WP AutoShield®: One-Click WordPress Security from cPFence: Page 8 - Enhance Control Panel

WP AutoShield®: One-Click WordPress Security from cPFence

cPFence

Yes, we’re working on a dedicated "cheat sheet" page for this in our knowledge base with brief descriptions of each tool, it’s coming soon.

In the meantime, just type cpfence in the terminal and hit enter to see a full list of all commands and tools with quick explanations.

MediaServe

cPFence Makes sense! I assume they should actually enable some of these things themselves with v12 or shortly afterward! It's complete insanity to not enable at least DKIM and recognize and set Email Routing based on MX records for importing from another panel.

MediaServe

FWIW I have a reseller member with a dedicated plan complaining about the math captcha. I've disabled it three times with "cpfence --bulk-disable-wp-captcha" but it gets mysteriously reactivated for some reason. Do you know what triggers this being reactivated so I can make sure it's re-disabled when necessary?

I get that it can be whitelisted in the cpfence config, but I'd prefer to NOT have to do it for every new website the reseller takes on.

cPFence

MediaServe

Yes, the math CAPTCHA gets reactivated when the WP-AutoShield daily cron runs at 6:10 AM. To manage this:

Edit the exclusion list:

nano /var/log/cpfenceav/wp-exclude-list.txt

To exclude all WordPress installations under a specific account, add:
```
  /var/www/site_id/
```
To exclude a single WordPress installation, add:
```
  /var/www/site_id/public_html/blog
```

If you want to disable the CAPTCHA feature for all websites on this server, edit the config file:

nano /opt/cpfence/config.conf

Set the following:

autoshield_wp_captcha="off"

This will disable the math CAPTCHA server-wide.

bgeek

MediaServe I faced the same problem in the last few days. One site using Memberpress is using a different login tag for membership logins, which would never get the math captcha show on the login page.

As cPFence suggested, I think the best way would be to change autoshield_wp_captcha to "off" in the /opt/cpfence/config.conf. This way, other functions of WP-AutoShield will still work.

bluelinq-computers

cPFence what about for those of us that rely on Object Cache Pro for our redis object caching needs?

cPFence

bluelinq-computers

For those using premium plugins like Object Cache Pro, here’s how you can manage installations alongside LiteSpeed Cache:

You can install your paid plugin in bulk using one of these commands:

cpfence --bulk-install-wp-plugin /path/to/local/plugin.zip

Or:

cpfence --bulk-install-wp-plugin https://domain.com/plugin.zip

After installing your premium plugin, you can install LiteSpeed Cache without enabling Redis:

cpfence --bulk-install-wp-plugin litespeed-cache

This ensures both LiteSpeed Cache (without Redis) and your premium plugin are installed server-wide.

If you already have LiteSpeed Cache installed with Redis enabled and want to switch to your paid Redis plugin, you can reset LiteSpeed Cache to defaults:

cpfence --bulk-reset-ls-plugin

This resets LiteSpeed Cache to its default settings without Redis, allowing you to use your premium Redis plugin.

MediaServe

bgeek I'll probably disable as requested. Had only one reseller annoyed by it, and he has a dedicated vm. I guess if we get enough complaints I might do this globally.

Sulli86

MediaServe I ended up turning it off globally; maybe @cPFence, Is it worth having these features off by default and providing detailed explanations on what it does and the implications it can have for end users?

cPFence

Sulli86

Well, the full WP-AutoShield module is off by default, but we highly recommend enabling it. The default settings work seamlessly for most clients, and you can always tweak them to suit your needs using the config file.

As for CAPTCHA, I don’t recommend turning it off globally because its benefits are substantial. Instead, exclude specific users using plugins like MemberPress or custom login plugins (which we don’t recommend). For most companies, this only affects 1 or 2 clients on a busy server.

With WP-AutoShield enabled, especially alongside hourly integrity check, your WordPress sites can stay almost bulletproof on autopilot.

bgeek

cPFence TBH, I'm waiting badly for the huge comprehensive cheatsheet of cPFence 😃

cPFence

bgeek

I understand it’s becoming overwhelming to keep up with all the new features and modules being added. The cheatsheet is on its way, coming soon after we wrap up the all-new cPFence MonitorPro Module, which is currently in beta. This module introduces exciting features like Cluster-Wide Website Monitoring, Keyword Monitoring (to check for the presence or absence of specific text ,or both), and more. With one-click setup, you can instantly start monitoring all websites in your cluster, with the option to add domains outside your cluster too. Stay tuned!

cPFence

bgeek TBH, I'm waiting badly for the huge comprehensive cheatsheet of cPFence

Master cPFence: Your Go-To Cheat Sheet

It's not perfect, but we will try to improve it every now and then.

Andreas

cPFence This sounds very cool.

So the software gets installed on all servers, but you can user any server to run commands?
Or does it get installed on the cp server?

cPFence

Andreas

It’s a new module that will be included in your cPFence software. If you have cPFence installed on your CP server, it’s as simple as flipping a switch to get started. If you’re running cPFence on a non-CP server, you’ll need to manually add the domains you want to monitor.

cPFence

Security and uptime go hand in hand. In the world of web hosting, monitoring your websites is essential to stay ahead and be the first to know when something goes wrong. If you’re serious about your hosting business, you need a reliable uptime monitoring solution running 24/7. That’s where cPFence’s new MonitorPro Module steps in.

Setting up SaaS monitoring services or an in-house solution can be time-consuming and costly, not to mention the hassle of keeping the monitored list up-to-date. Adding and removing clients as they come and go? Total headache.

But with cPFence MonitorPro, those days are over. Say hello to one-click website and keyword monitoring tailored for your hosting business.

MediaServe

I'd love to be able to install and config LiteSpeed Cache and remove things like WordFence, UpdraftPro and the like. Can we have a --force option to use these as cron jobs? I'd probably do this daily during cPanel migration efforts, then maybe weekly/monthly for servers fully populated.

cPFence

MediaServe

We currently have many bulk tools that can be run as cron jobs, but install and uninstall options are not supported in cron jobs at the moment. We'll look into adding support for this in the future.

For now, you can refer to this guide for using cPFence bulk tools in cron jobs: How to Use cPFence Bulk Tools in Cronjobs.

MediaServe

cPFence Circling back to this uninstall/caching thing...

The code you provided was helpful for identifying sites with/out caching, but has a couple problems:

No way to determine wether caching is activated, although most plugins should remove the directives from .htaccess (but IDK for sure.) If the plugin is installed but not activated and does have a hit in the .htaccess it'll still leave caching disabled so won't be optimized for CPU load reduction.
When I re-generate the WP site list, the targeted WP sites generated with the supplied code are still larger than I would expect. Working to debug the code to identify the problem...

I'm basically now of the opinion that we'll have to remove all caching plugins even if paid, and enforce LiteSpeed Cache. Now the problem is a bit ridiculous, because. you guys have made it really simple to automate these things, however...

cpfence --bulk-uninstall-wp-plugin wp-super-cache
cpfence --bulk-uninstall-wp-plugin wp-rocket
cpfence --bulk-uninstall-wp-plugin breeze
cpfence --bulk-uninstall-wp-plugin w3-total-cache
cpfence --bulk-uninstall-wp-plugin cache-enabler
cpfence --bulk-uninstall-wp-plugin comet-cache
cpfence --bulk-uninstall-wp-plugin hummingbird-cache
cpfence --bulk-uninstall-wp-plugin swift-performance
cpfence --bulk-uninstall-wp-plugin autoptimize
cpfence --bulk-uninstall-wp-plugin hyper-cache
cpfence --bulk-uninstall-wp-plugin wp-fastest-cache
cpfence --bulk-uninstall-wp-plugin powered-cache
cpfence --bulk-uninstall-wp-plugin cachify
cpfence --bulk-uninstall-wp-plugin simple-cache
cpfence --bulk-uninstall-wp-plugin advanced-cache
cpfence --bulk-uninstall-wp-plugin speedycache
cpfence --bulk-uninstall-wp-plugin speedycache-pro
cpfence --bulk-uninstall-wp-plugin aruba-hispeed-cache
cpfence --bulk-uninstall-wp-plugin docket-cache
cpfence --bulk-uninstall-wp-plugin rapid-cache
cpfence --bulk-uninstall-wp-plugin redis-cache
cpfence --bulk-uninstall-wp-plugin sg-cachepress
cpfence --bulk-uninstall-wp-plugin sqlite-object-cache
cpfence --bulk-uninstall-wp-plugin wp-cloudflare-page-cache

This is a list of plugins generated by searching for "cache". I'm sure many of our members aren't using many of these, but we need to be as comprehensive as possible, but this process take so long having to answer "yes" twice for each pass! Would be so much better if we can:

Pass multiple plugins on one line (Vital!)
Enable -yes for use in cronjobs (Optional but would be nice.)

DracoBlue

Any plans for security measures for PrestaShop?

cPFence

DracoBlue

It's not currently planned, but this could change if we see significant demand in the future. In the meantime, the three layers of protection offered by IPDB, WAF, and the powerful malware detection will ensure any CMS, including PrestaShop, remains in solid shape. Additionally, the Owl module is actively monitoring the server for generic malicious behaviors 24/7, and we’re improving it at a rapid pace with innovative ideas.

« Previous Page Next Page »