digitalpoint
Well-known member
Never used it. I’m sure it’s probably better than WorrPress though.
Rant about WordPress
- Thread starter digitalpoint
- Start date
-
- Tags
- wordpress
digitalpoint
Well-known member
Well that was a journey...
117 days from initial submission to approval.
It wasn't a full 117 days for them to start looking at it (it was 61 days until they first looked at it), then there was a few weeks of going back and forth on the naming.
...then they didn't like the slug even though it adhered to their guidelines so that was another couple weeks of going back and forth.
A couple nonsensical things they didn't like in the code, but it was simpler to make changes where the end result was the same vs. argue with the reviewers.
A couple issues with escaping vs. sanitizing that were worked out (I've been spoiled with XenForo where everything is escaped and sanitized by default and you have to go out of your way to not do it). In WordPress, it's the opposite (everything is NOT sanitized/escaped by default, so it's easy to miss something).
Either way... I can push it to wordpress.org SVN repo whenever I'm ready now.
Suzanne O
Well-known member
Yay finally...Well that was a journey...
117 days from initial submission to approval.
It wasn't a full 117 days for them to start looking at it (it was 61 days until they first looked at it), then there was a few weeks of going back and forth on the naming.
...then they didn't like the slug even though it adhered to their guidelines so that was another couple weeks of going back and forth.
A couple nonsensical things they didn't like in the code, but it was simpler to make changes where the end result was the same vs. argue with the reviewers.
A couple issues with escaping vs. sanitizing that were worked out (I've been spoiled with XenForo where everything is escaped and sanitized by default and you have to go out of your way to not do it). In WordPress, it's the opposite (everything is NOT sanitized/escaped by default, so it's easy to miss something).
Either way... I can push it to wordpress.org SVN repo whenever I'm ready now.
I also agree with @Miri use joomla instead.
or dreamweaver/indesign from adobe.
digitalpoint
Well-known member
Okay well... hopefully it works as expected. 
wordpress.org
I also rolled out the site that goes along with it... https://appforcf.com/
Has some interesting things like a XenForo marketplace I built from scratch (handles sales, licensing, renewals, subscriptions, it's integrated into XenForo's node system, etc.)
App for Cloudflare®
Utilize Cloudflare to the max (caching, settings, rules, analytics, cloud storage, email management, protect admin area).
I also rolled out the site that goes along with it... https://appforcf.com/
Has some interesting things like a XenForo marketplace I built from scratch (handles sales, licensing, renewals, subscriptions, it's integrated into XenForo's node system, etc.)
Wildcat Media
Well-known member
Looks good! Once funds improve here, I'll get the premium version as I need the R2 buckets for a couple of my WP projects. 
digitalpoint
Well-known member
If you are curious how the R2 stuff works on the WordPress side, it's more or less the same as XenForo.Looks good! Once funds improve here, I'll get the premium version as I need the R2 buckets for a couple of my WP projects.
If you have R2 enabled, media uploaded ends up in R2. One thing that's a little different is the old media still works without moving it to R2. The media browser will show an orange cloud for media that's on R2.
Wildcat Media
Well-known member
That is a good idea--if you remember, I have a multisite install, and I would not move the media (images) over to R2 for some of the lower-use sites on the network right away. I like the orange cloud indicator. The project I'm using is for photography and some of the images can be quite large, which is why wanted to store them in R2 buckets.
Alpha1
Well-known member
I've also installed the WordPress plugin. Looks good so far.
I'd love a function to block login from endless brute force attempts. 2 tries per on admin accounts, before it switches IP and tries again. I already added turnstile to wp-login but somehow that doesn't stop them.
BTW I used a plugin to add CloudFlare turnstile to all login forms, including Elementor and gravity forms: It would make sense to have your plugin add it.
wordpress.org
I'd love a function to block login from endless brute force attempts. 2 tries per on admin accounts, before it switches IP and tries again. I already added turnstile to wp-login but somehow that doesn't stop them.
BTW I used a plugin to add CloudFlare turnstile to all login forms, including Elementor and gravity forms: It would make sense to have your plugin add it.
Simple Cloudflare Turnstile – CAPTCHA Alternative
Add Cloudflare Turnstile to WordPress, WooCommerce, Contact Forms & more. The user-friendly, privacy-preserving reCAPTCHA alternative. 100% free!
digitalpoint
Well-known member
Why allow unauthorized users ANY attempts? Lock the admin down with Zero-Trust Network Access (similar to how the XenForo version does it for XenForo admin area). The Pro version has an auto-config button to set all that up for you, but nothing preventing you from setting it up on your own in Cloudflare's dashboard.I've also installed the WordPress plugin. Looks good so far.
I'd love a function to block login from endless brute force attempts. 2 tries per on admin accounts, before it switches IP and tries again. I already added turnstile to wp-login but somehow that doesn't stop them.
BTW I used a plugin to add CloudFlare turnstile to all login forms, including Elementor and gravity forms: It would make sense to have your plugin add it.
Simple Cloudflare Turnstile – CAPTCHA Alternative
Add Cloudflare Turnstile to WordPress, WooCommerce, Contact Forms & more. The user-friendly, privacy-preserving reCAPTCHA alternative. 100% free!
Alpha1
Well-known member
You are right about zero trust. That is handy and we will set that up after third party devs dont need access anymore.
Users/customers need to be able to register and login. Therefore there will need to be login form access. Those login screens get hammered for brute force.
Users/customers need to be able to register and login. Therefore there will need to be login form access. Those login screens get hammered for brute force.
digitalpoint
Well-known member
If it’s an automated process hitting the login, maybe use a page rule to add a challenge to the page? It’s more or less Turnstile without needing to code it on your end. Can just add it inline to the network request.
Wildcat Media
Well-known member
In the XF version, it was nice that the addon automatically populated Zero Trust with our admins' email addresses to access the admin area. For XF install, I deleted all the addresses except for two of my own.
I just took the time to set one up for one of my WP networks. It doesn't take many configuration options to get it to work. The only limitation is that I can only add five domains at a time. This network has eight sites under different domains, so I need to set up a second one for the remaining three domains.
I do feel better that I can lock down all of my WP sites this way. Accesses can't even get past Cloudflare now.
FTL
Well-known member
I've also installed the WordPress plugin. Looks good so far.
I'd love a function to block login from endless brute force attempts. 2 tries per on admin accounts, before it switches IP and tries again. I already added turnstile to wp-login but somehow that doesn't stop them.
BTW I used a plugin to add CloudFlare turnstile to all login forms, including Elementor and gravity forms: It would make sense to have your plugin add it.
Simple Cloudflare Turnstile – CAPTCHA Alternative
Add Cloudflare Turnstile to WordPress, WooCommerce, Contact Forms & more. The user-friendly, privacy-preserving reCAPTCHA alternative. 100% free!
Adding a 2 second delay or more between attempts in addition to zero trust will also stop brute force attacks in their tracks. In fact, no reason for the delays not to increase. I've seen Android phones implement this, making one wait an increasing amount of minutes, escalating to something like 30 minutes between attempts. Very effective.
digitalpoint
Well-known member
digitalpoint
Well-known member
Ya, the WordPress version does the same (auto configures and populates based on the admin emails). But ya... I don't trust WordPress at ALL. I'd say it's way more important to lock down your WordPress admin upstream of the application (WordPress) with Zero Trust than it is with XenForo. But that's just me...In the XF version, it was nice that the addon automatically populated Zero Trust with our admins' email addresses to access the admin area. For XF install, I deleted all the addresses except for two of my own.
I just took the time to set one up for one of my WP networks. It doesn't take many configuration options to get it to work. The only limitation is that I can only add five domains at a time. This network has eight sites under different domains, so I need to set up a second one for the remaining three domains.
I do feel better that I can lock down all of my WP sites this way. Accesses can't even get past Cloudflare now.
Wildcat Media
Well-known member
I agree--WP is the Internet's punching bag.Ya, the WordPress version does the same (auto configures and populates based on the admin emails). But ya... I don't trust WordPress at ALL. I'd say it's way more important to lock down your WordPress admin upstream of the application (WordPress) with Zero Trust than it is with XenForo. But that's just me...
I've had to test things a few ways to make sure everything is secured. I'm working on only a single domain now, but checking any way I know of to log in so that nothing gets past it. Initially, I had Zero Trust working on domain.com/wp-login.php, but if I go to domain.com/wp-admin, which redirects to wp-login.php anyway (with a redirect string tacked onto the end of it), it goes right to my WP login. So, I had to add both wp-login.php and wp-admin entries under domains for the Zero Trust Application. And so far I seem to be trapping whatever I am trying.
One oddity is that the CF challenge page is showing the domain of my XenForo installation on this same CF account. It's not deal-breaking but just a minor OCD annoyance.
digitalpoint
Well-known member
Ya... it's definitely not ideal. I vaguely remember reading somewhere they were going to address that, but I don't recall where I read it. It's also possible I dreamed it.
Wildcat Media
Well-known member
Honestly, they could just get rid of it. Maybe substitute it with a name of our choosing? It shows in the URL also. On the other hand, the only person seeing it is myself and maybe just a few other who use it. Nothing I'm losing sleep over...
digitalpoint
Well-known member
You definitely can change the subdomain (but it's still for your Cloudflare account as a whole). If it's named after a XenForo installation, it's probably just the name you gave it when it first asked you the subdomain. Either way, the Team Domain can be changed at any time...
FTL
Well-known member
It can be added to the zero trust authentication step though and anyway, there's always a way through any defence, no matter how hard, so I maintain that it can still be useful at the end server level.
Similar threads
- Question
