The Security Extension of {eac}Doojigger enables general security options, Server-Side CORS (Cross-Origin Resource Sharing), and Risk Assessment tools providing a general-purpose and easy to use "firewall" to your WordPress site.

Security Settings

Change Login URI
Security by obscurity: Change the name of the well-known 'wp-login'. Users must login at this url before accessing the WordPress dashboard.

Add Secure Nonce
Add and verify a hidden 'number-used-once' security token to the login/reset forms to block malicious attacks.

Password Policy
Password policies for user profiles (enforce strong passwords).

Account Login Attempts
Lock the user account after n login attempts (0 = unlimited).

Account Lock Time
Lock the user account for n minutes after failed login.

Disable File Changes
WordPress supports online editing of theme and plugin code as well as automated core, theme, and plugin updates. These options disable editiing and file modifications. Disable file changes for everyday operation and enable when applying updates.

Disable REST Requests
REST (REpresentational State Transfer) API (Application Program Interface) - This option hides API index lists and may disable WP Core API URLS, un-authenticated requests, or all REST API URLs. Additionally, JSON requests to non-api URLs (often used in attacks) can be blocked.

• API Index List
• WordPress Core APIs
• Un-Authenticated APIs
• All REST APIs
• Non-REST JSON Requests

Disable XML-RPC
XML (eXtensible Markup Language) RPC (Remote Procedure Call) - XML-RPC may be used to attempt unauthorized access or to overload the site in a DDoS attack. Disable if XML-RPC is not needed.

Disable RSS/ATOM Feeds
RSS/ATOM URLs may be used to attempt unauthorized access or to overload the site in a DDoS attack. Disable if RSS/ATOM feeds are not needed.

Disable oEmbed exchange
oEmbed is a format for allowing an embedded representation of a URL on third party sites.

Require HTTP Headers
Require the presence of an HTTP header in all requests. If your web site is behind a CDN or proxy (e.g. CloudFlare), you may be able to use a CDN-specific (or custom) http header and verify its existance to block any attempt to bypass the CDN. You may enter the header name or header:value to validate a specific value.

Block HTTP Headers
Many bots or suspicious browsers include detectable http headers. Use this list to look for and block requests with any of these headers. You may enter the header name or header:value to block a specific value.

Disable Site URIs
Certain site URIs should be unavailable or may present a security concern. This option allows you to block access to those URIs. Enter URIs, 1 per line, starting with '/'. For example '/category/name/' or just '/category'

Block IP Addresses
Block specific IP addresses or host/referrer names. Enter addresses or subnets 1 per line.

192.168.100.1 or 192.168.100.0/16  
2001:0db8:85a3:08d3:1319:8a2e:0370:7334  
maliciousdomain.com  

Global Cookie Flags

Cookies to Exclude
Exclude these cookies when applying flags. Cookies may need to be accessable from the browser as well as the server, or with both http and https, or by 3rd parties (often for tracking).

WP Heartbeat Time
Although not a security concern, WordPress pings the server every 15 to 60 seconds. This option can be used to slow it down and lessen resource usage.

Disable Front-End Heartbeat
Often the WordPress heartbeat ping is not needed on the site's public front-end. It can be disabled here but may be required by WordPress scheduled tasks or certain plugins and themes.

Server Side CORS

Cross-origin resource sharing (CORS) is a security mechanism that allows a web page to access resources from a different domain than the one that served the page.

CORS Options
These options implement basic CORS security at the server level helping to prevent malicious activty from browser & non-browser sources.

• Apply CORS to REST requests
• Apply CORS to XML-RPC requests
• Apply CORS to AJAX requests
• Apply CORS to Other Post requests
• Use referring URL if no origin
• Use IP address if no origin
• Validate this site's origin to its IP address

CORS Origin Whitelist
Allow API access from specific origin domains only. Enter origin URLs, 1 per line beginning with 'http://' or 'https://, or simply the ending domain name (e.g. 'http://api.trusted_domain.com' or '.trusted_domain.com').

Allowed IP Addresses
Allow these IP addresses regardless of origin domain. Enter 1 IPv4 or IPv6 address or subnet (CIDR) per line.

CORS Exempt URIs
Exclude site URIs from CORS security checks, allowing access from any origin. Enter URIs, 1 per line, beginning with /.

Content Security Assistant

Facilitates the creation of a comprehensive *Content Security Policy** (CSP) by adding a security nonce to script and style link tags.

CSP Nonce
These options assist in building a CSP by adding a common, request-specific security nonce to source and in-line script tags and stylesheet link tags (excluding inline styles).

CSP Action
Use the 'eacDoojigger_content_security_policy' action to apply the "Content-Security-Policy" header or the 'eacDoojigger_security_nonce' filter to retreive the security nonce value.

Actions & Filters

content_security_policy - Allows actors to add their CSP with the provided nonce.

add_action('eacDoojigger_content_security_policy',function($nonce) {  
    header("Content-Security-Policy: script-src 'nonce-{$nonce}';");  
});  

set_security_nonce - Allows actors to override the setting of the security nonce.

add_filter('eacDoojigger_set_security_nonce',function($nonce) {  
    return $nonce;  
});  

security_nonce - Allows actors to retrieve the security nonce.

$nonce = apply_filter('eacDoojigger_security_nonce',false);  

Risk Assessment

Risk Assessment uses internal risk filters and optional RA provider extensions to obtain a risk level (0-100) based on IP address.

If more than one RA extension is enabled, each will be used, according to the 'Multiple RA Providers' setting, until a risk level is obtained.

Risk Assessment Limit
Block access to the web site based on a risk assessment level of n or higher.

Risk Assignment Threshold
Block access (and report) after an IP address has been tagged (internally) at least n times in a 12 hour period.

Multiple RA Providers

• Divergent
  • Check each RA until a risk assessment score is found, regardless of what that score is.
• Convergent
  • Check each RA until and unless the risk assessment score reaches or exceeds the risk assessment limit.
• Average
  • Sum the resulting scores of each RA and calculate the average of the scores.

Request Rate Limit
Limit the number of requests from the same source over a 10 minute period, blocking access, if exceeded, for up to 12 hours. This should be a number exceeding what would be considered normal for a human, but take into consideration legitimate scanning bots that may scan your entire site.

Register Risk API
This API may be used to (externally) redirect high-risk requests to be blocked and reported.

/wp-json/eacDoojigger/v1/register_fraud?score=nn  
/wp-json/eacDoojigger/v1/register_threat?score=nn  
/wp-json/eacDoojigger/v1/register_abuse?score=nn  
/wp-json/eacDoojigger/v1/register_risk?score=nn  

IP Block List
When an IP address is blocked, save it to a block list file (ip_block_list.conf) in your WordPress root folder. This file may be used by your server or router to block requests before reaching WordPress.

Banned IP Addresses
Treat additional IP addresses as high-risk (banned).

Whitelist IP Addresses
Allow these IP addresses regardless of risk assessment.

When an allow list file (ip_allow_list.conf) is found in your WordPress root folder, the content is read and parsed for allowed IP addresses, overriding the risk assessment.

Clear IP Address
Clear/reset risk tracking for this IP address.

Actions & Filters

register_{$type} - Allows actors to trigger a risk event. $type = fraud, threat, abuse, or risk.

do_action('eacDoojigger_register_threat',$message,$score,$http_status);

risk_assessment - Allows actors to trigger a risk assessment.

do_action('eacDoojigger_risk_assessment');

clear_risk_assessment - Allows actors to clear any previous risk assessment.

do_action('eacDoojigger_clear_risk_assessment', $ipAddress);

risk_assessment_result - Allows actors to process the risk assessment result.

add_action('eacDoojigger_risk_assessment_result',function($ra_data) {...});

risk_assessment_report - Allows actors to process a registered risk event.

add_action('eacDoojigger_risk_assessment_report', function($ipAddress,$registered,$threshold,$limit) {...});

risk_assessment_whitelist - Allows actors to filter the IP whitelist.

add_filter('eacDoojigger_risk_assessment_whitelist', function($whitelist) {...});

risk_assessment_blacklist - Allows actors to filter a blacklisted IP address.

add_filter('eacDoojigger_risk_assessment_blacklist', function($ipAddress) {...});

risk_assessment_data - Allows actors to filter the risk assessment data before being processed.

add_filter('eacDoojigger_risk_assessment_data', function($ra_data) {...});

risk_assessment_provider - Used by risk assessment provider extensions as part of the assessment.

add_filter('eacDoojigger_risk_assessment_provider', function($ra_data) {...});

risk_api_register_request - Allows actors to authorize a risk api event.

add_filter('eacDoojigger_risk_api_register_request', function($authorized) {...});

RA (AbuseIPDB)

A project dedicated to helping combat abusive activity on the internet. This API utilizes the AbuseIPDB database to block access based on the abuse confidence level.

API Key
Your AbuseIPDB API Key enables IP abuse detection and reporting.

Abuse Reporting
Report abuse attempts. File : create a CSV file that can be manually reviewed and uploaded. API : automatically transmit abuses through the AbuseIPDB API.

RA (FraudGuard)

A service designed to provide an easy way to validate usage by continuously collecting and analyzing real-time internet traffic. This API utilizes the FraudGuard database to block access based on the fraud risk level.

API Username
Your FraudGuard username & password enables IP fraud detection.

API Password
Your FraudGuard username & password enables IP fraud detection.

Subscription Plan
Your plan information is used to determine the API version & features and to guide the rate limiting rules.

RA (IpGeoLocation)

IpGeoLocation provides geographical information about website visitors with any IPv4 or IPv6 address as well as a threat score with all paid plans. This API utilizes the IpGeoLocation database to block access based on the threat score.

API Key
Your IpGeoLocation API Key enables IP threat detection.

Subscription Plan
Your plan information is used to determine the API features and to guide the rate limiting rules.

1. Security settings