Protecting your site by detection

May 12, 20153 likes2,254 views

This document discusses ways to detect security issues on a WordPress site and server. It recommends using tools like ModSecurity, fail2ban, Apticron, and Apt-dater to monitor for updates, failed login attempts, and other security events. It also proposes building a WordPress plugin called WP Central that would aggregate security data from all sites and servers and provide a central dashboard. The plugin would monitor files, permissions, login attempts, and perform checksum scans to detect any changes or additions.

CODEKITCHENMarko Heijnen
Protecting your site by
detection

Marko Heijnen
• Founder of CodeKitchen
• Lead developer of GlotPress
• Core contributor for
WordPress
• Plugin developer
• Organizer for WordCamp
Belgrade
• Using lots of (new)
technologies

Recently lot’s of security
issues got reported

Stats first 5 months of 2015
• 3 core security updates
• Cross-site Scripting (XSS) due to the misuse of the
add_query_arg() and remove_query_arg()
functions
• Cross-site scripting (XSS) vulnerability inside the
popular JetPack plugin. and the default Twenty
Fifteen theme because of genericons.

My server setup
Loadbalancer
Webserver 1
Webserver 2
Memcached
Elasticsearch
MariaDB

My server setup
Public Private
Loadbalancer
Webserver 1
Webserver 2
Memcached
Elasticsearch
MariaDB

Do you know if you are
currently hacked???

Detection of your install
• Updates of WordPress, Plugins and themes
• Failed login attempts
• Security issues in plugins and themes
• Security enhancements reported by core
• List of plugins/themes you don’t use

Detection of the server
• Updates of server software
• Failed login attempts

Detection what is going on
• Requests to plugins you don’t have (404’s)
• Permissions of your folders/ﬁles
• Check if ﬁles got changed (Core, plugins, themes)
• Check if ﬁles got added (Core, plugins, themes)
• What is in your uploads folder (PHP ﬁles)

Software for security I use
• modsecurity / UFW on every server (default blocks
all)
• fail2ban
• apticron (only 1 per matching type)
• apt-dater-host (in combination with apt-dater)
• Own code

Apticron
• Cronjob checking if there are updates
• Mail you when there are updates
• Can mail the total list or only new updates

Apt-dater and Apt-dater-host
• Terminal-based remote package update manager
• A tool to manage a lot of servers
• Grouped same servers
• Install and update packages

My server setup
fail2ban
modsecurity
ufw
apticron
apt-dater-host
ufw
apticron (web1)
apt-dater-host ufw
apticron
apt-dater-host
Loadbalancer
Webserver 1
Webserver 2
Memcached
Elasticsearch
MariaDB

Features
• List all Linux packages
• List all PECL updates
• Shows if WP-CLI needs updating
• Restart services

Features
• List all WordPress updates
• Ability to perform updates when allowed
• Checksum scans
• Upload directory scans
• Doing backups
• Send WP CLI command

WP Central API
• http://wpcentral.io/api/
• First started with contributors
• After that stats
• Now creating checksums for plugins and themes
• Soon similar functionality as wpvulndb.com

Node.js server
• WordPress calls a microserver (nginx)
• nginx calls node.js server
• Returns the data when exists
• Will return error when not and generates the
checksums behind the scene

$WP Central API • http://wpcentral.io/api/checksums/theme/ twentyﬁfteen/1.2 • [{"code":"wpcentral_server_error","message":"Gener ating checksums”}] • [{"ﬁle":"header.php","checksum":"c0919b5f4b6e4f3a 58b858b2305e9146"},{},{},{},{},{},{},{},{},{},{},{},{},{}]$

Other solutions
• VaultPress
• ManageWP / WP Remote / InﬁniteWP
• Sucuri

There are WordPress
plugins you could use
But you should not trust that they do it all

Log aggregation
• Logstash
• Fluentd
• OSSEC

OSSEC
• An Open Source Host-based Intrusion Detection
System
• Performs log analysis, ﬁle integrity checking, policy
monitoring, rootkit detection, real-time alerting and
active response
• Works with a manager and agents
• https://hackertarget.com/defending-wordpress-
ossec/

Thank you for
listening
Questions?
@markoheijnen
markoheijnen.com 
 
codekitchen.eu

The document discusses the evolution of a server from Apache to Lighttpd to Nginx. Nginx provided significant performance improvements, reducing server load from over 26 to 0.3 while supporting over 4 million views per day. Nginx has a learning curve but simpler configurations that are easier to read and more flexible than previous solutions. It also works well with PHP-FPM for fast PHP processing and allows easy deployment and configuration of new CakePHP and PHP sites.

Generic Parse Serverdavidolesch

Niktopenetration Tester

Nikto is a popular webserver assessment tool that scans for over 6700 potentially dangerous files and programs, checks for outdated server versions of over 1250 servers, and identifies version-specific problems on 270+ servers. It identifies vulnerabilities very quickly but is not stealthy, making the scans obvious in server logs. Nikto allows tuning scans to specific categories like file uploads, information disclosure, or SQL injection, and has features like SSL support, HTTP proxy support, customizable reports, and host authentication.

CodeIgniter For Project : Lesson 103 - Introduction to CodeigniterWeerayut Hongsa

CodeIgniter is a PHP web application framework that uses a model-view-controller architecture. It has a small footprint and is simple to use. CodeIgniter projects have typical MVC structure with models for data, views for presentation, and controllers to link them. It works well on common LAMP stacks and recommends Apache, PHP 5.3+, and MySQL. Initial configuration involves setting up files for config, database, and routing.

Spinnaker for AzureLarry Guger

This document provides an overview of how Spinnaker integrates with Azure. It discusses the core principles of following an immutable infrastructure model and consistency across cloud providers. It also maps common Spinnaker concepts like accounts, server groups, and load balancers to their Azure equivalents. Additionally, it covers how Azure resource groups and networking are handled, and how Spinnaker uses pipelines to deploy server groups and enable traffic to new versions on Azure.

NGINX ADC: Basics and Best PracticesNGINX, Inc.

On-Demand: https://www.nginx.com/resources/webinars/nginx-adc-basics-best-practices/ In this webinar, we help you get started with NGINX, industry’s most ubiquitous web server and API gateway. We cover best practices for installing, configuring, and troubleshooting both NGINX Open Source and the enterprise-grade NGINX Plus. We provide insights about using NGINX Controller to manage your NGINX Plus instances. Watch this webinar to learn: - How to create NGINX configurations for web server, load balancer, etc. - About improving performance using keepalives and other NGINX directives - How the NGINX Controller Load Balancing Module can manage NGINX Plus instances at scale - About augmenting your existing ADC with NGINX

CodeIgniter For Project : Lesson 105 - Helper and LibraryWeerayut Hongsa

The document discusses helpers and libraries in CodeIgniter. Helpers are collections of functions that help with tasks, and are loaded with $this->load->helper. Common helpers include url for URLs and form for forms. Libraries provide specific functionality and are loaded with $this->load->library. Common libraries include session for managing sessions, input for retrieving input, and form_validation for validating forms. Both helpers and libraries are loaded and used via CodeIgniter's loader methods.

What's New in NGINX Plus R7?NGINX, Inc.

NGINX Plus R7 is full of new features to help you deliver your applications. HTTP/2 is now fully supported. A redesigned graphical dashboard helps you quickly identify problems. And improvements to the core of NGINX enhance performance, security, and reliability for all your applications. These changes bring tremendous capability to help make your applications faster and more secure than ever. View full webinar on demand at https://www.nginx.com/resources/webinars/whats-new-in-nginx-plus-r7/

AWS re:Invent re:Cap 2019: My ElasticSearch Journey on AWSsmalltown

Securing Kafka confluent

Maximizing PHP Performance with NGINXNGINX, Inc.

Watch the webinar on demand: https://www.nginx.com/resources/webinars/maximize-php-performance-with-nginx Is your PHP app slowing to a crawl? PHP is a powerful programming language that powers roughly 80% of the internet, but it’s unfortunately subject to performance problems – as we all know. Luckily, for thousands of PHP-based applications, some relatively simple changes can lead to noticeable improvements in performance. NGINX has greatly improved application performance for more than 150 million sites in production today. Using NGINX greatly improves the performance of PHP apps with features such as caching, load balancing, HTTP/2 support, and more, included in open source NGINX software and in our commercial-grade application delivery platform NGINX Plus.

Quantum basic VLAN pluginSalvatore Orlando

01 overview-servlets-and-environment-setupdhrubo kayal

This document provides an overview and setup instructions for introducing servlets. It discusses: 1) What a servlet is - a Java program that runs on a server and processes incoming web requests and responses based on a URL. 2) Installing Tomcat, the Java web server, and Eclipse, the IDE, to develop and run servlets. 3) Creating a basic "Hello World" web application with a servlet using Eclipse, and deploying it to Tomcat.

Parse Server Open SourceGeorge Batschinski

Parse Server is an open source backend as a service (BaaS) framework that allows developers to use the Parse API with their own infrastructure. It was created by Parse to allow developers to continue using the Parse API and migrating apps from Parse after it shuts down. Parse Server allows for more flexibility than Parse.com by allowing hosting anywhere, local development/testing, no preset query limits, custom databases/indexes, live queries, and functionality like Push Notifications, Pointer Permissions, and Config that have been added. Developers can get started by following Parse's migration guide and using Parse Server is expected to continue improving over time as an open source project.

Owin and KatanaUgo Lattanzi

Spinnaker - Bay Area AWS Meetup - 20160726Adam Jordens

Nginx Deep Dive Kubernetes IngressKnoldus Inc.

CGSpace technical overviewILRI

This document provides an overview of the CGSpace technical stack, which is based on DSpace. It discusses the key components including Nginx as the web server, Tomcat as the application server, PostgreSQL for metadata storage, and the Ubuntu operating system. It describes the Git-based development workflow using branches on GitHub for testing and deploying changes to the production and development instances.

Summit openshift-on-openstackPippo620677

This document compares using Kubernetes directly on OpenStack infrastructure (IaaS) versus using OpenShift on OpenStack. OpenShift is described as Kubernetes but with an enterprise focus. It provides a Platform as a Service (PaaS) that abstracts away much of the complexity of managing containers. Using OpenShift on OpenStack combines the benefits of containers with the flexibility of virtual machines and leverages OpenStack services like Swift, Cinder, and load balancers. The document outlines deployment architectures for both Magnum and OpenShift on OpenStack and invites the reader to try out exercises for each approach.

My early experience with Mirantis OpenStack 6.0Guy Tel-Zur

The document summarizes the author's early experience deploying Mirantis OpenStack 6 in a VirtualBox virtual environment on their laptop. It describes downloading the ISO image, running Fuel to deploy 4 VMs in a master-slave configuration with Ceph storage. The cloud infrastructure is deployed, which takes a long time, and then the author accesses the OpenStack portal and launches their first instance, accessing the console.

NGINX: Basics and Best Practices EMEANGINX, Inc.

Apachejtpond

Developing a user-friendly OpenResty applicationThibault Charbonnier

Talk given at OpenResty Con 2017 in Beijing. Kong (https://getkong.org) is a widely-adopted open source API Gateway built with OpenResty. It aims at helping secure, manage, and extend microservices-based architectures with minimal effort from the user, while ensuring platform agnosticism. In this talk, we will explore the challenges we encountered developing such an OpenResty application, and how we overcame many of them by way of libraries and contributions back to the OpenResty community. We will cover topics such as clustering OpenResty nodes, inter-workers communication, DNS resolution, typical pitfalls OpenResty developers should avoid, and much more.

Integration Of Mulesoft and Apache Active MQGaurav Talwadker

This document provides steps for integrating Mule and Active MQ to allow for publishing and receiving messages. It outlines installing Active MQ, enabling the GUI, starting the server, and creating a queue. It then discusses building a Mule dataflow to publish to the Active MQ queue using the JMS connector, and minimum configuration needed. Finally, it mentions viewing message counts in the Active MQ broker portal or receiving messages using the JMS connector with the same queue name and configurations.

Unified Streaming 1.11.14-GA HighlightsUnified Streaming

This release of Unified Streaming includes simplified setup using an Apache configuration file, improved manifest editing capabilities, support for additional operating systems, integration with AWS S3 using temporary security tokens, and bug fixes for encryption, SCTE-35 handling, and restart/catchup functionality. Key updates include easier default installation, new plugins for DASH and HLS accessibility, support for more Linux variations, and utilizing AWS best practices for security and access management with S3. Bugs were addressed relating to encryption, multiple audio track handling, and SCTE-35 message processing.

Apache CXF New Directions in IntegrationDaniel Kulp

Hacklu2011 tricaudstricaud

This document discusses how visualization can help make IT security possible when dealing with large scale infrastructure. It describes some common security tools like antivirus software, firewalls, and intrusion detection systems that are used but have limitations. The document then introduces parallel coordinate visualization as a tool that can help analyze large volumes of log and event data to help detect unknown attacks and behaviors. It provides examples of how parallel coordinates could be used to visualize and analyze squid proxy logs, Apache logs, and OpenVPN tunnels. The conclusion is that traditional visualization often fails at scale but parallel coordinates enables analyzing large datasets to find the unknown and understand logs better.

Giorgia Mia Ok 23 SettembreMarisa Corapi

More Related Content

What's hot (20)

CodeIgniter For Project : Lesson 105 - Helper and LibraryWeerayut Hongsa

What's New in NGINX Plus R7?NGINX, Inc.

AWS re:Invent re:Cap 2019: My ElasticSearch Journey on AWSsmalltown

Securing Kafka confluent

Maximizing PHP Performance with NGINXNGINX, Inc.

Quantum basic VLAN pluginSalvatore Orlando

01 overview-servlets-and-environment-setupdhrubo kayal

Parse Server Open SourceGeorge Batschinski

Owin and KatanaUgo Lattanzi

Spinnaker - Bay Area AWS Meetup - 20160726Adam Jordens

Nginx Deep Dive Kubernetes IngressKnoldus Inc.

CGSpace technical overviewILRI

Summit openshift-on-openstackPippo620677

My early experience with Mirantis OpenStack 6.0Guy Tel-Zur

NGINX: Basics and Best Practices EMEANGINX, Inc.

Apachejtpond

Developing a user-friendly OpenResty applicationThibault Charbonnier

Integration Of Mulesoft and Apache Active MQGaurav Talwadker

Unified Streaming 1.11.14-GA HighlightsUnified Streaming

Apache CXF New Directions in IntegrationDaniel Kulp

CodeIgniter For Project : Lesson 105 - Helper and LibraryWeerayut Hongsa

What's New in NGINX Plus R7?NGINX, Inc.

AWS re:Invent re:Cap 2019: My ElasticSearch Journey on AWSsmalltown

Securing Kafka confluent

Maximizing PHP Performance with NGINXNGINX, Inc.

Quantum basic VLAN pluginSalvatore Orlando

01 overview-servlets-and-environment-setupdhrubo kayal

Parse Server Open SourceGeorge Batschinski

Owin and KatanaUgo Lattanzi

Spinnaker - Bay Area AWS Meetup - 20160726Adam Jordens

Nginx Deep Dive Kubernetes IngressKnoldus Inc.

CGSpace technical overviewILRI

Summit openshift-on-openstackPippo620677

My early experience with Mirantis OpenStack 6.0Guy Tel-Zur

NGINX: Basics and Best Practices EMEANGINX, Inc.

Apachejtpond

Developing a user-friendly OpenResty applicationThibault Charbonnier

Integration Of Mulesoft and Apache Active MQGaurav Talwadker

Unified Streaming 1.11.14-GA HighlightsUnified Streaming

Apache CXF New Directions in IntegrationDaniel Kulp

Viewers also liked (10)

Hacklu2011 tricaudstricaud

Giorgia Mia Ok 23 SettembreMarisa Corapi

Loggin alerting and hunting technology hub 2016Scot Berner

Jaime Blasco - Fighting Advanced Persistent Threat (APT) with Open Source Too...RootedCON

The document discusses advanced persistent threats (APTs) and methods for fighting them using open source tools. It describes the characteristics of APTs and provides examples like the GhostNet and Aurora attacks. It also analyzes the Trojan.Hydraq used in Aurora. The key to fighting APTs is centralizing and correlating security data. Effective countermeasures include log monitoring, integrity monitoring, IDS/IPS, and analyzing suspicious network traffic and files to build a behavior matrix.

Hunting The Shadows: In Depth Analysis of Escalated APT AttacksF _

This document analyzes advanced persistent threat (APT) attacks targeting Taiwan, focusing on the "Lstudio" group. It describes the group's infrastructure including command and control servers, use of botnets to control thousands of compromised machines internationally, and development of custom tools. The summary highlights key points about the group's operations since 2007, use of multiple software versions and back-ends, and targeting of both government and private sector victims primarily in Taiwan but also worldwide.

The moment my site got hackedMarko Heijnen

Intrusion prevention system(ips)Papun Papun

The document discusses intrusion prevention systems (IPS), which monitor network and system activity to identify and block malicious activity. It describes how IPS uses signature-based or anomaly-based detection methods to identify intrusions. IPS can be network-based, host-based, wireless, or focus on network behavior analysis. The document contrasts IPS with intrusion detection systems (IDS), which can only detect and report intrusions, while IPS can actively prevent them. It also compares IPS to firewalls, noting that IPS monitors for unwanted entries while firewalls regulate activity based on set rules.

Threat Intelligence with Open Source Tools - Cornerstones of Trust 2014Santiago Bassett

Threat Intelligence has become increasingly important as the number and severity of threats is growing continuously. We live in an era where our prevention technologies are not enough anymore, antivirus products fail to detect new or sophisticated pieces of malware, our firewalls and perimeter defenses are easily bypassed and the attacker’s techniques are growing in complexity. In this new landscape, sharing threat intelligence has become a key component to mitigate cyber-attacks. In this session we will define what Threat Intelligence is and discuss how to collect and integrate threat intelligence from public sources. In addition, we’ll demonstrate how to build your own Threat Intelligence data using Open Source tools such as sandboxes, honeypots, sinkholes and other publicly available tools. The industry’s reticence to share information about attack vectors gives the adversary a huge advantage. Using Threat Intelligence we can reduce this advantage and enable preventative response. We will guide you through the different standards (OpenIOC, STIX, MAEC, OTX, IODEF…) to describe and share cyber intelligence, as well as Open Source Frameworks such as CIF (Collective Intelligence Framework) that allows you to combine different threat sources. One of the biggest problems with Threat Intelligence is finding out how to take advantage of the data you have to actually improve the detection/prevention capabilities in your environment. We will describe how to leverage Threat Intelligence to detect threats and provide defenses, and we will focus on how to use Open Source Tools (Suricata, OSSIM, OSSEC, Bro, Yara…) to get the most of your Threat Intelligence. Presenters: Jaime Blasco and Santiago Bassett Cornerstones of Trust 2014: https://www.cornerstonesoftrust.com

TEDx Manchester: AI & The Future of WorkVolker Hirsch

Build Features, Not AppsNatasha Murashev

Hacklu2011 tricaudstricaud

Giorgia Mia Ok 23 SettembreMarisa Corapi

Loggin alerting and hunting technology hub 2016Scot Berner

Jaime Blasco - Fighting Advanced Persistent Threat (APT) with Open Source Too...RootedCON

Hunting The Shadows: In Depth Analysis of Escalated APT AttacksF _

The moment my site got hackedMarko Heijnen

Intrusion prevention system(ips)Papun Papun

Threat Intelligence with Open Source Tools - Cornerstones of Trust 2014Santiago Bassett

TEDx Manchester: AI & The Future of WorkVolker Hirsch

Build Features, Not AppsNatasha Murashev

Similar to Protecting your site by detection (20)

Improving WordPress Development and Deployments with DockerBrett Palmer

This presentation will discuss how we use Docker to improve our development and deployment of WordPress sites. The presentation describes how themes and plugins can be developed locally and then packaged into a Docker container. A Jenkins pipeline is used with Git to automatically run a build and deploy the new WordPress container onto a test server where automated Selenium scripts are executed. Based on the results of the tests the container is tagged as a production candidate. A deployment pipeline is then used to execute a Blue-Green deployment on the latest update to production. Once the deployment is proven to work through automated testing the router is switched to the new deployment. The overall process helps reduce the risk of production updates to WordPress, themes, and plugins as well as reduce security concerns caused by randomly installing plugins by users. The presentation will also discuss strategies for running a WordPress database both outside and inside of a Docker container. It will discuss the pros and cons of each approach. Presentation given at Salt Lake City WordCamp 2019, Oct 12, 2019. (https://2019.slc.wordcamp.org/).

Best practices in Deploying SUSE CaaS Platform v3Juan Herrera Utande

The document provides best practices for deploying SUSE CaaS Platform. It discusses requirements like hardware needs, software subscriptions required, and support options. It covers planning and sizing considerations like cluster topology and disk space needs. Deployment best practices include steps like preparing the infrastructure, installing base software, verifying the infrastructure, installing CaaS Platform, and deploying Kubernetes addons. Testing and operations topics like monitoring, logging, backups are also covered.

Get Rapid Right-sized and Recent with the Liberty RepositoryGraham Charters

hardenning Operating System Server Berbasis Linuxjokerman16

321 codeincontainer brewboxLino Telera

Lino Telera presents on coding in containers. He discusses how containers can help address issues with traditional applications by allowing development and operations teams to work independently and enabling continuous integration and deployment. Containers isolate code and dependencies, making applications portable and scalable. Telera demonstrates building a simple Python web application, packaging it into a Docker container, and deploying it locally and to the cloud. He notes some challenges around stateful applications and databases in containers.

Introduction to dockerInstruqt

Docker is a tool that allows users to package applications into containers to run on Linux servers. Containers provide isolation and resource sharing benefits compared to virtual machines. Docker simplifies deployment of containers by adding images, repositories and version control. Popular components include Dockerfiles to build images, Docker Hub for sharing images, and Docker Compose for defining multi-container apps. Docker has gained widespread adoption due to reducing complexity of managing containers across development and operations teams.

Learn Electron for Web DevelopersKyle Cearley

Versioning for DevelopersMichelangelo van Dam

OpenStack SummitDocker, Inc.

The document outlines the agenda for the OpenStack Summit in November 2013, including presentations on Docker and its ecosystem, how Docker can be used with OpenStack and Rackspace, and a demonstration of cross-cloud application deployment using Docker. Docker is presented as a solution to the "matrix from hell" of running applications across different environments by providing lightweight, portable containers that can run anywhere regardless of the operating system. The summit aims to educate attendees on Docker and showcase its integration with OpenStack for simplified and efficient application deployment and management across multiple clouds.

DevOPS training - Day 2/2Vincent Mercier

This document provides an overview of DevOPS concepts including containers, Docker, and related tools. It discusses what containers are and the differences between virtual machines and containers. It then covers how containers can be used by developers and systems engineers. Docker is introduced as a tool for running and managing containers. Dockerfiles are described as documents for assembling container images. Docker Compose is presented as a tool for defining and running multi-container applications. Examples are given for creating a simple container with Dockerfile and running it locally and sharing it publicly. Monitoring tools like cAdvisor are mentioned. The document ends with discussing continuous integration/deployment using tools like Gitlab and Jenkins to automate the build and deployment process.

Customizing Apache CloudStack - CCC13Ilya Musayev

Java script nirvana in netbeans [con5679]Ryan Cuprak

This document discusses using NetBeans as an IDE for JavaScript development. It provides an overview of NetBeans' features for JavaScript including syntax highlighting, code completion, debugging, support for frameworks like Angular and Node.js, and mobile development with Apache Cordova. It also demonstrates how to set up and configure NetBeans for common JavaScript tasks like adding libraries, using build tools like Grunt and Gulp, and setting up unit testing with Karma and Jasmine.

OpenStack and WindowsAlessandro Pilotti

OpenStack is an open source cloud computing platform that can manage large networks of virtual machines and physical servers. It uses a distributed architecture with components like Nova (compute), Swift (object storage), Cinder (block storage), and Quantum (networking). OpenStack has been successful due to its scalability, support for multiple hypervisors including Hyper-V, and compatibility with popular programming languages like Python. While OpenStack is best suited for large public and private clouds, its complex installation and lack of unified deployment tools can present challenges, especially for small to mid-sized clouds.

Habitat talk at CodeMonsters Sofia, Bulgaria Nov 27 2018Mandi Walls

A Survey of Container Security in 2016: A Security Update on Container PlatformsSalman Baset

Deploying windows containers with kubernetesBen Hall

The document discusses deploying Windows containers with Kubernetes. It covers building Windows containers, deploying containers on Kubernetes, and operating Kubernetes. Specifically, it shows how to: - Build a Windows container with SQL Server using Docker - Deploy a .NET Core app container to Kubernetes and expose it using a load balancer - Scale the deployment to multiple replicas and observe traffic distribution - Perform rolling updates to deploy new versions of the application

Docker IntroductionJeffrey Ellin

Docker is a system for running applications securely isolated in a container to provide a consistent deployment environment. The document introduces Docker, discusses the challenges of deploying applications ("the matrix from hell"), and how Docker addresses these challenges by allowing applications and their dependencies to be packaged into lightweight executable containers that can run on any infrastructure. It also summarizes key Docker tools like Docker Compose for defining and running multi-container apps, Docker Machine for provisioning remote Docker hosts in various clouds, and Docker Swarm for clustering Docker hosts.

App fabric introductionDennis van der Stelt

Microsoft AppFabric provides services for building and managing composite applications at scale, including workflows, caching, and hosting services. It allows sharing of data and workflows across machines. Windows Server AppFabric provides service and workflow management capabilities while Azure AppFabric focuses on access control and a service bus in the cloud. The presentation discussed architectural choices using these technologies like caching sessions, hosting services, and a real-world example architecture integrating caching, hosting, and messaging.

Introduction to ASP.NET 5mbaric

- ASP.NET 5 is the next generation of Microsoft's web framework that aims to address limitations of the current ASP.NET stack such as limited hosting possibilities and dependency on IIS. - It features a modular architecture based on OWIN and Katana that decouples the application from the server and allows hosting on non-IIS platforms like Linux. - Key improvements include cross-platform support, a more developer-friendly experience with features like no-compile debugging, and an emphasis on performance and light weight deployment through tools like the K command line.

Managing Multisite: Lessons from a Large NetworkWilliam Earnhardt

This document discusses lessons learned from managing a large WordPress multisite network with over 8,500 sites and 77,000 users. Key points include how to setup and install multisite quickly, pros and cons to consider, when multisite is a good fit, and challenges of supporting a very large network at a university including infrastructure, selecting plugins and themes, ongoing security, and tools used for monitoring, debugging and version control. Managing a large multisite installation requires keeping things simple and scalable as well as thinking long term about how design decisions will impact the network over time.

Improving WordPress Development and Deployments with DockerBrett Palmer

Best practices in Deploying SUSE CaaS Platform v3Juan Herrera Utande

Get Rapid Right-sized and Recent with the Liberty RepositoryGraham Charters

hardenning Operating System Server Berbasis Linuxjokerman16

321 codeincontainer brewboxLino Telera

Introduction to dockerInstruqt

Learn Electron for Web DevelopersKyle Cearley

Versioning for DevelopersMichelangelo van Dam

OpenStack SummitDocker, Inc.

DevOPS training - Day 2/2Vincent Mercier

Customizing Apache CloudStack - CCC13Ilya Musayev

Java script nirvana in netbeans [con5679]Ryan Cuprak

OpenStack and WindowsAlessandro Pilotti

Habitat talk at CodeMonsters Sofia, Bulgaria Nov 27 2018Mandi Walls

A Survey of Container Security in 2016: A Security Update on Container PlatformsSalman Baset

Deploying windows containers with kubernetesBen Hall

Docker IntroductionJeffrey Ellin

App fabric introductionDennis van der Stelt

Introduction to ASP.NET 5mbaric

Managing Multisite: Lessons from a Large NetworkWilliam Earnhardt

More from Marko Heijnen (20)

Custom coded projectsMarko Heijnen

Security, more important than ever!Marko Heijnen

- WordPress is used on 26.6% of all websites worldwide as of 2016, showing steady growth each year. - A security audit of popular WordPress plugins found 118 instances of vulnerabilities across 58 plugins, demonstrating the ongoing need to improve WordPress security. - There are several steps site owners can take to harden WordPress security, such as limiting login attempts, enforcing SSL, moving files like wp-config.php, and using server-level protections including fail2ban, Nginx configurations, and a web application firewall. External services like Cloudflare and Sucuri can also help monitor and protect sites.

My Contributor StoryMarko Heijnen

WooCommerce & Apple TVMarko Heijnen

The moment my site got hacked - WordCamp SofiaMarko Heijnen

Mijn site beveiligingMarko Heijnen

My complicated WordPress siteMarko Heijnen

Most of us started running their first site on shared hosting but over time you want more out of it. After some bad experiences, I decided to move to a VPS and do it myself. In the beginning I made a few mistakes but since then things grow that my sites are now running on 6 servers. During this talk I will discuss how my site has grown to be more complex in the last couple of years and how it looks now. This will include all the mistakes I made.

Node.js to the rescueMarko Heijnen

GlotPress aka translate.wordpress.orgMarko Heijnen

Writing clean and maintainable codeMarko Heijnen

Extending WordPress as a proMarko Heijnen

Let's create a multilingual site in WordPressMarko Heijnen

- The document discusses creating multilingual WordPress sites and tools for translation. - It covers the current state of WordPress translations, how to make code translatable, creating language files, and using GlotPress for translation management. - New features of GlotPress that are helping with translation are highlighted, including the locale page, glossary, notifications, and profile pages.

Bootstrapping your pluginMarko Heijnen

This document summarizes Marko Heijnen's talk on bootstrapping a WordPress plugin using automation. It discusses setting up the basic files and structure for a plugin, including internationalization, version control and compiling assets. It also covers automating common tasks like minification, validation and testing through Grunt plugins. Grunt is presented as a JavaScript task runner that can be used to define and run repetitive tasks like compressing files, validating code and deployments. Examples are provided for configuring Grunt to create POT files for internationalization, download translations from GlotPress and perform other automated tasks.

The development and future of GlotPressMarko Heijnen

Why Javascript mattersMarko Heijnen

The code history of WordPressMarko Heijnen

This document summarizes the code history of WordPress from its founding in 2003 to the present. It discusses major releases, contributors, added features like post meta and plugins, tools used for development like Git and unit testing, and the future direction of new APIs. The timeline shows steady growth from a few early contributors to over 200 today, with major releases every 6-12 months adding significant new functionality that maintains backwards compatibility.

Building plugins like a proMarko Heijnen

The document discusses best practices for building WordPress plugins, including improving one's workflow with version control and text editors, understanding WordPress code structure and APIs, following coding standards, defining a plugin's focus and structure, and testing plugins. It also provides examples from the speaker's own plugins and mistakes made. The speaker advocates investing in one's skills and producing well-coded, unique plugins that address user experience through standards compliance and robust testing.

Perfect your images using WordPress - WordCamp Europe 2013Marko Heijnen

This document summarizes a presentation given by Mike Schroder and Marko Heijnen at WordCamp Europe 2013 about image manipulation in WordPress. It discusses how image handling was abstracted in WordPress through the WP_Image_Editor class, which provides a centralized way to read, manipulate, save, and stream images. Examples are given showing how to use WP_Image_Editor to perform common image editing tasks like resizing and cropping. Additional resources and plugins are also listed that extend WordPress's image editing capabilities.

Dealing with mediaMarko Heijnen

This document discusses changes to media handling in WordPress 3.5, including a new media manager, ability for multiple galleries, drag and drop functionality, and backend API rewrite. It notes some issues with the new system and proposes extensions like media tags, faster image insertion, and media folders. It also covers using the WP_Image_Editor class to programmatically edit images and plugins that improve image handling.

The awesome things you can do with images inside WordPressMarko Heijnen

Custom coded projectsMarko Heijnen

Security, more important than ever!Marko Heijnen

My Contributor StoryMarko Heijnen

WooCommerce & Apple TVMarko Heijnen

The moment my site got hacked - WordCamp SofiaMarko Heijnen

Mijn site beveiligingMarko Heijnen

My complicated WordPress siteMarko Heijnen

Node.js to the rescueMarko Heijnen

GlotPress aka translate.wordpress.orgMarko Heijnen

Writing clean and maintainable codeMarko Heijnen

Extending WordPress as a proMarko Heijnen

Let's create a multilingual site in WordPressMarko Heijnen

Bootstrapping your pluginMarko Heijnen

The development and future of GlotPressMarko Heijnen

Why Javascript mattersMarko Heijnen

The code history of WordPressMarko Heijnen

Building plugins like a proMarko Heijnen

Perfect your images using WordPress - WordCamp Europe 2013Marko Heijnen

Dealing with mediaMarko Heijnen

The awesome things you can do with images inside WordPressMarko Heijnen

Recently uploaded (20)

ThousandEyes Partner Innovation Updates for May 2025ThousandEyes

Noah Loul Shares 5 Steps to Implement AI Agents for Maximum Business Efficien...Noah Loul

Artificial intelligence is changing how businesses operate. Companies are using AI agents to automate tasks, reduce time spent on repetitive work, and focus more on high-value activities. Noah Loul, an AI strategist and entrepreneur, has helped dozens of companies streamline their operations using smart automation. He believes AI agents aren't just tools—they're workers that take on repeatable tasks so your human team can focus on what matters. If you want to reduce time waste and increase output, AI agents are the next move.

DevOpsDays Atlanta 2025 - Building 10x Development Organizations.pptxJustin Reock

Building 10x Organizations with Modern Productivity Metrics 10x developers may be a myth, but 10x organizations are very real, as proven by the influential study performed in the 1980s, ‘The Coding War Games.’ Right now, here in early 2025, we seem to be experiencing YAPP (Yet Another Productivity Philosophy), and that philosophy is converging on developer experience. It seems that with every new method we invent for the delivery of products, whether physical or virtual, we reinvent productivity philosophies to go alongside them. But which of these approaches actually work? DORA? SPACE? DevEx? What should we invest in and create urgency behind today, so that we don’t find ourselves having the same discussion again in a decade?

Manifest Pre-Seed Update | A Humanoid OEM Deeptech In Francechb3

Greenhouse_Monitoring_Presentation.pptx.hpbmnnxrvb

Into The Box Conference Keynote Day 1 (ITB2025)Ortus Solutions, Corp

Generative Artificial Intelligence (GenAI) in BusinessDr. Tathagat Varma

How Can I use the AI Hype in my Business Context?Daniel Lehner

𝙄𝙨 𝘼𝙄 𝙟𝙪𝙨𝙩 𝙝𝙮𝙥𝙚? 𝙊𝙧 𝙞𝙨 𝙞𝙩 𝙩𝙝𝙚 𝙜𝙖𝙢𝙚 𝙘𝙝𝙖𝙣𝙜𝙚𝙧 𝙮𝙤𝙪𝙧 𝙗𝙪𝙨𝙞𝙣𝙚𝙨𝙨 𝙣𝙚𝙚𝙙𝙨? Everyone’s talking about AI but is anyone really using it to create real value? Most companies want to leverage AI. Few know 𝗵𝗼𝘄. ✅ What exactly should you ask to find real AI opportunities? ✅ Which AI techniques actually fit your business? ✅ Is your data even ready for AI? If you’re not sure, you’re not alone. This is a condensed version of the slides I presented at a Linkedin webinar for Tecnovy on 28.04.2025.

Semantic Cultivators : The Critical Future Role to Enable AIartmondano

Rusty Waters: Elevating Lakehouses Beyond Sparkcarlyakerly1

Spark is a powerhouse for large datasets, but when it comes to smaller data workloads, its overhead can sometimes slow things down. What if you could achieve high performance and efficiency without the need for Spark? At S&P Global Commodity Insights, having a complete view of global energy and commodities markets enables customers to make data-driven decisions with confidence and create long-term, sustainable value. 🌍 Explore delta-rs + CDC and how these open-source innovations power lightweight, high-performance data applications beyond Spark! 🚀

tecnologias de las primeras civilizaciones.pdffjgm517

Enhancing ICU Intelligence: How Our Functional Testing Enabled a Healthcare I...Impelsys Inc.

TrsLabs - Fintech Product & Business ConsultingTrs Labs

Hybrid Growth Mandate Model with TrsLabs Strategic Investments, Inorganic Growth, Business Model Pivoting are critical activities that business don't do/change everyday. In cases like this, it may benefit your business to choose a temporary external consultant. An unbiased plan driven by clearcut deliverables, market dynamics and without the influence of your internal office equations empower business leaders to make right choices. Getting things done within a budget within a timeframe is key to Growing Business - No matter whether you are a start-up or a big company Talk to us & Unlock the competitive advantage

Heap, Types of Heap, Insertion and DeletionJaydeep Kale

Electronic_Mail_Attacks-1-35.pdf by xploitniftliyevhuseyn

Dev Dives: Automate and orchestrate your processes with UiPath MaestroUiPathCommunity

This session is designed to equip developers with the skills needed to build mission-critical, end-to-end processes that seamlessly orchestrate agents, people, and robots. 📕 Here's what you can expect: - Modeling: Build end-to-end processes using BPMN. - Implementing: Integrate agentic tasks, RPA, APIs, and advanced decisioning into processes. - Operating: Control process instances with rewind, replay, pause, and stop functions. - Monitoring: Use dashboards and embedded analytics for real-time insights into process instances. This webinar is a must-attend for developers looking to enhance their agentic automation skills and orchestrate robust, mission-critical processes. 👨‍🏫 Speaker: Andrei Vintila, Principal Product Manager @UiPath This session streamed live on April 29, 2025, 16:00 CET. Check out all our upcoming Dev Dives sessions at https://community.uipath.com/dev-dives-automation-developer-2025/.

HCL Nomad Web – Best Practices and Managing Multiuser Environmentspanagenda

Webinar Recording: https://www.panagenda.com/webinars/hcl-nomad-web-best-practices-and-managing-multiuser-environments/ HCL Nomad Web is heralded as the next generation of the HCL Notes client, offering numerous advantages such as eliminating the need for packaging, distribution, and installation. Nomad Web client upgrades will be installed “automatically” in the background. This significantly reduces the administrative footprint compared to traditional HCL Notes clients. However, troubleshooting issues in Nomad Web present unique challenges compared to the Notes client. Join Christoph and Marc as they demonstrate how to simplify the troubleshooting process in HCL Nomad Web, ensuring a smoother and more efficient user experience. In this webinar, we will explore effective strategies for diagnosing and resolving common problems in HCL Nomad Web, including - Accessing the console - Locating and interpreting log files - Accessing the data folder within the browser’s cache (using OPFS) - Understand the difference between single- and multi-user scenarios - Utilizing Client Clocking

Splunk Security Update | Public Sector Summit Germany 2025Splunk

Drupalcamp Finland – Measuring Front-end Energy ConsumptionExove

Increasing Retail Store Efficiency How can Planograms Save Time and Money.pptxAnoop Ashok

ThousandEyes Partner Innovation Updates for May 2025ThousandEyes

Noah Loul Shares 5 Steps to Implement AI Agents for Maximum Business Efficien...Noah Loul

DevOpsDays Atlanta 2025 - Building 10x Development Organizations.pptxJustin Reock

Manifest Pre-Seed Update | A Humanoid OEM Deeptech In Francechb3

Greenhouse_Monitoring_Presentation.pptx.hpbmnnxrvb

Into The Box Conference Keynote Day 1 (ITB2025)Ortus Solutions, Corp

Generative Artificial Intelligence (GenAI) in BusinessDr. Tathagat Varma

How Can I use the AI Hype in my Business Context?Daniel Lehner

Semantic Cultivators : The Critical Future Role to Enable AIartmondano

Rusty Waters: Elevating Lakehouses Beyond Sparkcarlyakerly1

tecnologias de las primeras civilizaciones.pdffjgm517

Enhancing ICU Intelligence: How Our Functional Testing Enabled a Healthcare I...Impelsys Inc.

TrsLabs - Fintech Product & Business ConsultingTrs Labs

Heap, Types of Heap, Insertion and DeletionJaydeep Kale

Electronic_Mail_Attacks-1-35.pdf by xploitniftliyevhuseyn

Dev Dives: Automate and orchestrate your processes with UiPath MaestroUiPathCommunity

HCL Nomad Web – Best Practices and Managing Multiuser Environmentspanagenda

Splunk Security Update | Public Sector Summit Germany 2025Splunk

Drupalcamp Finland – Measuring Front-end Energy ConsumptionExove

Increasing Retail Store Efficiency How can Planograms Save Time and Money.pptxAnoop Ashok

Protecting your site by detection

1. CODEKITCHENMarko Heijnen Protecting your site by detection

2. Marko Heijnen • Founder of CodeKitchen • Lead developer of GlotPress • Core contributor for WordPress • Plugin developer • Organizer for WordCamp Belgrade • Using lots of (new) technologies

3. Recently lot’s of security issues got reported

4. Stats first 5 months of 2015 • 3 core security updates • Cross-site Scripting (XSS) due to the misuse of the add_query_arg() and remove_query_arg() functions • Cross-site scripting (XSS) vulnerability inside the popular JetPack plugin. and the default Twenty Fifteen theme because of genericons.

5. I almost got hacked

6. Not only your site but also your server

7. My server setup Loadbalancer Webserver 1 Webserver 2 Memcached Elasticsearch MariaDB

8. My server setup Public Private Loadbalancer Webserver 1 Webserver 2 Memcached Elasticsearch MariaDB

9. Do you know if you are currently hacked???

10. Protecting is silver

11. Detecting is gold

12. What can you detect

13. Detection of your install • Updates of WordPress, Plugins and themes • Failed login attempts • Security issues in plugins and themes • Security enhancements reported by core • List of plugins/themes you don’t use

14. Detection of the server • Updates of server software • Failed login attempts

15. Detection what is going on • Requests to plugins you don’t have (404’s) • Permissions of your folders/files • Check if files got changed (Core, plugins, themes) • Check if files got added (Core, plugins, themes) • What is in your uploads folder (PHP files)

16. How I do it

17. Software for security I use • modsecurity / UFW on every server (default blocks all) • fail2ban • apticron (only 1 per matching type) • apt-dater-host (in combination with apt-dater) • Own code

18. Apticron • Cronjob checking if there are updates • Mail you when there are updates • Can mail the total list or only new updates

19. Apt-dater and Apt-dater-host • Terminal-based remote package update manager • A tool to manage a lot of servers • Grouped same servers • Install and update packages

20. My server setup fail2ban modsecurity ufw apticron apt-dater-host ufw apticron (web1) apt-dater-host ufw apticron apt-dater-host Loadbalancer Webserver 1 Webserver 2 Memcached Elasticsearch MariaDB

21. Use WordPress to manage WordPress

22. Features • List all Linux packages • List all PECL updates • Shows if WP-CLI needs updating • Restart services

23. Features • List all WordPress updates • Ability to perform updates when allowed • Checksum scans • Upload directory scans • Doing backups • Send WP CLI command

24. List of all servers

25. List of all sites

26. General overview of a site

27. Security checks for the site

28. WP Central

29. WP Central API • http://wpcentral.io/api/ • First started with contributors • After that stats • Now creating checksums for plugins and themes • Soon similar functionality as wpvulndb.com

30. Node.js server • WordPress calls a microserver (nginx) • nginx calls node.js server • Returns the data when exists • Will return error when not and generates the checksums behind the scene

31. WP Central API • http://wpcentral.io/api/checksums/theme/ twentyﬁfteen/1.2 • [{"code":"wpcentral_server_error","message":"Gener ating checksums”}] • [{"ﬁle":"header.php","checksum":"c0919b5f4b6e4f3a 58b858b2305e9146"},{},{},{},{},{},{},{},{},{},{},{},{},{}]

32. WP-CLI

33. Ideas are more then welcome

35. Other solutions

36. Other solutions • VaultPress • ManageWP / WP Remote / InﬁniteWP • Sucuri

37. There are WordPress plugins you could use But you should not trust that they do it all

38. The next steps

39. Log aggregation • Logstash • Fluentd • OSSEC

40. OSSEC • An Open Source Host-based Intrusion Detection System • Performs log analysis, ﬁle integrity checking, policy monitoring, rootkit detection, real-time alerting and active response • Works with a manager and agents • https://hackertarget.com/defending-wordpress- ossec/

41. Thank you for listening Questions? @markoheijnen markoheijnen.com    codekitchen.eu

Protecting your site by detection

Recommended

More Related Content

What's hot (20)

Viewers also liked (10)

Similar to Protecting your site by detection (20)

More from Marko Heijnen (20)

Recently uploaded (20)

Protecting your site by detection