="checkbox" id="sec_mod_4" name="security_settings[]" value="option_prohibit_special_files" />
|
|
<label for="sec_mod_4">
|
|
<?= __('Block access to potentially sensitive files', BDP_LV_PLUGIN_SLUG); ?><br />
|
|
<span>
|
|
<?= __('This setting prohibits access to configuration files and log files', BDP_LV_PLUGIN_SLUG); ?>
|
|
</span>
|
|
</label>
|
|
</div>
|
|
|
|
<div class="bdp_setting_box">
|
|
<input <?php if (true === is_file_editor_diabled()) {echo ' checked';} ?> type="checkbox" id="sec_mod_5" name="security_settings[]" value="option_file_editor" />
|
|
<label for="sec_mod_5">
|
|
<?= __('Disable file editor in WP Dashboard', BDP_LV_PLUGIN_SLUG); ?><br />
|
|
<span>
|
|
<?= __('This is a security feature that allows you to prevent users from editing theme and plugin files directly from the WordPress dashboard. This can be useful for a variety of reasons, including preventing accidental code changes and protecting your website from malicious attacks.', BDP_LV_PLUGIN_SLUG); ?>
|
|
</span>
|
|
</label>
|
|
</div>
|
|
|
|
<div class="bdp_setting_box">
|
|
<input <?php if (true === is_conatenation_disabled()) {echo ' checked';} ?> type="checkbox" id="sec_mod_6" name="security_settings[]" value="option_disable_conatenation" />
|
|
<label for="sec_mod_6">
|
|
<?= __('Disable script concatenation', BDP_LV_PLUGIN_SLUG); ?><br />
|
|
<span>
|
|
<?= __('Disabling script concatenation in the WordPress admin panel is a simple and effective way to enhance performance. However, it is crucial to carefully consider the impact of this change, as it may increase the number of HTTP requests, potentially affecting loading times', BDP_LV_PLUGIN_SLUG); ?>
|
|
</span>
|
|
</label>
|
|
</div>
|
|
|
|
<div class="bdp_setting_box">
|
|
<input <?php if (true === is_includedir_protected()) {echo ' checked';} ?> type="checkbox" id="sec_mod_7" name="security_settings[]" value="option_secure_include_dir" />
|
|
<label for="sec_mod_7">
|
|
<?= __('Disable script execution in include dir', BDP_LV_PLUGIN_SLUG); ?><br />
|
|
<span>
|
|
<?= __('Limiting script execution in specific directories can improve security by preventing potentially malicious scripts from running in critical parts of the WordPress system. This is particularly important to prevent attacks such as Cross-Site Scripting (XSS), which inject malicious code into website content.', BDP_LV_PLUGIN_SLUG); ?>
|
|
</span>
|
|
</label>
|
|
</div>
|
|
|
|
<div class="bdp_setting_box">
|
|
<input <?php if (true === is_bot_access_prohibited()) {echo ' checked';} ?> type="checkbox" id="sec_mod_8" name="security_settings[]" value="option_prohibit_bot_access" />
|
|
<label for="sec_mod_8">
|
|
<?= __('Prohibit access from unwanted bots', BDP_LV_PLUGIN_SLUG); ?><br />
|
|
<span>
|
|
<?= __('Excluding specific bots from a WordPress website provides improved security by reducing potentially malicious activity and security risks, optimizes resource consumption and site performance, protects against content theft and duplicate content, enables more precise control of traffic, and promotes more effective SEO -Optimization by reducing irrelevant bots, ultimately leading to a safer, more efficient and better performing website.', BDP_LV_PLUGIN_SLUG); ?><br />
|
|
<a href="site-health.php?tab=bdp_enhanced_security&subpage=botlist"><?= __('Bot Detection Database', BDP_LV_PLUGIN_SLUG); ?></a>
|
|
|
|
</span>
|
|
</label>
|
|
</div>
|
|
|
|
<div class="bdp_setting_box">
|
|
<input <?php if (true === is_directory_listing_disabled()) {echo ' checked';} ?> type="checkbox" id="sec_mod_9" name="security_settings[]" value="option_block_directory_listing" />
|
|
<label for="sec_mod_9">
|
|
<?= __('Disable directory listing', BDP_LV_PLUGIN_SLUG); ?><br />
|
|
<span>
|
|
<?= __('Directory listing should be disabled to ensure the security and privacy of a website. When Directory Listing is enabled, this allows users to directly access the contents of directories on a web server without having to specify a specific file. This can expose sensitive information such as directory structures, internal files and scripts, posing a potential security risk. Disabling Directory Listing prevents users from accessing this sensitive information, thereby providing an additional layer of security for the website.', BDP_LV_PLUGIN_SLUG); ?>
|
|
</span>
|
|
</label>
|
|
</div>
|
|
|
|
<div class="bdp_setting_box">
|
|
<input <?php if (true === is_wp_debug_diabled()) {echo ' checked';} ?> type="checkbox" id="sec_mod_10" name="security_settings[]" value="option_disable_wp_debug" />
|
|
<label for="sec_mod_10">
|
|
<?= __('Disable debug output', BDP_LV_PLUGIN_SLUG); ?><br />
|
|
<span>
|
|
<?= __('Debugging should be disabled to protect sensitive information about the internal structure and potential security vulnerabilities of a a WordPress website from potential attackers. When debugging is enabled, error messages and warnings are displayed directly on the website, which can provide attackers with valuable information about the configuration of the website and possible vulnerabilities.', BDP_LV_PLUGIN_SLUG); ?>
|
|
</span>
|
|
</label>
|
|
</div>
|
|
<div class="bdp_setting_box">
|
|
<input <?php if (null !== is_login_rewritten()) {echo ' checked';} ?> type="checkbox" id="sec_mod_11" name="security_settings[]" value="option_rewrite_url" />
|
|
<label for="sec_mod_11">
|
|
<?= __('Change Login URL', BDP_LV_PLUGIN_SLUG); ?><br />
|
|
<span>
|
|
<?= __('Changing the default login URL of WordPress is advisable to enhance the security of your website. By default, WordPress login URLs is /wp-admin or /wp-login.php, which are easily guessed by hackers and facilitate attacks such as brute-force attacks. Changing the login URL to something unique and difficult to guess increases security since potential attackers will struggle to find the correct URL. This can help protect your website from unauthorized access and other malicious activities.', BDP_LV_PLUGIN_SLUG); ?><br />
|
|
<label style="font-weight: bold;">
|
|
<?= __('Login-URL', BDP_LV_PLUGIN_SLUG) ?>: <?= get_site_url(); ?>/<input style="width: 100px;" class="long_text" type="text" name="rewrite_login" id="rewrite_login" value="<?= is_login_rewritten(); ?>">
|
|
</label>
|
|
</span>
|
|
</label>
|
|
</div>
|
|
|
|
|
|
|
|
<br /><br />
|
|
<input type="submit" class="button" value="<?= __('Save changes', BDP_LV_PLUGIN_SLUG); ?>" />
|
|
<a class="button" href="site-health.php?tab=bdp_enhanced_security&action=updatesitekeys"><?= __('Change site keys', BDP_LV_PLUGIN_SLUG); ?></a>
|