EXECUTE XML-RPC WHEN NO USE IS NEEDED

When using WordPress, it is likely that anyone who has ever opened source code will see the file xmlrpc.php located in the root directory source. XML-RPC is a script used in WordPress since the previous version but since version 3.5 it has been turned on by default.

XML-RPC is a protocol that connects to remote WordPress web sites using XML to exchange data. Currently supported APIs of CMS such as WordPress API, Blogger API, Movable API, Pingback API, MetaWeblog API, etc.

Typically on WordPress, we will use XML-RPC when setting up the post from an external application such as Windows Live Writer, or services that connect to the website to post such as IFTTT.

But since XML-RPC is popular on WordPress, it raises the possibility of a brute force attack for passwords or worse than sending large amounts of requests to the server to cripple the server. This form of attack is called HTTP Flood Attack, which is a DDoS attack.

XMLRPC's attack frequency statistics on Sucuri. Sucuri's XMLRPC attack frequency statistics on Sucuri. Original article
The attack on the WordPress-based XML-RPC website is not new, but over the past week I've seen quite a few people hacked in this manner, according to their record on the customers using the hosting service at AZDIGI.

So now, if you do not want to connect WordPress to external services or applications, disable XML-RPC to avoid the risk of this kind of attack.

HOW TO KNOW THE WEBSITE IS TAKING OFF

The easiest way to know if your website is under attack is to open an access_log file. If you see a large amount of hits like this, then your website is under attack via XML-RPC.

xxx.xxx.xxx.xxx - - [15/Sep/2016:12:54:49 +0700] "POST /xmlrpc.php HTTP/1.1" 200 0 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.6) Gecko/20070725 Firefox/2.0.0.6"
xxx.xxx.xxx.xxx - - [15/Sep/2016:12:54:50 +0700] "POST /xmlrpc.php HTTP/1.1" 200 0 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.6) Gecko/20070725 Firefox/2.0.0.6"
xxx.xxx.xxx.xxx - - [15/Sep/2016:12:54:50 +0700] "POST /xmlrpc.php HTTP/1.1" 200 0 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.6) Gecko/20070725 Firefox/2.0.0.6"
xxx.xxx.xxx.xxx - - [15/Sep/2016:12:54:51 +0700] "POST /xmlrpc.php HTTP/1.1" 200 0 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.6) Gecko/20070725 Firefox/2.0.0.6"
xxx.xxx.xxx.xxx - - [15/Sep/2016:12:54:51 +0700] "POST /xmlrpc.php HTTP/1.1" 200 0 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.6) Gecko/20070725 Firefox/2.0.0.6"
xxx.xxx.xxx.xxx - - [15/Sep/2016:12:54:52 +0700] "POST /xmlrpc.php HTTP/1.1" 200 0 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8

TROUBLESHOOTING THROUGH THE XMLRPC

To limit this type of attack, there is a simple way to block this file from executing. Note that you should not remove it because it is part of the source code WordPress, can cause errors or when the version update it will be back so the block is the best way.

Block xmlrpc.php on .htaccess

If you use the Shared Host or the Apache install server, insert the following into the .htaccess file at the root of the website.

01 02 03 04

<files xmlrpc.php>  order allow,deny  deny from all </files>

Block xmlrpc.php on NGINX

If you are using NGINX as the backend (used in conjunction with PHP-FPM), remove the following into the domain configuration file on the NGINX.

01 02 03 04 05

location = /xmlrpc.php {  deny all;  access_log off;  log_not_found off; }

Then restart NGINX.

service nginx restart

Block xmlrpc.php with the iThemes Security plugin

If you do not have the convenience of two ways to use the features of iThemes Security is the easiest.

This plugin is almost a plugin to install when using WordPress, if you have not installed this plugin, then install immediately following this tutorial. In this plugin has integrated XML-RPC blocker and block Pingback (should disable if you do not need), you can turn on Security -> Settings -> WordPress Tweak and select Disable XML-RPC.

ithemes-security-block-xmlrpc Block XML-RPC on the iThemes Security plugin.
If you use NGINX then check this option will need to restart NGINX.

EPILOGUE

Although the WordPress source code is one of the most popular and well-known source code sources, some of the features in the source code may be misused, so keep an eye on your logs or logs. (access log) for early detection of abnormal behavior. If you are not sure whether your website is safe or not, we recommend using the Sucuri Firewall service to better protect your website.

Read More

WOOCOMMERCE OPTIMAL ROAD

By default, when installing Woocommerce, you may find that the products have not very nice links, but if you want the product paths and product directory paths, the product keyword is better then we should. Enable static path for Woocommerce. In this article I will talk about how to install and some tips related to static path optimization.

ESTABLISHING THE PROVEN ROAD FOR WOOCOMMERCE

To set this up, you have to go to Settings -> Static Routes.

Then, in the common installation you have to select the path structure calculated for WordPress before to activate the feature.

And in the optional section, you will see that there are additional sections for the product including:

·         Product category default: Means the base name on the path to product catalog pages. An example on the path to the list will be https://thachpham.com/danh-muc-san-pham/quan-jean/ then the name of the muc-san-pham is the name of the base for the category. For some reason, you should set it muc-san-pham or something other than muc-san-pham because it will get a 404 error if it is named.

·         Default product keyword: Same as above but for product keyword pages.

·         Default Product Attribute: Same as above but for archive pages for product attributes.

Note, you can not use accented Vietnamese. I will correct as follows to not error:

And below is the default static link of the product or in other words easier to understand the static path structure for the product page. Here you can choose the structure that you like but avoid selecting the structure with the Vietnamese mark as it will fail. For example, I want my path is https://thachpham.com/san-pham/quan-levis will set as follows:

Or if you want to link the product containing the product category name of the product then set as follows:

DELETE LIST OF PRODUCT LIST AND PRODUCT LIST

I write it so that it matches the translation but if it is correct to delete the base name for product paths and categories. Above you will see that each time you enter the path of the product list will have more / product-catalog/ on the path and for the product will have more / product /. If you want to delete those two, then install these two plugins.

First, install the Remove Taxonomy Base Slug and activate it. Then go to Extract Package -> Remove Taxonomy Base Slug and select product_cat and product_tag (press shift to select) and click Apply Changes.

Finally go to Settings -> Static Path press the Save button again so it flush permalink.

The next step is to remove the plugin from custom post type and activate it, then go to Settings -> Static Path and press the Save Changes button.

ADD .HTML for the product

When you install the plugin remove slug from the custom post type is in the plugin that has added support for suffix for the path. You go to Settings -> Custom post type and fill in the html.

Then go to Settings -> Static Path and press save button to change it to update. Now go back to the homepage and click on the product will see the product has .html in the tail already.

EPILOGUE

That is some of my experience in optimizing Woocommerce's paths, first of all giving it a nice boost and of course the second is for the path structure that it's SEO standards are all right. Wish you success.

note: Because today my site has problems so I can not edit the English language, so the image will have another language

Read More

ADD AND REMOVE THE WIDGET IN THE WORDPRESS WORK

When it comes to widgets in WordPress, you probably think of the widgets that appear on your site. However, the widget I mentioned in this article is not for displaying outside the website but as a widget within the admin page, which is located in the Dashboard as shown below.

And in this tutorial I will show you how to delete the default widgets as well as create a new widget in the admin page to use it to display some of the information you want.

How to delete the default widget in the admin page

If you are like me, the widgets in the admin page almost do not use it a long time because it is too little information, just as we should delete it to avoid seeing it again.

To do this, we will create a function and hook it into the action hook named wp_dashboard_setup.

01 02 03 04 05 06 07

/**  * Delete the default widget in the admin page */  function tp_remove_default_admin_widget() {  } add_action( 'wp_dashboard_setup', 'tp_remove_default_admin_widget' );

And then in this function we use the remove_meta_box function to delete the widget here. We use this function because these widgets are meta boxes created for page type called dashboard. For example, if you want to remove the WordPress News widget, you have the following:

01 02 03 04 05 06 07 08 09

/**  * Delete the default widget in the admin page  */  function tp_remove_default_admin_widget() {      remove_meta_box( 'dashboard_primary', 'dashboard', 'side' );  } add_action( 'wp_dashboard_setup', 'tp_remove_default_admin_widget' );

Similarly, you can see a list of the default dashboard names here and want to delete which one then copy that into your function.

In case you want to remove the welcome display in the Dashboard, you must use remove_action (), and place the code outside of your function.

01	remove_action( 'welcome_panel', 'wp_welcome_panel' );

How to create a widget in the admin page

Usually when creating a website for a customer, we may need to use the Dashboard to post a reminder notice, or advanced features such as getting the latest news on our site, or updating the price of gold. Something, ... depending on the level of your code.

In this tutorial I will teach you how to create a simple widget and a widget to display the latest posts on your page via RSS.

We first create a separate function and hook it into the action hook named wp_dashboard_setup. And in this function we use the function wp_add_dashboard_widget () to create a new widget.

01 02 03 04 05 06 07

/**  * Create widget in admin page  */  function tp_create_admin_widget_notice() {     wp_add_dashboard_widget( 'tp_notice', 'Reminder notes', 'tp_create_admin_widget_notice_callback' );  } add_action( 'wp_dashboard_setup', 'tp_create_admin_widget_notice' );

In the above paragraph, we have:

01	wp_add_dashboard_widget( 'tp_notice', 'Ghi chú nhắc nhở', 'tp_create_admin_widget_notice_callback' );

Inside:

tp_notice: ID of the widget, the ID must not be the same as the other widgets.

Reminder notes: The title of the widget

tp_create_admin_widget_notice_callback: The name of the function that it will execute in this widget, where you can understand what this function contains is what it displays in the widget whose ID is tp_notice.

Okay, now let's create the function tp_create_admin_widget_notice_callback()that we have declared above to display the content of the generated widget. In this function we temporarily display a simple text.

function tp_create_admin_widget_notice_callback() {

    echo '

This is sample content in the tutorial on how to create a simple widget in the admin page..

';

}

Since you have full access to the PHP code in this section, you can create your own content here.

The mechanism of use is just that. But hopefully once you know the simplest things, you'll be able to easily find better ways to use widgets in the more useful administration page.

Read More

download and install facebook messenger for wordpress

In the previous section we have learned about the capabilities of facebook messenger for wordpress,facebook messenger plugin can help your business improve and increase sales for your business. It also has the ability to help the site get high rankings on the google search engine.

The ability of the facebook messenger for wordpress plugin is great right, so today we learn together the download, installation and usage of it.

download facebook messenger for wordpress

First you go to wordpress.org, next you click on the plugin label

 then from the search box on the wordpress site you type the keyword "wp facebook messenger.

After typing in the box and clicking search, the site will return many different results, and to select the right facebook messenger forwordpress you select the plugin icon as shown below.

Next you click on wp facebook messenger, it will move you to the next page and you will see on the right hand has a blue download button you click to start downloading this plugins facebook messenger.

After clicking on the download word you have finished downloading the pluign to the machine, then what to do now is to install and use only.

install facebook messenger for wordpress

First in the dashboard you have to find the plugins, click on the new add,

Then you will see the plugin plugin next to the add plugins as shown below

click on upload plugin, then click on the file, select the file facebook messenger for wordpress you just downloaded, click install now.

So you have finished installing the plugin then

Note that after installing the plugin you should always keep the status Activate to ensure that facebook messenger for wordpress always active.

customize facebook messenger for wordpress

In the dashboard you will see settings, you go to it, it will appear a list of settings, we need to select the facebook messenger for wordpress.

After clicking on the facebook messenger for wordpress menu, the system will move you to the facebook messenger setting, here you will see the customize items as follows.

• ·         your facebook fan page URL
• ·         custom text for button
• ·         display header cover
• ·         messenger icon position
• ·         icon type
• ·         upload icon or image
• ·         main color
• ·         open messenger app button
• ·         Custom text for open Messenger app button    
• ·         Language
• ·         Display
• ·         Display all pages but except

And now we look more closely at the functions.

Your facebook fan page URL: This is the part you have to fill in your facebook URL or your fan page URL.

Custom text for button: Custom text for the button on WooCommerce product detail page

Display header cover: Select Facebook header cover type on Messenger popup, you will be chosen as hide, heaher small, big header ....

Messenger icon position: position of the plugin facebook messenger, you want it to appear to the top of you you need to chionj position.

Icon type: This part is very handy. You can give the facebook messenger for wordpress display the icon or image of the business.

Upload icon or image: This section requires the URL of the icon or image you want to upload.

Main color: Main color for Messenger icon and button, The color of facebook messenger for wordpress is unlimited.

Open Messenger app button: Use this feature if you want user click to open Messenger app on smartphone (will display a button on Messenger popup)

Custom text for open Messenger app button: Custom text for button open Messenger app.

Language: You can select the display language for facebook messenger plugin.

Display: Select type you want to display Messenger (If it don't display in WooCommerce pages, please make sure you selected 'Display all pages but except' option)

Display all pages but except: Select where you want to display Facebook Messenger.

After you finish setting up, you have to save it. So you can use facebook messenger for wordpress to improve and increase sales for your business then. Because I am using facebook messenger for wordpress plugin so i know it is good for business development, this i can guarantee. Since it's a demo, there are many limitations to using, so I recommend you buy it for use, so you will not be disappointed.

Buy facebook messenger for wordpress here.

https://codecanyon.net/item/facebook-messenger-for-wordpress/16392065?ref=Samurai_Team

related articles

facebook messenger for wordpress help boost sales forbusiness

facebook mesenger for wordpress

5 Reasons Why Facebook Live Chat For Wordpress is TheUntapped Potential for Your Business

Free Facebook Live Chat For Wordpress, Modern MarketingSolution

Read More