WP AutoShield®: One-Click WordPress Security from cPFence: Page 15 - Enhance Control Panel

WP AutoShield®: One-Click WordPress Security from cPFence

cPFence

gmakhs looks bloated, I am happy is optional

Bloated? It’s actually built on GoAccess, one of the lightest and most modern tools out there. And yes, it’s fully optional. We originally built it for our own internal use and decided to include it as a free bonus for our clients. We think many hosting company owners will find it quite handy.

gmakhs

cPFence

I am not saying that you are doing a bad job, actually the way you interact with the community and keep updating your software is quite impressive.

The problem that I see, is that you don't consider all variables when you push the updates, as an example not everyone wants to have the logs enabled for all, not everyone likes to have software that auto updates on timezone that is not convenient to them, etc, what is the best standard for your experience is not for everyone so there must be the option of some flexibility.

Now I just point out those things, and I believe this is something you will take into account on the next feature releases or updates and Improve your software even further .

xyzulu

cPFence Run: cpfence --enable-logspot

It would be great to be able to only enable this on certain websites, and not just all or none.

cPFence

xyzulu

We might consider adding this feature in the future. However, it’s usually best practice to have logs readily available for all sites by default, especially when troubleshooting or addressing security issues. Having logs readily available can save a lot of time when problems arise. But we’ll certainly keep your suggestion in mind.

Kosta

xyzulu we can simply use it on one package allocated to a web server with enabled logspot and for packages that doesn’t require logspot allocated on other server that way websites we don’t want to have this feature won’t have it while we can have it on other packages. Doesn’t really need it per website…

cPFence

Note for users running our daily updates and log maintenance script:

If you're using the script from this guide, please make sure to update it to exclude cpf_logs directories from log rotation. These logs are managed automatically by the LogSpot module, and external truncation could interfere with analytics accuracy.

You can exclude them by adjusting the find command like this:

/usr/bin/find /var/www \
  -path "*/cpf_logs/*" -prune -o \
  \( -name "*.log" -o -name "*_log" \) -size +5M -type f -exec sh -c '
    for file; do
      tail -c 5M "$file" | /usr/bin/sponge "$file"
    done
  ' sh {} +

The script on our GitHub Gist has been updated to reflect this change. Make sure to grab the latest version if you're using LogSpot.

8Dweb

So, are we able to see “access” logs per site from the tool? 😉

btraill

Thanks again guys! I've just enabled this on my staging and production servers.

Kosta

@cPFence but it be nice to have simple button into enhance dashboard where user can click and view this logs. Without pass but with sso etc?

cPFence

Kosta

We don’t have control over the Enhance dashboard at the moment, as there are no official frameworks available yet to integrate such features directly. Meanwhile, you can use the WHMCS button to provide your clients access to analytics. You can also use the API to fetch the client’s password and display it next to the button for convenience.

rdbf

Yes, logging in the cpf_logs directory is continuous and permanent, regardless of Enhance’s log rotation.
And no, you don’t need to re-run anything, new websites will be detected on the fly automatically.

gmakhs

Kosta nope, I don't, I have been years in this industry and auto updates always lead to disaster sooner or later, also leaves your server er open to valnurelabilities.

Imagine if your enhance had automatically upgrade to v12 once it came out, how good that would be for you and your schedule ?

Kosta

gmakhs we have monitor pro to tell us if anything goes wrong after update and this is only update nothing as major upgrade to completely change all your environment. Did you had a chance to speak with Linda lol
By the way it did fit perfectly into my schedule. I was drinking coffee and I had email from my servers that my security software gets updated successfully.
No other emails with errors since then. I know crowdstrike fu up a lot of systems with auto update but this is once in a million…

gmakhs

Kosta I will wait until you get busy, and an auto update will create some issues that you have to solve asap while dealing with another issue, then you will understand what I am saying .

By no means I am saying that cpfence is bad, I just point out something that should have been optional (auto updates ).

rdbf

This is nice.....

Few initial questions:

Does this mean that logging in the cpf_logs directory is now continuous and permanent, even though Enhance flushes the various logs every few minutes?
With the 100MB limit, with 10k hits or so per day, how long would you expect the retention to be? Would it also be possible in the future to target a number of days of retention, rather than file size?
If a new website is added, do any of the commands need to be re-run, or will it automatically generate a password and start the logging?
For the cpfence --logspot-logs-viewer, I was wondering if there could be a list shown so I don't need to dig up UUIDs. But then I hit enter while leaving the input empty, and it showed the list, so could be nice to mention that 😉
Since this function could be kept as admin-only, is it possible to just set a 'master password' for all sites? Saves a lot of entries in password managers. Alternatively I set all passwords the same on a server with the following command:
sudo find /var/www -path "*/cpf_logs/yourpassword.txt" -type f -exec sed -i.bak 's/.*$/SuperSecretPassword/' {} \;
in case someone would want this.

Edit: I just realized that the password will be client-readable in their folder, so setting it server-wide like this would not be wise.....

Kosta

rdbf why would you keep it as admin only? Its end customer feature…
Why would you need to manage end customers passwords..?
Seems like it’s setting up automatically when I place new website into the server…

xyzulu

gmakhs not everyone wants to have the logs enabled for all

They are not auto enabled. This is explained above

cPFence How to get started:

Run: cpfence --enable-logspot

cPFence

gmakhs

I'm afraid both features you mentioned aren’t likely to change anytime soon. We understand that cPFence may not be the right fit for everyone. I'm happy to issue a refund—if that works for you, please share your invoice number.

gmakhs

xyzulu I mean enabled for all websites, it will be better if you able to enable it for specific websites .

gmakhs

cPFence I won't ask refund, there is other value added

cPFence

gmakhs

Then I truly hope the feedback doesn’t turn into repeated complaints, as that can affect how others view the product, especially on public threads that serve as our sales page. I’ve noticed you’ve done the same with Enhance too, and while everyone’s entitled to their opinion, if you don’t like a tool, it might be better to move on rather than continue posting negatively about it.

We’re always open to constructive feedback when it’s occasional and aimed at helping us improve.

gmakhs

cPFence I believe my feedback to be constructive at this point for Cpfence, since i just pointed our few things that are important.

My criticism against enhance came out from the lies, and miss information their team posted on this forum, if they where honest it wouldn't go that far, and if you noticed since they started being more transparent i have tuned it down

Gilfoyle

cPFence It is better you don't engage him/her. He/she is very good at complaining and pointing out what is not working than what is working. Him/her and a few other guys made me think enhance was a bad product, were it not that I just decided to test it myself.

« Previous Page Next Page »