![\"Lockdown](\"http:\/\/www.shinephp.com\/wp-content\/uploads\/2011\/06\/wp-login.png\" "\\"Lockdown")
<\/a>Lockdown WP Admin<\/p><\/div> Lockdown WP Admin Settings<\/p><\/div> \nLast feature is concerned of mechanism of HTTP authentification for users of your blog. The idea is interesting. If you turn on this feature and select “WordPress Login Credentials” option then you should not modify manually your .htaccess or .htpasswd files, etc. Due to this plugin server during realizing HTTP authentication will check user’s login and password from his WordPress user account. It’s quit good and interesting idea, as using direct .htaccess, .htpasswd technique is not possible if you have multi-users access to your admin back-end. It’s difficult to support such password database manually. Lockdown WP admin private users<\/p><\/div> \nI had problems with HTPP authentification here. HTPP authentification feature worked at my local test installation, but it didn’t work at site located on 1and1.com<\/a> hosting. Furthermore, HTTP authentification took place not before showing WordPress login form, but just after. That is WordPress checks user name and password, tells you or intruder if user name and password valid or not and show HTPP authentification popup window just after that. That is the main purpose of using HTTP authentification – prevent blog from brute force passwod cracking attacks – is not fulfilled here. If intruder gets valid WordPress username and password via software bot then he may login with manual input of user credentials into HTPP authentification popup window.\n<\/p>\n According to written above I don’t recomend you to use the HTTP authentification feature offered by “Lockdown WP admin” plugin.<\/span><\/p>\n \nPHP code is accurate and well commented. It is a plus. The big minus I found reading PHP code is the spyware feature which this plugin includes. I’m sure if plugin author needs such information he should give to the user the choice, ask his permission for sending these data. I don’t see that ‘Lockdown WP admin’ works a such way. So if you plan to use this useful in general plugin and don’t wish to send your data to the external server, you should comment the line #505, 506, 507 at the ‘lock-down-wp-admin.php’ file. Look at the code fragment below for your reference:<\/p>\n Method which send your data to the plugin’s author is:<\/p>\n As we can see from the comments to the method above it is included to plugin temporarily. But there is nothing more permanent than something temporary. In any case plugin user should know if his data is sent anywhere.<\/p>\n Text above is about version 1.6. After 3 days only after this post publication Sean Fisher published version 1.7 which is free from sending data to the external site functionality. I compared 1.6 and 1.7 versions with diff tool and confirm that “Lockdown WordPress Admin”<\/strong> or shortly “Lockdown WP Admin” plugin for WordPress is one of plugins concerned WordPress security enhancement. You can locate it at the WordPress repository<\/a>. Plugin author is Sean Fisher<\/a>. Last version available for the moment of writing this review is 1.6.
\n“Lockdown WordPress Admin”<\/strong> or shortly “Lockdown WP Admin” plugin for WordPress is one of plugins concerned WordPress security enhancement. You can locate it at the WordPress repository<\/a>. Plugin author is Sean Fisher<\/a>. Last version available for the moment of writing this review is 1.6.
\nLets go and see step by step what this plugin offers to the WordPress adminstrator to make WordPress more secure.
\n1st,<\/strong> “Lockdown WP admin” hides wp-admin directory from the un-logged-in visitor. Such visitor will get 404 page not found HTTP error in its browser if he requests http:\/\/yourblogdomain\/wp-admin\/ URL.
\nIn order to activate this feature turn on “Yes, please hide WP Admin from the user when they aren’t logged in” checkbox via the “Lockdown WP” menu item at the “Lockdown WP” submenu of your WordPress administrator dashboard. I tested it on two WordPress installations (local and remote one hosted at the shared 1and1.com<\/a> hosting. Tests were successful in both cases. Conclusion: this useful feature works.<\/span>
\n
\nThe second way to login into WordPress beside of sending request to wp-admin folder directly is WordPress login link – wp-login.php by default. So we came to the
\n2nd,<\/strong> “Lockdown WP admin” can change your blog login link, thus it could be e.g. http:\/\/yourblog\/secretloginlink\/<\/code> instead of http:\/\/yourblog\/wp-login.php<\/code> by default. Tested. Conclusion: This feature works also.<\/span>
\nTwo useful features described above could help you protect your blog from the brute force attacks. <\/p>\n
\nOther option is to use separate user name and password for HTTP authentication. You can add\/delete users to such list via “Private users” menu item at the “Lockdown WP” submenu.
\n
\nIn case something goes wrong with HTPP authentification plugin has a feature to discard this option without deleting the plugin itself. You may put the empty ‘disable_auth.txt’ file into plugin directory for that.<\/p>\n
\nWarning!<\/span> Once a week if user update plugin’s settings “Lockdown WP admin” plugin sends valuable information to plugin’s author site. URL is http:\/\/labs.talkingwithsean.com\/lockdown-api\/main\/send\/<\/span>
\nLet’s see on the example of data which is sent to the external server:
\n[ld_admin_version] => 1.5
\n[server] => www.shinephp.my
\n[request_url] => \/wp-admin\/admin.php?page=lockdown-wp-admin
\n[wordpress_version] => 3.1.3
\n[url] => http:\/\/www.shinephp.my
\n[charset] => UTF-8
\n[login_base] => your-secret-login-directory-here
\n[ld_http_auth] => none
\n[ld_hide_wp_admin] => yep
\n[permalink_structure] => \/%postname%
\n[server_software] => Apache\/2.2.14 (Ubuntu)
\n[query_string] => page=lockdown-wp-admin
\n[wp_version] => 3.1.3\n<\/p>\n\r\n \/\/ The stats\r\n\t$check_stats_sent = get_transient('ld_send_stats');\r\n\tif ( !$check_stats_sent )\r\n\t $this->send_stats();\r\n<\/pre>\n\r\n \/**\r\n\t * Send stats\r\n\t *\r\n\t * Send anyomous stats to help out the development of the plugin.\r\n\t * This should be pretty temporary.\r\n\t * @access private\r\n\t**\/\r\n\tpublic function send_stats()\r\n\t{\r\n\t\tglobal $wp_version;\r\n\t\t\r\n\t\t$to_post = array(\r\n\t\t\t'ld_admin_version'\t=>\t$this->ld_admin_version,\r\n\t\t\t'server'\t\t\t=>\t$_SERVER['HTTP_HOST'],\r\n\t\t\t'request_url'\t\t=>\t$_SERVER['REQUEST_URI'],\r\n\t\t\t'wordpress_version'\t=>\t$wp_version,\r\n\t\t\t'url'\t\t\t\t=>\tget_bloginfo( 'url' ),\r\n\t\t\t\/\/\tI reconsidered this..\r\n\t\t\t\/\/\t'admin_email'\t\t=>\tget_bloginfo('admin_email'),\r\n\t\t\t'charset'\t\t\t=>\tget_bloginfo('charset'),\r\n\t\t\t'login_base'\t\t=>\t$this->login_base,\r\n\t\t\t'ld_http_auth'\t\t=>\tget_option('ld_http_auth'),\r\n\t\t\t'ld_hide_wp_admin'\t=>\tget_option('ld_hide_wp_admin'),\r\n\t\t\t'permalink_structure'\t=>\tget_option('permalink_structure'),\r\n\t\t\t'server_software'\t\t=> $_SERVER['SERVER_SOFTWARE'],\r\n\t\t\t'query_string'\t\t\t=> $_SERVER['QUERY_STRING'],\r\n\t\t\t'wp_version'\t\t\t=>\t$wp_version,\r\n\t\t);\r\n\t\t \r\n\t\tif ( function_exists('got_mod_rewrite '))\r\n\t\t\t$to_post['got_mod_rewrite '] = got_mod_rewrite();\r\n\t\t\r\n\t\t$options = array(\r\n\t\t\t'timeout' => ( ( defined('DOING_CRON') && DOING_CRON ) ? 30 : 3),\r\n\t\t\t'body' => array( 'data' => serialize( $to_post ) ),\r\n\t\t\t'user-agent' => 'WordPress\/' . $wp_version . '; ' . get_bloginfo( 'url' )\r\n\t\t);\r\n\r\n\t\t$raw_response = wp_remote_post('http:\/\/labs.talkingwithsean.com\/lockdown-api\/main\/send\/', $options);\r\n\t\t\r\n\t\t\/\/\tSet that we sent it\r\n\t\tset_transient('ld_send_stats', 'true', 604800);\r\n\t\t\r\n\t\t\/\/\tWhat'd they respond?\r\n\t\tif ( is_wp_error( $raw_response ) )\r\n\t\t\treturn FALSE;\r\n\t\r\n\t\tif ( 200 != $raw_response['response']['code'] )\r\n\t\t\treturn FALSE;\r\n\t\r\n\t\t$response = json_decode( unserialize( $raw_response['body'] ) );\r\n\t\t\r\n\t\tif ( !is_array( $response ) )\r\n\t\t\treturn FALSE;\r\n\t\t\t\r\n\t}\r\n}\r\n<\/pre>\nsend_stats()<\/code> method was removed from the code. Thanks to Sean for so fast release of the updated code.<\/p>\n","protected":false},"excerpt":{"rendered":"
\nLets go and see step by step what this plugin offers to the WordPress adminstrator to make WordPress more secure.<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"ngg_post_thumbnail":0},"categories":[8,4],"tags":[5,522,520,24],"yoast_head":"\n