bohuco.net

Recent Updates Toggle Comment Threads | Keyboard Shortcuts

Do Some Things About Your WordPress Security … and Why
1. Install a Security Plugin

That’s an easy one, install a plugin that checks your security settings and give you advice. For example “Better WP Security” tell you 20 things you should do to improve your WordPress security and you can do the most of them with just one mouse click.

It also ads database backup feature, login lockouts and ssl features. Check it out!

2. Delete Your Admin-User

There is a user with the username “admin” on every WordPress. You should create a new user with another username and admin-privileges, after that delete the “admin”-user and transfer all posts to the new user.

Why? Automatic hacking attempts depends on WordPress defaults, so many attacks assume that there is an admin-user and try to get his password and/or privileges. See also 5. “Make Things Complicated”.

3. Prevent Random Login Attempts

Look at your apache logs, you will usually find many login attempts with admin user to your blog. That’s automated brute-force attacks. You are quite secure now because you already removed your admin user but you can do even more. Add a second password inquiry to your login-screen with .htaccess. You have a two step login procedure on different software levels then.

Add this lines at the top of your .htaccess
```
AuthType Basic
AuthName "Restricted Area"
AuthUserFile /var/www/htpasswd/.htpasswd

<Files "wp-login.php">
  require valid-user
</Files>
```
Of course, you have to create a .htpasswd file with a user and password … and don’t use the same password for both levels please.

4. Check Your Salts and Keys

Everybody is talking about salts, “Adobe has no salts”, “LinkedIn hashes are not salted” and so on. What all this security guys are talking about? A salt is a random and secret string you should add to your password hash-generation so it’s much harder to decrypt passwords with rainbow tables.

In wp-config.php are 8 keys and salts, everyone of these should be a different random string. If there is something like “put your unique phrase here” … DO IT NOW! There is a salt generator from wordpress.org that makes it easy and secure.
```
define('AUTH_KEY',         '+W)!0iS266I@0TfT9jA4;qUtc!6W.D}4A !MEDZL0J +5#(l|_c=t`$$&F');
define('SECURE_AUTH_KEY',  'xN&y_3FlF4vtBXKXv+-x7z00 |spmsZX`Vt_bk]hie~U;OE/JiQcUO,5EL5-;%~I');
define('LOGGED_IN_KEY',    'SFgSKKIb7ZNP%+E)FJ fKbz-%?z`,M1#@o^GY lay;$![@+->4nc|6+1-~57*Dan');
define('NONCE_KEY',        '9-sa~o?7T&.|o_|KtUIQ)jyTSs!v+r&[|H9`+lb|#|T},],dF@_G+l,Y$2&lyJ]v');
define('AUTH_SALT',        '/Js]Ck2|5|smh.r%G!vjD+s3B7y2ECps3nV?qa.3M|*0K?B-=ZA:PH%uaP_Pk?bo');
define('SECURE_AUTH_SALT', 'Lo[Vcx5KAtIA|N9z]1ST_kLBYSr@-]^N96-UZaH1=SM]VQYJ)zVMHV|P`X:KY*8,');
define('LOGGED_IN_SALT',   'l3Pf#4o:U-6[3_QDf~;Pfz(E@jlA{5fs-2t,v|h`bKZ& =sY= .|t+,+:A*g/#uG');
define('NONCE_SALT',       '}<|(G ;p+vc/Y(jyfW*@9O|fK0qpZtKLw(47,M)0_J-.DYKA^]Q-gdUn|<+_Y^!h');
```
If everything looks okay or you just created new salts ... nevertheless you should change it just a bit, add some random chars to it, just for the case.

5. Make Things Complicated

There are some things you can do that it gets very complicated to automatically attack your wordpress. For example you can change your database-table-prefix to something random (not wp_), rename your wp-content folder or hide your wp-login.php file. All this things are not so easy to do, they may break your blog, so you should use "Better WP Security" or other plugins for that.

6. Check File Permissions

Okay it's a bit of work, but you should check you file permissions and set it to less as possible. There is no need that your config is always writable or that all your plugin folders have 777 permissions. Remove write-permissions wherever it's possible.

A hacker is looking for places where he can modify things, make it hard for him to find such places.

7. Deactivate The Theme- And Plugin-Editor

This one is a must! Deactivate the build-in WordPress file-editors under themes- and plugins-menu, the menu-point where you can edit php-files direct in your wordpress. If ever an attacker get into your wordpress he can modify all files where apache-user has write-permissions.

Add the following line to wp-config.php
```
define('DISALLOW_FILE_EDIT', true);
```
8. Clean Up a Bit

Delete everything you don't need! Old and unused plugins and themes, readme-files, wordpress sample config, old database dumps, uploaded zip files, old renamed files ... anything you don't need anymore. Move it to a folder, make a zip out of it for backup and then delete it.

You don't need this stuff anymore and there is a chance that in future someone discover a vulnerability in one of these files. If this day comes it's maybe to late to delete it, so you should do it now.
DerFichtl 8:52 pm on December 2, 2013 Permalink | Reply
Reply Cancel reply

Required fields are marked *

Name *

Email *

Website
how boyer-moore search algorithm works … en.wikipedia.org/wiki/Boyer%E2%…

7:52 pm on November 29, 2013 Permalink | Reply
backup gmail account with fetchmail lifehacker.com/235207/geek-to…

3:19 pm on November 28, 2013 Permalink | Reply
how to find your stuff with linux find command bohuco.net/blog/2013/11/l… #linux #commandline #developer

7:56 pm on November 26, 2013 Permalink | Reply

Linux “Find” 101 for Developers

Finding things on disk is a very important task, not only for sys-admins. Thank god there is a “find” command on every linux prompt. Here are the most important find options suitable for web-developers and programmers who needs to find something on their project folder or document root.

Find Command Features

Finding files, folders, symlinks
Search Recursive in subfolders
Filter by user, groups, permissions, date/time
Change output format of results
Piping results to other commands

Find Files in Folders

# find . -name "*.php"	start searching in current directory, search for *.php files
# find . -name *"Dat?."**	Use wildcards like * and ? (files any extension, starting with “Dat” and then single wildcard char)
# find . -iname "DaTe.php"	search case insensitive (match Date.php, date.php, …)
# find . -follow -name "*.php"	follow symlinks into other directories
# find . -name *"\."**	find files starting with a dot (.svn, .htaccess)
# find . -name "[A-Z]*.php"	use shell patterns, find files starting with uppercase (Classes for example) use [a-z] for lowercase
# find . -user www-data	find files by files owner (a linux user)
# find . -group www-data	find files by files owner group
# find . -perm 777	find files and folder with all permissions
# find . -mindepth 1 -maxdepth 2 -name "*.php"	limit the search depth to subfolders
# find . -type d	limit search to directories (d) or files (f)
# find . -name ".php" -printf "%p %k KB\n"*	use printf for output formating (not available on OSX)
# find /var/www -name ".php" -size +1M*	find files by size (larger than 1 Megabyte)
# find /var/www -mmin -60	find files by modify date, -mmin -60 means within 60 minutes, +60 would mean: not in the last 60 minutes. use -mtime for days.
# find /var/www -amin -60	find files by access date/time

More about find command

DerFichtl 7:45 am on November 23, 2013 Permalink | Reply
Tags: command line ( 5 ), Linux ( 7 ), PHP ( 50 ), web development

PHP Constants – Define, Use and Performance

Using constants is a good idea if you have values that never change. It makes code more secure because the values can’t be changed after defining and it makes code more readable. Here is all you should know about constants, some performance charts and a dirty secret.

A constant is case-sensitive by default. But a good convention for naming constants is: Always uppercase and separate words with underscores. Constants can only hold scalar values like integers, strings, boolean and float … no arrays.
```
define('DB_HOST', 'localhost');
define('DB_PORT', '8080');

// numbers works too if not at the beginning
define('DB1_PORT', 8000);

// get all defined constants (also php constants like: E_NOTICE)
var_dump(get_defined_constants());

// get user constants only
$allConstants = get_defined_constants(true); 
var_dump($allConstants['user']);
```
Define and Use Constants

You can use the define() function or the const keyword (since php 5.3) to create a constant. I usually use define() because the const keyword works only on the top level scope and not in if-statements or functions. Constants are global by default and therefor “bad” by nature (exception are class-constants we will see later).

If a constant is defined you can’t remove or modify it … obvious it’s a constant.
```
if (true) { 
    // this works 
    define('MY_CONST', 'my const');

    // Parse error ... not top level scope
    const MY_CONST = 'my const';
}

define('MY_CONST', 'try 1');
define('MY_CONST', 'retry'); // Notice: Constant MY_CONST already defined in ...
MY_CONST = 'wtf'; // Parse Error!
```
If you can use the const statement do it, const is twice as fast than define() function.

There is a constant() function if you don’t know the name of a constant, for example if you have to compute the constant-name. The constant() function is two-times slower as using a constant direct.

Checking for Constants

If you want to know if a constant is defined then use defined() function. If you don’t check first and just try to use a non existent constant you will get a: “Notice: Use of undefined constant”
```
if (defined('MY_CONST')) { // don't forget the quotes
    echo MY_CONST;
}
```
Dirty Secret: Use of Undefined Constant …

This is one of PHPs dirty secrets, if you try to use an undefined constant, php will create it on-the-fly and uses as value the name of the constant. IMHO you should never use this circumstance as a feature it throws also an php notice …

“Notice: Use of undefined constant myDirtyConstant – assumed ‘myDirtyConstant’ in …”

When this happens, it is usually an programming error, for example you forgot an dollar sign …
```
// MY_DIRTY_CONSTANT is not defined
if(! defined('MY_DIRTY_CONSTANT')) { 
    echo "Test: ".MY_DIRTY_CONSTANT; // ... but you can use it???
}

// Often happens in array-keys
$array = array();
$array[myKey] = "nice try"; // should be $myKey
```
Class Constants

Class constants are defined on top of the class with the const statement. You can use the constant with two colons like a static method or variable (without dollar).
```
class User {
    const TABLE = 'user';

    function getAll() {
        $sql = sprintf('SELECT * FROM %s', self::TABLE);
    }
}
```
The only way to get all defined class constants is using the reflection class.
```
$refl = new ReflectionClass('User');
var_dump($refl->getConstants());
```
CONSTANT vs. Variable

Surprising for me: Constants are much slower than variables, look at following chart about defining and using a variable / constant:

Tweet now!
DerFichtl 7:33 pm on November 12, 2013 Permalink
Tags: PHP ( 50 )

MF and Greg are discussing. Toggle Comments
- Greg 10:45 am on November 18, 2013 Permalink | Reply
  
  how often do you access a constant 10k times in a loop? and all for what? a 100% improvement in performance on a scale of hundredths or thousandths of a second?
  - MF 3:41 pm on November 24, 2013 Permalink | Reply
    
    thanks for reply … sure its a micro-benchmark and just for interest and not important in real life … nevertheless i was surprised, usually constants should be faster than variables.
Pioneers Festival 2013: John Biggs from Techcrunch [Video]
John Biggs from Techcrunch talks about …
- open source / open hardware
- liking Beer and a bartender robot
- why finding schematics is fun and not dead
- commandlines are not dead
- killing black boxes
- his self repair fail of an ipad mini
- getting (not) rich with a raspberry pi bitcoin miner
- makerbars and hackathons
…

To be honest, until now i don’t know what about this talk was … but he is a funny guy … and bartender robots are really fucking cool …
DerFichtl 8:40 pm on November 7, 2013 Permalink
PHP String Replace Functions – Cheatsheet and Tutorial

PHP is famous for the simple and rich string modification methods. One important type of modification is to replace a string with another. Here are the possible methods, how to use it. At the end you will find a performance comparison over all the function and different input sizes.

Simple str_replace
```
str_replace('search string aka needle', 'replace with', 'in this string aka haystack');
```
Basic Example
```
$name = 'bill';
$replaceName = 'steve';
$string = 'bill is a genius.';

$newString = str_replace($name, $replaceName, $string); // => steve is a genius.
```
Get Replacement Count
```
// ... via pass-by-reference variable
str_replace('one','two','one one one', $count);
echo $count; // = 3
```
Use Arrays as $search and $replace
```
$search = array('a','b');
$replace = array('b','a');
echo str_replace($search, $replace, 'ababab'); // => aaaaaa
```
Insensitive str_replace Function
```
// str_replace is case-sensitive ... str_ireplace not
echo str_ireplace('A', 'b', 'aA'); // => bb
```
Use Strings like Arrays
```
$str = 'a string';
$str[0] = 'A'; // change first char
$str[strlen($str)] = '!'; // append a char
```
Use substr_replace for Replacing Strings by Index
```
$str = 'another string';

// insert a string on position 8 (overwrite 0 chars)
$str = substr_replace($str, 'nice ', 8, 0);

// overwrite 5 chars on pos 8 with the new string
$str = substr_replace($str, 'not nice ', 8, 5);
```
strtr Single Byte Replacements
```
echo strtr('this is a nice text', "t", "T"); // => This is a nice TexT

// a bit strange but ... replaces char by char ... all x=>X, t=>T, e=>E
echo strtr('this is a nice text', "xte", "XTE"); // => This is a nicE TEXT

// use it with associative arrays
echo strtr('this is a nice text', array("xt"=>"XT")); // this is a nice teXT
```
Swiss Army Knife preg_replace
```
echo preg_replace("/nice/", "very nice", "this is a nice text");

// replace with limit
echo preg_replace("/t/", "T", "this is a nice text", 1);

// replace with no limit
echo preg_replace("/t/", "T", "this is a nice text", -1);

// replace with $count variable
echo preg_replace("/t/", "T", "this is a nice text", -1, $count);

// replace with arrays, returns array("bbbbbb","bbbbbbb")
var_dump( preg_replace(array('/a/'), array('b'), array('ababab','bababa')) );
```
It’s getting complicated now … preg_replace_callback
```
// replace with callback, returns a with uppercase A
preg_replace_callback('/a/', function($match){
    return strtoupper($match[0]);
}, 'ababab');

// use create_function if you want a slow version (see below)
preg_replace_callback('/a/', create_function(
    '$matches',
    'return $matches[0];'),
'ababab');
```
“ereg_replace” is marked as deprecated and should not used anymore.

Here is the performance overview over the different replace functions with different parameters, avoid strtr with assoc array and preg_replace_callback with create_function it’s really slow.

How will the performance change if the data-size changes? Size matters but the count of replacements matters much more, many matches makes str_replace slow.

Here is the code template for the str_replace performance tests. microtime_float comes from php.net help pages.
```
$s = 'ababababab';
$a = 'cdcdcdcdcd';
$b = 'b';

$start = microtime_float();
for($i=0; $i<100000; $i++) {
    str_replace($a, $b, $s, $c);
}
echo "input 10b, search 10b, $c\t".round(microtime_float()-$start, 4)."\n";
```
Do you know more or better methods to replace strings ... share it in comments!

Tweet now!
DerFichtl 9:20 pm on November 4, 2013 Permalink
Tags: PHP ( 50 )
5 free online tools for testing your website’s speed thenextweb.com/dd/2013/11/03/… via @push

9:19 pm on November 3, 2013 Permalink

ThePandaDoc is discussing. Toggle Comments
I saw @davemcclure at #pioneers13 … the best #startup roaster in the world. #follow

5:41 pm on November 3, 2013 Permalink

GreteApp is discussing. Toggle Comments
#XBox One Spielechef … haben sie die Lektion wirklich gelernt … bin mir nicht so sicher. derstandard.at/1381370574144/… #microsoft

5:30 pm on November 3, 2013 Permalink
Interview mit @lillikoisser zum Thema Corporate Blogs lily.co.at/corporate-blog…

2:30 pm on November 3, 2013 Permalink

lillikoisser is discussing. Toggle Comments
“TaDa! – Why Big Unveilings Dont Work” lnkd.in/btPHSN8 via @DavidSpinks @shiraabel #iterate #adapt #feedback

10:52 am on November 3, 2013 Permalink
fixing some bugs in my meme generator … memes-generator.net #fun #sideproject #memes

10:01 am on November 3, 2013 Permalink
PHP CLI Simple HTTP-Server
Use PHP without Apache in dev-environments is very simple since PHP 5.4
DocumentRoot is the current directory or use the -t argument.

php -S localhost:8000

You can also provide a router-script …

php -S localhost:8000 router.php

PHP Docs

DerFichtl 7:37 pm on November 2, 2013 Permalink
Wie #buffer einen Hacker-Angriff in ein Happy End verwandeln konnte … netzwertig.com/2013/11/01/hac…

DerFichtl 3:33 pm on November 1, 2013 Permalink
German Startup Fails in 2013 golem.de/news/offline-s… #pioneers13

DerFichtl 6:38 am on November 1, 2013 Permalink
handshake with famous hansi hansmann … by the stories i heard i thought he is much taller #angel #pioneers13

DerFichtl 7:49 pm on October 31, 2013 Permalink
content marketing vs adwords are there any good infos online? #roi #effectiveness #costs

DerFichtl 7:37 pm on October 31, 2013 Permalink
“kaum zu glauben aber wahr, happy hour ist da” #westbahn #durchsage

DerFichtl 7:21 pm on October 31, 2013 Permalink
lets follow some #pioneers13 @shiraabel @HelloSisu @MattieHauser

DerFichtl 6:55 pm on October 31, 2013 Permalink

shiraabel is discussing. Toggle Comments
Got a “lousy Test Tube” from @HelloSisu http://t.co/DHkt5V2MJQ

DerFichtl 4:19 pm on October 31, 2013 Permalink
Uxarchive Seen at @shiraabel #pioneers13 uxarchive.com

DerFichtl 2:38 pm on October 31, 2013 Permalink
ohh buddybroker now … i am curious what investors say … #Recruiting #pioneers13

DerFichtl 1:02 pm on October 31, 2013 Permalink
btw. the #MakerBot is from happylab.at in vienna (@rupprECHT)

DerFichtl 12:53 pm on October 31, 2013 Permalink

me

links

tags

Recent Updates Toggle Comment Threads | Keyboard Shortcuts

Do Some Things About Your WordPress Security … and Why

1. Install a Security Plugin

2. Delete Your Admin-User

3. Prevent Random Login Attempts

4. Check Your Salts and Keys

5. Make Things Complicated

6. Check File Permissions

7. Deactivate The Theme- And Plugin-Editor

8. Clean Up a Bit

DerFichtl 8:52 pm on December 2, 2013 Permalink | Reply

Reply Cancel reply

7:52 pm on November 29, 2013 Permalink | Reply

3:19 pm on November 28, 2013 Permalink | Reply

7:56 pm on November 26, 2013 Permalink | Reply

Linux “Find” 101 for Developers

Find Command Features

Find Files in Folders

More about find command

DerFichtl 7:45 am on November 23, 2013 Permalink | Reply Tags: command line ( 5 ), Linux ( 7 ), PHP ( 50 ), web development

PHP Constants – Define, Use and Performance

Define and Use Constants

Checking for Constants

Dirty Secret: Use of Undefined Constant …

Class Constants

CONSTANT vs. Variable

DerFichtl 7:33 pm on November 12, 2013 Permalink Tags: PHP ( 50 )

Greg 10:45 am on November 18, 2013 Permalink | Reply

MF 3:41 pm on November 24, 2013 Permalink | Reply

Pioneers Festival 2013: John Biggs from Techcrunch [Video]

DerFichtl 8:40 pm on November 7, 2013 Permalink

PHP String Replace Functions – Cheatsheet and Tutorial

Simple str_replace

Basic Example

Get Replacement Count

Use Arrays as $search and $replace

Insensitive str_replace Function

Use Strings like Arrays

Use substr_replace for Replacing Strings by Index

strtr Single Byte Replacements

Swiss Army Knife preg_replace

It’s getting complicated now … preg_replace_callback

DerFichtl 9:20 pm on November 4, 2013 Permalink Tags: PHP ( 50 )

9:19 pm on November 3, 2013 Permalink

5:41 pm on November 3, 2013 Permalink

5:30 pm on November 3, 2013 Permalink

2:30 pm on November 3, 2013 Permalink

10:52 am on November 3, 2013 Permalink

10:01 am on November 3, 2013 Permalink

PHP CLI Simple HTTP-Server

DerFichtl 7:37 pm on November 2, 2013 Permalink

DerFichtl 3:33 pm on November 1, 2013 Permalink

DerFichtl 6:38 am on November 1, 2013 Permalink

DerFichtl 7:49 pm on October 31, 2013 Permalink

DerFichtl 7:37 pm on October 31, 2013 Permalink

DerFichtl 7:21 pm on October 31, 2013 Permalink

DerFichtl 6:55 pm on October 31, 2013 Permalink

DerFichtl 4:19 pm on October 31, 2013 Permalink

DerFichtl 2:38 pm on October 31, 2013 Permalink

DerFichtl 1:02 pm on October 31, 2013 Permalink

DerFichtl 12:53 pm on October 31, 2013 Permalink

DerFichtl 7:45 am on November 23, 2013 Permalink | Reply
Tags: command line ( 5 ), Linux ( 7 ), PHP ( 50 ), web development

DerFichtl 7:33 pm on November 12, 2013 Permalink
Tags: PHP ( 50 )

DerFichtl 9:20 pm on November 4, 2013 Permalink
Tags: PHP ( 50 )