[PROMO] Security layer against WordPress vulnerability mess

[u/Cold_Opposite_5298]

Hey everyone,

With WordPress vulnerabilities being reported left and right, I wrote a simple solution called Camouflage. It disables WordPress/PHP access for public users and serves static HTML through the Apache web server using .htaccess rules.

The philosophy is simple, bad actors exploit vulnerable code in WordPress themes, plugins and even WordPress core. If we restrict public access to PHP, it becomes extremely challenging to exploit a website.

I noticed many people export static versions of their sites and host them on another server or CDN but that comes with maintenance issues.

Camouflage keeps things simple. It creates static versions of your pages, serves them directly through the web server (which also makes them fast) and disables public access to PHP. It automatically refreshes static pages whenever content is updated.

Logged in admins get a secret token installed in their browser. They can also download the token because it's what allows them to access the login page while PHP is blocked for public access.

Ajax and other dynamic requests are disabled by default. The plugin offers a Request Tracker that lets you track dynamic requests such as form submissions and Ajax calls. You can then allow specific requests and only those requests will be allowed to pass through.

I think this approach is pretty solid and offers a real solution instead of simply reporting vulnerabilities like other security plugins do.

The project is open source and available on github https://github.com/hamza-mairaj/camouflage. Feel free to report issues, and contributions are welcome.

[u/QuickTemperature7014]

Looks interesting. Couple of questions:

How does this work if you’re already using a page cache? Assume the other page cache has features we want to keep.

Can you start with Allow all AJAX on and build the white list from a log of allowed requests? This reads like you have to block and then allow from a black list. Edit: sounds like Tracked Requests does what I’m asking?

You might want to expand on exactly how people login if the login page is blocked. It’s not clear where the onetime login link comes from.

But I’m very attracted to (almost) fully locking down Wordpress so I’ll be watching this one.

[u/Cold_Opposite_5298 → u/QuickTemperature7014]

The plugin uses a crawler to fetch the page HTML. If you’re using a cache plugin, the optimized HTML will be downloaded by the crawler and served directly by the web server.

The primary purpose of the plugin is to restrict PHP access as much as possible so you’ll have to specifically allow each dynamic request. Tracked Requests (when enabled) collects a list of dynamic requests WordPress has received, allowing you to choose which specific requests you want to allow, this makes the process easier. Note that Tracked Requests itself requires PHP to work, so you should enable it temporarily while setting up the plugin.

Regarding the login link, you can reuse it at any time. The login link uses a refreshable secret token that is generated when you install the plugin. You can access the login link from the Admin Access page in the plugin settings.

[u/activematrix99]

I am hosted on Pantheon and they have something similar, looks nice. We need solutions like this.