GoSuccess

You are absolutely correct that processing IPs is GDPR-relevant, as they are considered personal data under the regulation. However, GDPR does allow the storage and processing of IPs for security purposes under the legitimate interest basis (Article 6(1)(f)), as long as this processing is necessary and proportional. You can find more details here: https://gdpr.eu/article-6-how-to-process-personal-data-legally/.

Storing IPs is critical for identifying and mitigating security threats, and this applies to nearly all security software, including plugins like Ninja Firewall and cPFence. Of course, it's essential for both the company's and the client website's privacy policy to mention the processing of IPs. This requirement is not specific to cPFence but applies to any security tool or plugin handling personal data.

I understand your concerns, and I've reached out to the legal team of one of my clients, who frequently deals with GDPR compliance, to review this matter further. I'll share any updates or insights they provide. Acting early to address GDPR considerations is always a good practice to avoid surprises later. Thank you once again.

Update:

We’ve received feedback from our client’s legal team regarding GDPR compliance. Based on their advice, we’ve implemented a few minor changes to enhance compliance and follow best practices.

Here’s the latest cPFence update:

Version 3.3.14

Added:

• Introduced the ability to bulk remove the cPFence MU plugin from all WordPress sites server-wide. Use the command:
  cpfence --bulk-remove-mu-plugin.

Improved:

• Idle Logout Feature: jQuery is now enqueued only when the idle logout functionality is enabled, optimizing resource usage.
• Login Limit Feature: IP addresses are now hashed before being stored in the database, ensuring full anonymization and enhanced GDPR compliance.
• Automatic Cleanup: WP AutoShield now clears all expired transients storing hashed IPs daily, further ensuring GDPR compliance.

To ensure full transparency and compliance with GDPR, as advised by the legal team, we recommend including the guidance outlined in the following link within the privacy policy of your hosting company website or any client’s website concerned about GDPR compliance:

Is cPFence GDPR-Compliant?

Thanks, @GoSuccess, for your valuable feedback!

Introducing Owl AutoMySQL®: One-Click MySQL Resource Limits from cPFence

Owl AutoMySQL automates the monitoring and management of abusive MySQL users, solving a major pain point for shared hosting servers with high user volumes. It ensures optimal server performance by preventing resource abuse, all without manual intervention.

One-Click Activation:
Activate with a single command: cpfence --owl-automysql-on
Owl AutoMySQL will begin 24/7 smart monitoring and management instantly.

Customizable Exclusions:
Exclude specific websites or priority clients by adding them to your configuration file: /opt/cpfence/config.conf.

Zoinkies

Bulk plugin installation, uninstallation, and blacklisting are coming soon. We might consider adding MU plugin support in the future.

Zoinkies

We’re just waiting for the Enhance framework to make this happen. In the meantime, we’re focused on adding more one-click, set-it-and-forget-it features.

Sulli86

Yes, we’ve had a few clients report this, and it turns out they’re either entering the password or math equation incorrectly. One case involved a custom math captcha modification conflicting with the cPFence one.

I’d recommend trying to log in yourself to confirm the issue. If you still encounter problems, feel free to drop us a ticket, and we’ll get it sorted.

For less tech-savvy clients, it might be easier to add them to the exclusion list to avoid the headache altogether.

Sulli86

After testing multiple MFA plugins, I was able to replicate the issue with one plugin (miniOrange 2-factor). Please submit a ticket with the name of the problematic plugin, and we will assist you in resolving the issue. The next version will offer enhanced compatibility with these MFA plugins.

Version 3.3.17 (8th January 2025)

Added

• LiteSpeed Features:

  • Who said you need paid LiteSpeed Enterprise to enjoy bulk features? With cPFence, you can now achieve the same functionality on OpenLiteSpeed (OLS) with just one click!
  • cpfence --bulk-install-ls-plugin: Install the LiteSpeed plugin on all WordPress sites server-wide.
  • cpfence --bulk-configure-ls-plugin: Configure the LiteSpeed plugin with Advanced presets and Redis enabled server-wide.
  • cpfence --bulk-clear-litespeed-cache: Clear the LiteSpeed cache on all WordPress sites server-wide.

• WordPress Bulk Management:

  • Gone are the days of relying on tools like MainWP or InfiniteWP to bulk manage your WordPress sites. With cPFence, you can now handle it all seamlessly with server-wide commands:
  • cpfence --bulk-install-wp-plugin: Search and install any WordPress plugin using a name, ZIP file path, or URL to ZIP server-wide.
  • cpfence --bulk-uninstall-wp-plugin: Deactivate and uninstall any WordPress plugin server-wide using the plugin slug.

Improved

• Enhanced cPFence MU Plugin compatibility with multi-factor authentication (MFA) plugins.

leonardo

You can check the details of the "Advanced Presets" within the LS plugin settings in the WordPress admin panel—it’s essentially the recommended configurations by the plugin.

Regarding Redis, if you prefer using your custom Redis plugin, you should avoid using this tool as it’s hardcoded to activate Redis through the LS plugin. However, it’s generally recommended to use the built-in Redis functionality of LiteSpeed for simplicity and ease of management. With this setup, clearing the LiteSpeed cache also clears the Redis cache, ensuring everything stays synced with minimal effort.

That said, it ultimately depends on your preferences and how you’d like to manage your setup.

Also, please note that these are manual tools and are unrelated to the automatic features of WP-AutoShield, which operate independently to enhance site security.

Andreas

This tool simply uses the built-in native WP CLI to activate the plugin and apply the "Advanced Presets" in bulk, saving you time. If your site isn’t compatible with the Advanced Presets for any reason, it’s best not to use the configuration tool for that particular site. Instead, use only the install tool and configure it manually from admin panel to your liking.

Andreas

If you use only the install tool, it will apply the "Essentials" preset, which is compatible with all sites. The configuration tool is best used after testing the "Advanced" presets on a few sites and ensuring compatibility. Once you're confident, it’s a great time-saver for configuring hundreds of sites in one go.