WP AutoShield®: One-Click WordPress Security from cPFence: Page 8 - Enhance Control Panel

WP AutoShield®: One-Click WordPress Security from cPFence

cPFence

bgeek TBH, I'm waiting badly for the huge comprehensive cheatsheet of cPFence

It's not perfect, but we will try to improve it every now and then.

MediaServe

I'd love to be able to install and config LiteSpeed Cache and remove things like WordFence, UpdraftPro and the like. Can we have a --force option to use these as cron jobs? I'd probably do this daily during cPanel migration efforts, then maybe weekly/monthly for servers fully populated.

cPFence

MediaServe

We currently have many bulk tools that can be run as cron jobs, but install and uninstall options are not supported in cron jobs at the moment. We'll look into adding support for this in the future.

For now, you can refer to this guide for using cPFence bulk tools in cron jobs: How to Use cPFence Bulk Tools in Cronjobs.

MediaServe

cPFence Circling back to this uninstall/caching thing...

The code you provided was helpful for identifying sites with/out caching, but has a couple problems:

No way to determine wether caching is activated, although most plugins should remove the directives from .htaccess (but IDK for sure.) If the plugin is installed but not activated and does have a hit in the .htaccess it'll still leave caching disabled so won't be optimized for CPU load reduction.
When I re-generate the WP site list, the targeted WP sites generated with the supplied code are still larger than I would expect. Working to debug the code to identify the problem...

I'm basically now of the opinion that we'll have to remove all caching plugins even if paid, and enforce LiteSpeed Cache. Now the problem is a bit ridiculous, because. you guys have made it really simple to automate these things, however...

cpfence --bulk-uninstall-wp-plugin wp-super-cache
cpfence --bulk-uninstall-wp-plugin wp-rocket
cpfence --bulk-uninstall-wp-plugin breeze
cpfence --bulk-uninstall-wp-plugin w3-total-cache
cpfence --bulk-uninstall-wp-plugin cache-enabler
cpfence --bulk-uninstall-wp-plugin comet-cache
cpfence --bulk-uninstall-wp-plugin hummingbird-cache
cpfence --bulk-uninstall-wp-plugin swift-performance
cpfence --bulk-uninstall-wp-plugin autoptimize
cpfence --bulk-uninstall-wp-plugin hyper-cache
cpfence --bulk-uninstall-wp-plugin wp-fastest-cache
cpfence --bulk-uninstall-wp-plugin powered-cache
cpfence --bulk-uninstall-wp-plugin cachify
cpfence --bulk-uninstall-wp-plugin simple-cache
cpfence --bulk-uninstall-wp-plugin advanced-cache
cpfence --bulk-uninstall-wp-plugin speedycache
cpfence --bulk-uninstall-wp-plugin speedycache-pro
cpfence --bulk-uninstall-wp-plugin aruba-hispeed-cache
cpfence --bulk-uninstall-wp-plugin docket-cache
cpfence --bulk-uninstall-wp-plugin rapid-cache
cpfence --bulk-uninstall-wp-plugin redis-cache
cpfence --bulk-uninstall-wp-plugin sg-cachepress
cpfence --bulk-uninstall-wp-plugin sqlite-object-cache
cpfence --bulk-uninstall-wp-plugin wp-cloudflare-page-cache

This is a list of plugins generated by searching for "cache". I'm sure many of our members aren't using many of these, but we need to be as comprehensive as possible, but this process take so long having to answer "yes" twice for each pass! Would be so much better if we can:

Pass multiple plugins on one line (Vital!)
Enable -yes for use in cronjobs (Optional but would be nice.)

DracoBlue

Any plans for security measures for PrestaShop?

cPFence

DracoBlue

It's not currently planned, but this could change if we see significant demand in the future. In the meantime, the three layers of protection offered by IPDB, WAF, and the powerful malware detection will ensure any CMS, including PrestaShop, remains in solid shape. Additionally, the Owl module is actively monitoring the server for generic malicious behaviors 24/7, and we’re improving it at a rapid pace with innovative ideas.

cPFence

Version 3.3.25 (28th January 2025)

Added

Built-In Brute Force Protection:
- cPFence now includes powerful, native brute force protection for SSH and SFTP, fully integrated into cPFence without requiring additional tools like CSF:
- Initial attacks are temporarily blocked for 10 minutes after 5 consecutive failed logins.
- Repeated and aggressive attacks, especially within a short time window, will result in a permanent ban to ensure maximum security.
  
  This seamless integration ensures advanced protection without the need for external dependencies, delivering peace of mind right out of the box.

Improved

Enhanced the logs analysis module to better detect and block DDoS attacks, improving server protection against malicious traffic.

Fixed

Several minor fixes and improvements to enhance overall performance and reliability.

8Dweb

cPFence when running cpfence --update
Is there a way to auto add the yes flag?

rdbf

cPFence

For those of us running Fail2Ban with relatively default settings with a jail for sshd, would just disabling Fail2Ban mean that the Brute Force Protection takes over the part where it keeps track of /var/log/auth.log and ban repeat offenders in a slightly different way?

And is there a log that cPFence keeps of these actions?

rdbf

cPFence

I tried to whitelist an ipv6 range, or address, but this wasn't possible. Does that mean the blacklisting also doesn't support ipv6? Could ipv6 support for DDoS and Brute Force Protection be implemented?

My current country is a world leader on ipv6, and sucks majorly on ipv4 (especially with CGNAT and extra especially with ipv4 routing - shoutout to Telekom Malaysia.....), so I always love to see proper ipv6 implementations in everything I use. Fail2ban does do ipv6 properly btw.

cPFence

8Dweb

Yes , you can use this ;

cpfence --update -yes

8Dweb

cPFence lol, of course I was trying
yes
y
-y
but not -yes.

Thank you.

cPFence

rdbf

Correct! No need for Fail2Ban SSH jail while running cPFence. Any IP that fails five consecutive login attempts will be banned for 10 minutes. If the attack repeats within a short time frame, the ban becomes permanent.

You can check brute force protection stats with:

cpfence --show-stats

To check the status of an IP:

cpfence --check-ip IP

(If it says "Blacklisted in file," it means the IP has been permanently banned due to DDoS or brute-force attacks captured by the cPFence log analysis module, which checks server-wide access logs and /var/log/auth.log 24/7.)

To unblock an IP:

cpfence --del-blacklist-ip IP

If your server is under a brute-force attack and you want to monitor how cPFence is protecting it in real-time, use:

sudo tail -f /var/log/syslog | grep -E 'cPFence Blocked:|cPFence DDos Protection:|Brute-force Protection'

wrapper

Just about to jump onto this. Quick question, I already have a bunch of wordpress websites with litespeed cache and redis set up, do I need to remove this on all of them before I go ahead? Does it matter that I'm using openlitespeed?

I also can't see where to set up the per-site license, or do I have to use the full server license here?

cPFence

wrapper

No need to uninstall or remove anything, our bulk tools are smart enough to skip what’s already set up, so you can start using them right away.

For the per-website license, just grab a regular license and drop us a ticket, we’ll convert it to the per-website model for you.

cPFence

MediaServe

We do exactly this, we enforce LiteSpeed Cache for all clients (most don’t even know what a caching plugin is) and only exclude those who specifically request to use something else.

But I like your idea! The next version will include a dedicated tool to bulk uninstall and delete all major caching plugins except LiteSpeed with -y enabled for cron jobs, making it completely hands-free.

longbsants

Is CPFense compatible with the Apache server? Or only with OLS? Would it be a good option to replace the security features of Cloudflare Free?

cPFence

longbsants

Yes, cPFence is compatible with Apache, but the WAF module is currently available only for LiteSpeed/OpenLiteSpeed. We highly recommend using OLS for enhanced security and performance. Read more here,(tip #9).

Cloudflare is a great addition for both security and performance, and cPFence works 100% alongside it without any issues.

longbsants

cPFence Okay, thank you, but I've got my infrastructure set up with Apache and FlyingPress, and I'm concerned about the learning curve with OLS. Currently, Cloudflare, at least in the free version, tends to increase my TTFB significantly, but it does offer some security benefits. I only have the free version of Wordfence, which wasn't enough to protect some of my sites from attacks. That's why I'm thinking of finding something that could remove Cloudflare's cache from the equation.

8Dweb

cPFence Do you have any issues running WHMCS on OLS?

cPFence

longbsants

Nothing beats OLS/LS caching in our experience when it comes to performance and ease of use. The LiteSpeed Cache plugin combines caching, Redis integration, and heartbeat optimization all in one, no wonder it’s the go-to solution for major hosting providers. Even CloudLinux tried to compete with AccelerateWP (a rebranded WP-Rocket) and started pushing it hard for the shared hosting industry, but LiteSpeed still remains #1, hands down.

ivansalloum

longbsants Stop using Wordfence and switch to Ninja Firewall.

Andreas

cPFence

I am testing cpfence on a test VPS and so far I like it. I love all the option and work you have put into it.
But I have 2 questions.

What are you doing for users who need to add something into htaccess and it's not compatible?

Like security headers. You cannot just copy/paste the code that apache uses.
Is there a site that shows the OLS version to use?
What are others here doing in these situations?

Also for caching, how are you measuring performance?
I use loader.io, and I am finding the test aborts when using OLS and litespeed cache.

With OLS, I also tested hypercache, and I have no issues at all with handling all the traffic.
(My only issue with hyper cache is not adding the line define( 'WP_CACHE', true ); in the config file. It has to be done manually. )

With apache, I use the plugin called Surge. You just enable it and it works. I can through 10k hits over 1 min and it handles it just fine.

longbsants

cPFence I conducted a test here by setting up an OLS server, but I noticed that some things work better with Apache + FlyingPress, which is fine. However, I couldn't manage to implement CORS or HSTS policies through either the console or the web admin. Would cpfense be able to implement this? From what I've seen, Enhance still doesn't support saving the configurations, am I correct?

« Previous Page Next Page »