Blogs

WordPress is the most popular CMS that are is used for creating websites. WordPress is used for creating any style of the website from a simple blog to a full-featured business website. If you are facing issues that the WordPress keeps login out, then the steps provided in this tutorial provide you the best fixes for the login issue you were encounter. Main causes: The main cause is the browser cache when you try to login to your WordPress. It set a browser cookie which authenticates your login session. If there are any errors on those cookies, then you are unable to authenticate and it keeps you logging out. To resolve such issues, please follow the below steps: 1) If you are continually logged out from your WordPress dashboard, then the most common reason is conflict in your URL settings. WordPress is always authenticate logged in users through browser cookies. If the WordPress URL and Site address are different, then it will be unable to authenticate your credentials and you will be logged out. Login to your WordPress dashboard and make sure that you have set the WordPress Address (URL) and Site Address (URL) are exactly the same. You can check it from your WordPress Dashboard >> Settings >> General. If there any differences, this could be the reason for this error. For example, if one the URL is beginning with “https://” and the other uses “http://”, or one has WWW in front and the other doesn’t, then you would need to correct it, Both the URLs should be exactly same. If you are unable to access the WordPress dashboard, then you can edit the WordPress Address (URL) and Site Address (URL) from the file wp-config.php You can use FTP to the server and edit the mentioned file there. define(‘WP_HOME’,’http://yoursite.com); define(‘WP_SITEURL’,’http://yoursite.com);   2) Clearing the browser cache and cookies is another way to resolve this issue. Most of the log out issues are related to the browser cookies that are stored on your browser. You would need to clear the browser cache as well as the browser cookies to resolve this issue. 3) If the issue still persists, then try to deactivate the plugins on the WordPress website. You can manually deactivate all the plugins on your website using FTP client. After logging into FTP server, navigate to the public_html directory and then to the wp-content directory. Disable all plugins on the website. After deactivating the plugins, you’ll have to activate them one at a time to identify the culprit plugin. 4) Ensure that your WordPress site is permitted to save cookies on your browser.  In some cases, your web server is disabled to accept cookies. When this happens, WordPress will be unable to save the cookies, which means you will be logged out again and again. To fix this, you would need to enable ‘Allow Site to Save and Read Cookie Data ‘on your web browser. 5) If the issue is still reoccurring after changing all the above settings, then you would need to restore the website from any of the working back-ups or contact us(your hosting provider) for restoration and everything should be working then.

WordPress, the content management system that does not require any introduction. But here is the fact, There are 313,050 million sites built on WordPress. And it has a 59.7% of market share in content management. With WordPress, you can host files and database on different servers/machines very quickly as it uses MySQL as a database management system. In this guide, we will configure WordPress with an external database in Ubuntu 16.04 servers. First of all, What do we mean when we say WordPress with external database? It means that we are going to host WordPress files on one server(Application server). And we are going to host our WordPress database on another server(Database server). Our goal is to execute MySQL queries on database-server and process and display data on application-server. There are many advantages of hosting application and a database on separate servers. Especially if your WordPress application is growing at a reasonable rate. Here are some benefits you get with this setup. Let’s say your application-server requires more computing power than your database-server. In this case, you can only upgrade your application-server and keep your database-server the same. This way, you can upgrade and downgrade servers based on the computing power they need. In the case of downtime, you can quickly know if it’s an issue on a database server or an application server. If you want high availability set up for your database, Follow this guide to create a master-slave replication in MySQL. With replication, you can keep your site up and running even if the main MySQL server is down. In case of monitoring, you can monitor the load and memory on the application server. While you can monitor queries per second, slow queries, read/write queries, and much more on the database server. I just have mentioned three advantages here, but there are many more that you will experience. So, Let’s get started with the tutorial. Configure WordPress with external database What will you need to follow this guide? Well, you will need two Ubuntu 16.04 servers. Both the servers must be clean with only the operating system installed. And a root access to both the servers as we will install packages and update configuration files. Here are the IP addresses and hostnames we will use in this guide. Application server: application-server (1.2.3.4) Database server: database-server (4.5.6.7) First of all, we will configure our application server. It is not going to be a typical LAMP server setup, because we do not have to configure MySQL on our application server. So, let’s get started. CONFIGURE APPLICATION SERVER On the application server, we will install Apache to serve the HTTP requests and PHP to interpret PHP code requested by Apache. And we are going to use the MySQL database hosted on the database server, so we do not have to install MySQL on this server. Execute the following commands on the application server. root@application-server:~# apt-get updateroot@application-server:~# apt-get upgrade -yroot@application-server:~# apt-get install apache2 -yroot@application-server:~# apt-get install php7.0 php7.0-curl php7.0-mysql php7.0-mbstring php7.0-dom php7.0-gd -yroot@application-server:~# apt-get install libapache2-mod-php7.0root@application-server:~# apt-get install mysql-client -y The first four commands will update repositories, upgrade packages, install Apache, and install PHP7.0 along with the PHP libraries required for WordPress. And the last one will install MySQL client that we can use to test the remote connection with our database server. To verify if Apache and PHP are installed and configured correctly, execute the following commands and then access the public IP address of the application server in the browser. root@application-server:~# rm /var/www/html/index.htmlroot@application-server:~# echo “<?php phpinfo(); ?>” >> /var/www/html/index.php On the browser, you should see a page with PHP configuration information just like the following image. If you can see this page on the public IP address of your application server, you have successfully configured the application server. Now, we can move on to the configuration of our database server. CONFIGURE DATABASE SERVER Database server configuration is also easy. It is because we have to install MySQL and update the MySQL configuration file to allow remote access. Execute the following command to install MySQL on your database server. root@database-server:~# apt-get updateroot@database-server:~# apt-get upgrade -yroot@database-server:~# apt-get install mysql-server mysql-client -yroot@database-server:~# mysql_secure_installation While executing the third command, you have to enter the MySQL root password. And while running the fourth command, You have to answer a few questions. Answer it like this. Enable Validate Password Plugin? No Change the password for root? No Remove anonymous users? Yes Disallow root login remotely? Yes Remove test database and access to it? Yes Reload privilege table now? Yes Once done, try to log in to your MySQL server using the following command. root@database-server:~# mysql -uroot -p If you can log into your MySQL server, you have successfully installed MySQL on the server. Now, it is time to update the MySQL configuration file to allow remote connections. Execute the following command to open the MySQL configuration file in edit mode. root@database-server:~# nano /etc/mysql/mysql.conf.d/mysqld.cnf In the file, find a line containing bind-address. You have to uncomment this line and replace the default value with the IP address of your database server. The updated line should look like the following. bind-address = 4.5.6.7 Do not forget to replace the example IP address with yours. Once done, press CTRL+X followed by Y followed by Enter to save the file. Now, restart the MySQL server using the following command to apply the new configuration. root@database-server:~# service mysql restart All the hard work is now over. Now, we can create a database for our WordPress application on the database server. CREATE DATABASE FOR WORDPRESS ON DATABASE SERVER First of all, log in to your MySQL server using the following command. root@database-server:~# mysql -uroot -p; Enter the password you have set while installing the MySQL server. Once you are in, run the following queries in MySQL to create a database and a user having access from our application server. mysql> CREATE DATABASE wordpress;mysql> CREATE USER ‘wordpressUser‘@’1.2.3.4‘ IDENTIFIED BY ‘qawsedrf123‘;mysql> GRANT ALL PRIVILEGES ON wordpress.* TO ‘wordpressUser‘@’1.2.3.4‘;mysql> FLUSH PRIVILEGES; Now, if you want to test if the user and database are successfully created, login to your application server and execute the following command

WordPress is a content management system that does not require any introduction. Millions of blogs and websites and stores are powered by WordPress. It is so huge that there are thousands of different cases that might require changes in the configuration of the website. One such case is the change in the domain name of the website. In this short guide, I will show you different methods to change WordPress site URLs. By site URLs, I mean the WordPress address and the Site address. Both of them are same in the majority of the cases. Both of them are the base URLs of your WordPress site. So, In this guide, I will show you three different methods to update the URLs of your WordPress websites. The three methods are: Change WordPress URLs from the Admin section Update URLs from wp-config.php Change WordPress URLs using WP-CLI Let’s start our guide with the first and the easiest method to change WordPress site URLs. Change WordPress Site URLs from the Admin section This is the easiest method to change WordPress URLs. The first thing you have to do is to log in to the Admin section of your WordPress site. Once you are logged in, click on the Settings section from the left sidebar. On the General Settings page, you will see a bunch of fields for a bunch of information. In that form, you will find two fields with (URL) in the label. Just like the following image. Enter the new URLs in both of these fields and click on the Save Changes button given at the bottom of the settings page. Once done, you will be able to access your site on the new WordPress URLs. Change URLs with wp-config.php If you don’t want to change URLs from admin section or cannot change URLs from the admin section, don’t worry! You can actually set the URLs from wp-config.php file. So, Open up the file manager or FTP client and navigate to the WordPress installation directory. Once you are there, Edit the wp-config.php file and add the following lines at the end of the file. define('WP_HOME', 'https://newexample.com'); define('WP_SITEURL', 'https://newexample.com'); Now, Save the file and you will be able to access your WordPress site using the new URLs. Note that the values set in the wp-config.php file will override the URLs provided in the General settings page of WordPress. Now, Let’s move on to the last method to change WordPress site URLs. Change WordPress URLs using WP-CLI WP-CLI is an awesome tool to manage all your WordPress instances using the command line interface. It is very easy to manage WordPress settings using WP-CLI. You can also set the site URLs using the WP-CLI tool. It just takes two commands to update the URLs using this method. But to execute these commands, you have to connect to your server via SSH. If you are using Linux based operating system or Mac OS, open up the terminal and connect with your server via SSH directly. If you are using Windows, use Putty or Bitvise to connect with your server via SSH. Once you are in, Execute the following commands to update the URLs of your WordPress site. wp option update home 'https://newexample.com' wp option update siteurl 'https://newexample.com' So, that’s all it takes to update Site URLs using WP-CLI. If you want to install WP-CLI on Linux, you can follow our guide too!   Conclusion: There is one more method to update the WordPress site URLs. In that method, you will basically log in to the PHPMyAdmin and update the site URLs directly into the database. It is a little bit hard if you are facing this for the first time. But the above-given methods are the easiest and the best! Let us know in the comment section if you are facing any issue changing WordPress site URLs, we will respond back with the solution as soon as possible.

A brute force attack is a trial-and-error method in which the hackers aim to gain access to a website by trying different combinations of usernames and passwords until they get in. These attacks focus on websites having weak security links. For example, these attacks mainly happen to a website using a weak username and passwords like ‘admin’ and ‘12345’. Brute Force attack can run out of the server memory as the number of HTTP requests becomes high. Furthermore, this can lead to a performance issue on the website. The number of HTTP requests is the number of times someone visits our website. How to Prevent Brute Force Attacks These hackers hammer the ‘wp-login.php’ file over and over again until the website is accessible or the server dies. We can prevent brute force attacks using the following measures: 1) ALWAYS USE UNUSUAL USERNAME In the early version of WordPress, the username ‘admin’ was a default, so the hackers assume that most of the people are using the same now. It is always advisable to change the username using the “Change Username” plugin. Try not to keep an easy username like “admin” or “administrator” or “boss”. Make sure it is unusual so that no one can guess your username. 2) CREATE COMPLEX AND STRONG PASSWORD It is always recommended to have a secure password, which prevents others from guessing your password and can avoid a brute force attack. There are many ‘automatic password generators’ available which can be used to generate a secure password. The WordPress password strength meter feature ensures the password strength is adequate while changing the same. The ‘Force Strong Password’ plugin can help users to set strong passwords. Some of the things which need to be kept in mind while choosing a password are: Avoid using any permutation of your name, username, company name, or name of your website. Don’t use any word from a dictionary, in any language. Avoid using Short Passwords. Always try to use alpha-numeric passwords. It is always recommended to enable “Two-Step Authentication” on your website for more security. 3) USE SECURITY PLUGINS There are many plugins available for WordPress to limit the number of login attempts made to the website like Limit Login Attempts, IP Geo Block, etc. Also, you can completely block someone from accessing wp-admin by using different plugins like Loginizer, WP Custom Admin Interface, Admin Menu Editor, etc. 4) PASSWORD PROTECT WP-LOGIN.PHP FILE The password protection of your ‘wp-login.php’ file can add an extra layer of security to your site. For the same, you can create a ‘.htpasswd’ file. This file can be created under your public folder or in the same folder of .htaccess, but if you are adding it under the same folder as that of .htaccess, then you need to add some extra security to the .htaccess file. After uploading the .htpasswd file to the server, you have to include it in the.htaccess file in order to protect some routes on your website. For instance, if you have uploaded the htpasswd file in the home directory containing asecretuser the user, add the following code to your htaccess file. # stop Apache from serving .ht* files <Files ~ “^\.ht”> Order allow, deny Deny from all </Files> # Protect wp-login.php <Files wp-login.php> AuthUserFile ~/.htpasswd AuthName “Private access” AuthType Basic require user asecretuser </Files> The “AuthUserFile” location depends on your server, and also the “require user” details changes based on what username you pick. By using the ‘HttpAuthBasicModule’, we can protect the wp-login.php file in Nginx by adding the following block inside your server block. Location /wp-login.php { auth_basic “Administrator Login”; auth_basic_user_file .htpasswd; } The .htpasswd filename path is related to the ‘nginx.conf’ file and the files should be in the following format: user:pass user2:pass2 user3:pass3 The passwords must encode by function crypt(3), so you can use the ‘htpasswd generator’ to encrypt your password. 5) LIMIT ACCESS TO WP-LOGIN.PHP BY IP If you have a fixed IP address to log in to your Admin area, then you can deny wp-login.php access to others using ‘.htaccess’ or ‘web.config file’. This process is known as IP whitelist. To allow only one IP address (e.g., 203.0.113.15) to access the admin area, you can create a file with the name .htaccess and add the following code: # Block access to wp-login.php <Files wp-login.php> order deny,allow allow from 100.00.00.01 deny from all </Files> If you want to add pre than one allowed IP address, we can edit the .htaccess file as below. # Block access to wp-login.php <Files wp-login.php> order deny,allow allow from 100.00.00.01 allow from 100.00.00.02 allow from 100.00.00.03 deny from all </Files> If you are using Apache 2.4 and Apache module, then the syntax is different: # Block access to wp-login.php <Files wp-login.php> Require ip 100.00.00.01 </Files> To access the admin using multiple IP addresses in Apache 2.4, you can add: # Block access to wp-login.php <Files wp-login.php> Require ip 100.00.00.01 100.00.00.02 100.00.00.03 # or for the entire network: # Require ip 100.00.00.0/255.255.255.0 </Files> 6) DENY ACCESS TO NO REFERRER REQUESTS The Spam login attack can be prevented by adding the following block into the ‘.htaccess’ file. # Stop spam attack logins and comments <IfModule mod_rewrite.c> RewriteEngine On RewriteCond %{REQUEST_METHOD} POST RewriteCond %{REQUEST_URI} .(wp-comments-post|wp-login)\.php* RewriteCond %{HTTP_REFERER} !.example.com.* [OR] RewriteCond %{HTTP_USER_AGENT} ^$ RewriteRule (.*) http://%{REMOTE_ADDR}/$1 [R=301,L] </ifModule> 7) BLOCKLISTS As per the study, most of the brute force attacks are from hosts from Russia, Kazakhstan, and Ukraine. So, we can block the IP-addresses that originate from these countries. We can download blocklists from the internet, and then we can load block rules with iptables using some shell scripting. Blocking an entire countries IP address cannot be done if your website is global; that time, you can add the well-known spammer’s IP-addresses to the iptables. This table needs to be updated regularly. 8) CLOUD/PROXY SERVICES Some services like Cloudflare and Sucuri CloudProxy can help to reduce these attacks by blocking the IPs before they reach the server.   Conclusion: There is no actual way to make your site 100% hack-proof. It is