Hi, I want to know how i can check the wordpress website security. How can I check the firewall is working?
how to check wordpress website security
2 postsHi, I want to know how i can check the wordpress website security. How can I check the firewall is working?
Hi Wei.
You can check your WordPress security configuration directly in the BitFire settings page.
Simply open the page and in the security headers section click "test security headers". A New tab will open on securityheaders.com with the current status of the security headers on your site. This should be an "A". If it is not - you may have a caching plugin that is not caching the security headers. BitFire will serve the correct headers for any dynamic page.
You can check the WAF security by opening the cloudbrics WAFER scanner. enter your domain name and select "other", "verify by meta key", copy the key to the bitfire settings page and click "add tag", then tell WAFER to scan your website.
The scan may take several minutes depending on your site performance. The result should be an "A" or an "A+" if your hosting provider blocks some upstream tests that never make it to PHP.
To test the RASP functionality - first enable "always on protection" and disable File RASP in the settings: go to a directory on your website file explorer and create a new .php file. give it a random number file name like "81218236.php". Then enter this:
<?php
$wrote = file_put_contents('test-write.php', '<?php echo 'The site does not protect PHP files\n");
echo ($wrote > 0) ? "PHP is not protected" : "PHP is protected";
now in an incognito web browser open the file you just created - you should see: "PHP is not protected" and there will be a new file "test-write.php". Delete this file.
Now enable the file protection RASP and try the test again. You should see: "PHP is protected" and there will be no test-write.php file written. Now delete the test programs.
I hope this helps !
You can check your WordPress security configuration directly in the BitFire settings page.
Simply open the page and in the security headers section click "test security headers". A New tab will open on securityheaders.com with the current status of the security headers on your site. This should be an "A". If it is not - you may have a caching plugin that is not caching the security headers. BitFire will serve the correct headers for any dynamic page.
You can check the WAF security by opening the cloudbrics WAFER scanner. enter your domain name and select "other", "verify by meta key", copy the key to the bitfire settings page and click "add tag", then tell WAFER to scan your website.
The scan may take several minutes depending on your site performance. The result should be an "A" or an "A+" if your hosting provider blocks some upstream tests that never make it to PHP.
To test the RASP functionality - first enable "always on protection" and disable File RASP in the settings: go to a directory on your website file explorer and create a new .php file. give it a random number file name like "81218236.php". Then enter this:
<?php
$wrote = file_put_contents('test-write.php', '<?php echo 'The site does not protect PHP files\n");
echo ($wrote > 0) ? "PHP is not protected" : "PHP is protected";
now in an incognito web browser open the file you just created - you should see: "PHP is not protected" and there will be a new file "test-write.php". Delete this file.
Now enable the file protection RASP and try the test again. You should see: "PHP is protected" and there will be no test-write.php file written. Now delete the test programs.
I hope this helps !