Basic Protection

Admin Passwords

Strong passwords are essential to prevent unauthorized access to accounts. One of the most common attack vectors for WordPress is a “Brute force” attack, where logins are attempted on your site using common usernames (e.g. Admin) and passwords (e.g. Password). Your administrator account passwords should be sufficiently long, and generally use a mix of letters, numbers, and special characters. Rotating the password frequently isn’t usually necessary. The Administrator password shouldn’t be reused on other accounts.

A strong password is one of the most important defenses against “Brute force” attacks.

Restricting Account Permissions

Ensure that users only have the permissions that they require, this restricts the damage that can occur if an account is compromised. It’s also good practice as it prevents users from accidentally changing settings mistakenly modifying your site.

Account Cleanup

Ensure that accounts from users who don’t need access to your site are deleted (e.g. employees who are no longer with your organization). This reduces the number of accounts that may be compromised, and also prevents a former user from performing some malicious action.

Regular Updates

Regularly updating your website is important to prevent vulnerabilities in WordPress and in plugins from being exploited by hackers.

If you use CPanel, there are options to enable automatic updates to WordPress and Plugins. WordPress also offers automatic updates to new versions on the updates page.

Advanced Protection

Limiting Login Attempts

Limiting login attempts is an excellent additional layer of protection against “Brute Force” attacks.

There are multiple plugins that are able to limit login attempts to your site, and block IP addresses for some period of time following multiple failed logins. One such example is Limit Login Attempts Reloaded.

The free version of the plugin will be adequate for many small websites, and offers settings for number of failed logins before a lockout occurs. You may also specify the length of the first lockout and subsequent lockouts.

Login Captcha

By default WordPress doesn’t offer a login Captcha. A Captcha is a very useful tool to deter bot activity, though may not prevent it all together. It provides another layer in the protection of your website.

A very simple Captcha plugin is Simple Login Captcha, though there are many more advanced plugins that offer more protection. Simple Login Captcha is free and very simple and easy to setup.

Once installed, a Security Code will be required to login to your website

Country Blocking

Another layer of security is blocking IPs from certain countries, a large percentage of bot activity generally originates from a few countries. This solution is not best for all websites however, and generally requires more management. But it may provide extra protection if your site is receiving many failed login attempts (100+/day).

A caveat of country blocking is that it may not always work well with caching plugins, and depending on the plugin and your settings legitimate users may be blocked from accessing your site. However, some plugins allow specifying front-end and back-end blocking separately.

IP2Location, is one such country blocking plugin. It requires a free account to download the GeoIP database. You may consider limiting only the back-end of your site to your country and neighboring countries to reduce your sites attack surface. IP2Location provides statistics (if enabled) so the effectiveness of the plugin can be audited.

Logging In

Start by logging into your website. Generally the login page can be found at “yoursite.com/login” or “yoursite.com/wp-login”. The login page will look like the above.

Navigating to Posts Area

Once you are logged into WordPress you will see the dashboard, similar to shown above. Now click “Posts” from the menu on the left side of the screen.

The posts menu will expand, and a listing of all posts will appear. From here you are able to edit, modify, quick edit, delete, and create new post. Next click “Add New” to create a new post.

Working In Posts Editor

The post editor will now open, start by adding the title of your blog post in the “Add title” section.

On the top right hand side of the posts editor the gear icon, opens the settings menu. Settings are provided both for the page, and for the currently selected block.

To open the blocks drawer click on the blue “+” icon at the top left corner of the screen.

Adding Blocks To a Post

The blocks drawer provides a listing of all options available to be added to the post. Blocks allow adding images, paragraphs, headers and more.

The first block we’ll add is the “Image” block, click and drag it from the blocks drawer to the post area.

Now that the image block is added to the post, it will prompt to select which image to use for it. If there is already images on the library, you may select “Media Library” to view and select the existing image. Otherwise, to upload a new image click “Upload”, and a file dialog will appear allowing you to select the desired picture.

We now see that our image has been added to the post.

There is a caption area under the image that may be used if desired. Click just below the image to have it appear. Enter the caption where it prompts to “Add caption”.

Now, click outside the image block area. Note that the black plus button has appeared. This provides an alternative interface to add new blocks to the post. Click the icon to bring up the recent blocks dialog.

In the recent blocks dialog, we can see some common/recent blocks. This will change as you add other blocks to your post. The next block we will add using this dialog is a “Paragraph”. Click “Paragraph” from within the dialog.

A new block is added to your post. To add to the paragraph block type or paste your text where it says “Type / to chose a block”. To follow this example use any text of your choosing.

Your text will be shown similar to the above. For this example we’re using some Lorem ipsum text. Click the black plus icon again to bring up the recent blocks dialog.

Now we will add a “List” block to the page. If this is not shown, simply search for it.

A bullet point list will be added to the post. Type an item, followed by hitting the enter key to create a new list item. When completed click outside of the list block.

Observe that the list block will be populated similar to the above. Next click the black plus button to add another block.

Now we will add a “Heading” to the post. Headings should be used for title sections as they provide more functionality. It is possible to jump to headings, and screen readers and reading modes will interpret headings differently to provide the best experience to your readers. Click on “Heading” to add a heading to your post.

Type your section heading in the “Heading” prompt.

This was a simple review of a few blocks that may be added for most simple post types. There are many more blocks that can be used for formatting your posts. Explore the blocks drawer and test out some other blocks on your post to see how they appear. It’s possible to preview the page without publishing, this will be shown in the “Previewing a Post” section.

Working With Blocks

As paragraphs, headings and other fields are all rich text fields they may be modified to bold, italicize, and otherwise modify text within them. For the first example we’ll bold a word in the paragraph previously created. On the edit pane above the block click the “B” to bold the selected text.

Observe that the selected text is now bold.

Now we will add a link. Select a word, and from the edit pane click the “link” icon.

A dialog will appear to enter the URL for the link.

Press enter to add the link, and toggle the “Open in new tab” as desired.

Observe that the word is now underlined as a link.

Clicking on the link will show a popup that allows editing the link, changing settings of the link, and removing the link.

Previewing a Post

Now that we’ve made edits to the post we will preview it to see how it will actually appear on our website. Posts are subject to the formatting of the WordPress theme applied to your site, so it’s always a good idea to preview before publishing to confirm that everything is displayed as desired.

From the top right of the screen click “Save Draft”.

Now that the draft is saved click, form the top right corner of the screen click “Preview”.

A menu appears and gives us options for how we’d like to preview our site. Leave “Desktop” checked and then click “Preview in new tab”.

A new tab will then be opened in your web browser.

Review your post and confirm that all the details in it are as desired. When you are complete close the preview tab and return to the previous tab.

Publishing a Post

Before a post is visible on your site it must be published. Prior to publishing we will review some settings.

To review the post settings start by clicking the “Gear” icon on the top right of the screen.

Ensure that the “Post” tab is selected within the settings menu on the right side of the screen.

First, within the summary section there are the visibility options. Post may either be public, private, or password protected. Public posts are visible to all viewers of your website, and private posts are only visible to users who are logged in. This is a useful way to provide user only content.

The tags section provides an area to set the tags on the post. Tags allow for easier indexing and searching of your post.

The categories section allows the posts category to be specified. Categories can be used for filtering. Click “Add New Category” to add categories for your post.

The “Set featured image” section allows a main image to be applied for this post. Depending on your theme this image may be shown in the header of the post on it’s page, along with the post in a directory of all posts, in searches of posts, and more.

When all the settings have been specified as desired click “Publish” to publish the post.

Confirmation is then given that the post is live.

Click the “WordPress” icon on the left side of the screen to return to the main WordPress page. Depending on your configuration this icon may be replaced with your sites logo.

Quick Editing a Post

Quick editing is very useful for changing the publish status, categories, tags, and other metadata about posts easily.

Navigate back to the “Posts” section by clicking “Posts” on the menu on the left side of the screen.

Hover over the post to be edited, observe that the options “Edit”, “Quick Edit”, “Trash”, and “View” appear. Click on “Quick Edit”.

The quick edit panel will then open allowing for making some changes to the post. Make changes as desired, and when complete click “Update”.

For example if your website is “mysite.com”, and you have purchased “my-site.com” as well, “my-site.com” can be forwarded so when it’s entered the user is automatically directed to your primary domain.

First start by logging into GoDaddy’s website.

Then click the account icon on the top right hand of the screen. From the menu that appears select “My Products”.

Click the “My Account” button on the left hand side of the screen and then select “Domains”.

Here you will see the portfolio of all domains owned by the account. On the domain you’d like to forward click the three dots to bring up the menu, and then select “Edit DNS”

The DNS Management page will then be shown.

Scroll down to find the Forwarding section. First, on the “Domain” row click “Add Forwarding”

A popup will appear that prompts for forwarding details. For this example we will forward to google.com. Leave the forward type as “http://”, accept the default forward type of “Permanent”. Don’t worry, it’s still possible to modify or change the forwarding in the future as needed.

Once all the details have been filled in click “Save”

A new row will appear showing that domain, forwarding destination and type. At this point “domaintoforward.com” will forward to “google.com”, however we also need to set up “www.domaintoforward.com”. Do so by clicking the “Add Forwarding” button on the “Subdomains” row.

Specify the subdomain to forward from as “www”, leave the type as “http://”, and then fill out the target to forward to. Leave type as “Permanent” and then click “Save”.

That’s it! The forwarding section should look similar to the above.

Lastly, the SPF, DMARC, and DKIM records of the new host were validated to ensure good mail delivery so that North Star could be confident their customers communications were reaching them, and vice versa.

North Star Electric: https://www.northstarelectric.ca/

Rentrex was able to source the desired unit, refurbish and provide upgrade services.

Wireguard VPN can provide a very effective means of accessing your network remotely. Allowing secure acess to computers, printers, network storage devices, security camera systems, and more.

This guide will walk through setting up WireGuard on a debian based system.

Installing WireGuard 

To install WireGuard, first ensure that your system is up to date. Then from the terminal install wireguard using your package manager of choice such as below. We will also install qrencode. Though this is not needed it is helpful for configuring mobile devices.

sudo apt-get install wireguard
sudo apt-get install wireguard-tools
sudo apt-get install qrencode

Setting Up Server Configuration

The keys and configuration will be generated as the root user, and file permissions will be set so that the keys and config are kept secure. Keys and config will be generated within the “/etc/wireguard” folder. To navigate to the folder and change the permission execute the commands below:

sudo -i
cd /etc/wireguard
umask 077

We must create our configuration file. First ensure you have not exited sudo, and are still in the “/etc/wireguard” directory. Then the file can be created using nano (or your favorite text editor) as below:

nano wg0.conf

Using the text editor populate the file with the following:

[Interface]
Address = 10.6.0.1/24
ListenPort = 51820

Generating Server Keys

Use the below command to generate the server private and public keys.

wg genkey | tee server.key | wg pubkey > server.pub 

Then add the private key to the configuration file using the command below:

echo "PrivateKey = $(cat server.key)" >> wg0.conf 

Registering The Server

To make it easy to start and restart the server, and ensure wireguard runs on boot we will register it as a service. Use the commands below (as root) to register and start the server.

systemctl enable wg-quick@wg0.service
systemctl daemon-reload
systemctl start wg-quick@wg0

Generating Client Keys

The keys will be generated as the root user, and file permissions will be set so that the keys are kept secure. Keys will be generated within the “/etc/wireguard” folder. If you are no longer in the wireguard directory, and/or have exited sudo. Repeat the command below, otherwise proceed to the next step.

sudo -i
cd /etc/wireguard
umask 077

Now that we’ve navigated to the wireguard directory as the root user and set our permissions we can proceed to generate the key(s). This step will be repeated for every client that a key is to be generated for.

client="clientname"
wg genkey | tee "${client}.key" | wg pubkey > "${client}.pub" 

Now that we’ve generated our public and private key pairs we will generate our pre-shared key (PSK). This provides additional security. A unique pre-shared key should be generated for each client. In this step we will use the same name as defined by the client variable previously.

wg genpsk > "${client}.psk" 

Adding Client(s) to Server

Our newly generated keys must be added now to the server configuration. If the server already has a clients configured this process will add additional clients without overwriting existing ones. Generally the server configuration file will be called “wg0.conf”. If this is not the case, replace “wg0.conf” with the name of your configuration file.

Within the “AllowedIPs” section, the “x” must be replaced with the IP address to use for the client. These addresses should be in sequence starting at “2” (as “1” will be used for the server). E.g., if you are adding your first client below replace “x” with “2”.

echo "### Begin ${client} ###" >> wg0.conf
echo "[Peer]" >> wg0.conf
echo "PublicKey = $(cat "${client}.pub")" >> wg0.conf
echo "PresharedKey = $(cat "${client}.psk")" >> wg0.conf
echo "AllowedIPs = 10.6.0.x" >> wg0.conf 

To load the client configuration the server must be restarted.

 systemctl restart wg-quick@wg0

Check that the server is running and configured correctly using the command below:

wg 

Setting Up Client Configuration Files

First we’ll create a configuration file for the new client below and add the previously generated private key to it. Replace “x” with the same number used previously to define this client. For the DNS line, supply the IP address of whatever handles DNS requests for your network (this may be your router). Replace “*YOUR PUBLIC IP*” with your public IP address. If you do not have a static IP look into a dynamic DNS service.

echo "[Interface]" > "${client}.conf"
echo "Address = 10.6.0.x/24" >> "${client}.conf"
echo "DNS = x.x.x.x" >> "${client}.conf"
echo "MTU = 1420" >> "${client}.conf"
echo "PrivateKey = $(cat "${client}.key")" >> "${client}.conf"
echo "[Peer]" >> "${client}.conf"
echo "AllowedIPs = 0.0.0.0/24" >> "${client}.conf"
echo "Endpoint = *YOUR PUBLIC IP*:51820" >> "${client}.conf"
echo "PersistentKeepalive = 25" >> "${client}.conf"
echo "PublicKey = $(cat server.pub)" >> "${client}.conf"
echo "PresharedKey = $(cat "${client}.psk")" >> "${client}.conf" 

Copying Configuration To Client

If the client is another computer we can simply copy the “.conf” file to it. The windows wireguard client makes it easy to import a “.conf” file, which is covered in the next section.

Alternatively, if you are using a mobile client (i.e. a smartphone) the configuration can be transfered using a QR code. To do so, use the command below (qrencode must have been installed prior).

qrencode -t ansiutf8 -r "${client}.conf" 

This will produce a QR code that is scannable from within your terminal session.

Windows Client Setup

To setup the windows client start by downloading and installing it. The installer can be found at: https://www.wireguard.com/install/

After install, launch the wireguard client and then click “Import tunnel(s) from file” to import the configuration file that was exported in the last step.

That’s it! You’ll then see the details loaded in automatically from the config file. Simply click “Activate” to establish the VPN connection.

This guide will display the process using the Popup Anything plugin, and it assumes you already have it installed. If Popup Anything is not installed. Start by adding the plugin to your WordPress.

Navigate to Popup Anything from the navigation bar on the left side of the window. Then click “Add Popup”.

Add a title for your popup. The “Behaviour” tab lets us set features about how the pop up will act. Though the premium plugin offers many more features, basic covers many use cases. Scroll down to set features like how the popup will appear.

Further down on the “Behaviour” tab we can set features about our Popup’s behaviour. For this example we’ll be using a stock image. As such I’ve set the “How Popup Appear?” drop down to “Image Click”. Other types of Popups, such as a simple text link, are also possible. Lastly take note of the “Popup Shortcode”, we’ll need to come back for this later.

Now navigate to the “Content” tab. Here is where we can define the content that will be displayed when our popup image is clicked. For this example I’ve just used another stock image. You can adjust the heading and subheading as required, or remove them entirely.

Now Return to the “Behaviour” tab and copy the “Popup Shortcode”.

At this point, we are done setting up our Popup. Now click “Publish”. We can always return to modify settings further.

For example, you may want to remove or modify the “Custom Close Text”, and “Security Note” that are found on the bottom of the “Content” tab.

Now navigate to the page where you’d like to include the Popup. Though the process here is being demonstrated using the Gutenberg editor, many Pagebuilders are similar.

We will be adding a Shortcode block. If your page builder doesn’t have a Shortcode block, try using a textbox. Some builders (e.g. BeaverBuilder) work by placing Shortcode directly as text.

Paste the Shortcode previously copied into the Shortcode block (or textbox). You can move this around and place it within your layout as desired.

That’s it! Now when the page is viewed the image will show, and when clicked our Popup will display.

Syncthing

For these other file types, and when the devices you need to synchronize files between might not always be connected to the internet, synchthing can be a great solution.

Syncthing allows multiple computers to synchronize files in a given folder. Any number of devices can be added to the shared folder, and multiple folders may also be shared. Syncthing works across different platforms (Windows, Mac, Linux), and also has an android app.

How it Works

Syncthing stores files locally on each machine with a copy of the shared folder. Files are synchronized over the local network, or internet. Transfers can occur directly from computer to computer or via a relay depending on the network configuration.

This means that files in a syncthing share are always available which can be of huge benefit for computers that travel to job sites where internet connection may not be available.

Install

Start by navigating to: https://syncthing.net/downloads/

Select the appropriate version above for your operating system. On many Linux distributions Syncthing will already be in your repository, and installing it will setup a daemon to run at boot.

For windows download the zip folder and extract it at a location of your choice (e.g. C:\Program Files\Syncthing). To have Syncthing run automatically on boot shortcut to Syncthing from the startup folder, add a task in Task Scheduler to run it at boot, or similar alternative will need to be setup.

Setup

Syncthing is managed through a web interface. This is beneficial as it allows GUI setup on headless servers and for easy remote management. Access to this interface can be password protected, though it is best to limit access with firewall rules. Exposing it to the internet is undesirable in the majority of cases.

If Syncthing is installed and running it can be accessed by navigating to the following on the computer it is installed on. (Unless you’ve specified another port, 8384 is default)

http://127.0.0.1:8384/

Adding a Folder

To add a folder start by clicking on the “Add Folder” button. The “Add Folder” window will then appear.

Within the “Add Folder” window, start by setting the “Folder Label”, this can be anything (that’s valid as a windows folder, so some special characters cannot be included). The folder ID will be generated automatically as some string of alpha and numeric characters separated by a hyphen.

This is all that’s needed to setup a folder. If no File Versioning is required simply click “Save”. Otherwise navigate to the “File Versioning” tab. Additionally if you have already added other devices, the “Sharing” tab will show them and allow the new folder to be shared with them.

File Versioning allows this device to store multiple copies of a file. This can be very beneficial in the case that something was changed by mistake. Trash Can, or Simple File Versioning are likely the best picks in most cases. Read more about versioning below:

https://docs.syncthing.net/users/versioning.html

Once done setting up the versioning requirements. Press “Save”.

Adding a Remote Device

Syncthing adds devices by their unique ID.

To access the ID of your current device. Navigate to “Actions > Show ID”

The ID code for your device, and a QR code will be shown. Save this code securely as we’ll use it on another device to link them together.

On another device (different from the one we got the code from). On the main page select “Add Remote Device” to add a new device.

Paste the Device ID of the different device in, then give the device a memorable name. Additional settings can be modified from the “Sharing” and “Advanced” tabs. Sharing will allow sharing existing folders. A setting called “Introducer” is available to have the device automatically share all of its connected devices. This makes setup for many devices much quicker.

Advanced provides connection settings that may be beneficial in specific cases, such as specifying a connection address directly. Though these are not needed for basic setup.

Once completed with setup click “Save”.

Usage

Syncthing is now setup and will allow for synchronizing files between two machines. This can be extended by adding more machines to a folder, and to have multiple folders. Syncthing is not a backup solution alone, and a proper backup procedure on at least one of the devices that host a syncthing folder is recommended (though all is preferable). Syncthing does provide another layer in a backup solution however, and provides great availability for files across multiple devices.

Google

Google search console will be linked to a google account, so you must create a google account if you don’t have one already.

Now navigate to the google’s search console page https://search.google.com/search-console

Enter your domain name within the “Domain” section. We are using the domain verification as it will cover the entire website, whereas “URL prefix” doesn’t cover all domains.

We’ll be working through the generic case, this is done by selecting “Any DNS provider” from the drop down at the top. If your provider is on the list however, you may desire to work through their process. Save the TXT record that’s generated. This will be added to your DNS later.

Bing

Access the Bing webmasters tools at http://www.bing.com/webmasters

On the right side enter your website URL and then click “Add”.

Click on “Add CNAME record to DNS” and save to string of text. We will add these to the DNS next.

Adding DNS Record

The process will be shown using GoDaddy’s interface. Though the process is very similar for most hosting providers

Navigate to the DNS management console. This will allow us to add the records required by Google and Bing.

For the Bing record, this will be created as type CNAME, with the name equal to the string of letters and numbers, and the value being “verify.bing.com”. As with the previous record, a TTL of the shortest time option will be used.

Now return to Google and click “Verify”. Following, you will see the above indicating that the property has been successfully linked. If you receive an error message, verify that you’ve entered the records correctly (check for an extra space added after any data – this will likely cause issues). Otherwise, if everything appears to be correct wait some time before trying again, as it can sometimes take a few hours before records become available.

Return to Bing and click verify. You should now see the above message. Bing Webmasters tools are now verified and your website is setup. Look for future guides on tips and tricks for getting the most out of these tools.