Learn how to secure your server and WordPress site with xCloud's firewall rules, Fail2Ban brute-force protection, and the WP Fail2Ban plugin. Configure the 8G web application firewall, enable AI Bot Blocker to stop scrapers, and block common attack vectors like XML-RPC and user enumeration.
Chapters
Security is absolutely vital with any website. I'm going to walk you through some of the things that xCloud provides by default on the server and then some of the options that you have to add also to your WordPress site. Let's get started. I'm here on my dashboard and I'm going to choose a server, and then in the left nav under Security, we're going to go to Firewall Management. Now this is a built-in firewall on your server, and by default SSH, HTTP, and HTTPS are all allowed from any IP address. And then xCloud infrastructure connections are allowed only from these IP addresses, which you want to leave. Now you can update these. You could delete this one or disable and add a new one that would look something like this. So you could reset your SSH and choose to allow it only from one IP address or deny some known bad IP addresses. I'm not going to do that right now, but I wanted you to be aware that you can set up rules basically for any port and any protocol. But also at the bottom of this is Fail2Ban. Now, Fail2Ban is an automated system that detects attacks and then blocks the IP address that they're coming from. So for example, if you get 100 attempts to log in via SSH in under 10 seconds from a specific IP address, It says, hey, that's probably an attack and blocks it. You can see I have 2 right now. My server's not that old, so it hasn't had time to be attacked that much. But as it ages, you'll get more and more IP addresses here, and that's fine. You can manually ban an IP address. So if you have a known bad actor, you can just ban it. Now, another thing I want to draw your attention to is the fact that I have this banner here that says I need a reboot, and I could reboot now, I could skip it, which I don't recommend, but this requires me to do it manually, and if I forget or whatever, that's a problem. So there's an option to configure auto reboot, which you could get to from here, but then also here. And there's just a switch and you turn it on and you can set a time when your server will reboot and that's entirely up to you. There isn't a best time, it's when it's best for you and your site visitors. So I'm going to leave this on and it's going to go at 12 AM UTC. So I'm going to hit save settings. Settings are updated. Now whether you do this automatically or not is entirely up to you and similar to the other, there's not a right or wrong answer. You may have a server that should not be updated the same time every day or whatever, and you may need to do it manually. Well, then you just set up your own mechanism for, for doing that, and that's fine. But I wanted to point out that you can do this. But now let's move on to site-specific settings. So I'm going to choose this one, and under Tools NGINX and security. And there are a whole bunch of, uh, settings here and we're going to go over each one of them. At the top you have 7G Firewall and 8G Firewall. Uh, these are web application firewalls. You may see many others around. Um, Wordfence is a common WordPress one, but this is set up on the server side, which I much prefer. I don't recommend running both of these. 8G is just the next iteration of 7. It's the better version. So, um, just turn that one on and you can view the logs and see what's been blocked. Uh, then, uh, AI Bot Blocker, or it does exactly what it says, uh, blocks known AI bots, scrapers, and automated crawlers. Again, this is up to you. Maybe you want AI to be fully aware of everything on your site, so maybe you leave it off. I'm going to turn mine on. Then we have disable nginx config regeneration. Uh, nginx is the web server, and right now it's, uh, the configuration is managed by xCloud. And so if there are changes made, it automatically regenerates that config file. But if you need to manually change something in the config file, which happens, you don't want them to overwrite your changes. and so this is where you can turn that off. I don't have any custom changes, so I'm going to leave this turned off right here. PHP execution in the upload directory is always turned off. You can't turn that on. Enable XML-RPC. This implies that it's off by default. Now, XML-RPC is the kind of thing that allows the WordPress mobile app to work. It's a way for external apps to inter— interact with your site. Now, if you don't need it, you should turn it off because that's one less attack vector. I don't, so I'm going to leave it off. Edit X-Frame-Options. X-Frame-Options dictates whether or not your site is allowed to be embedded in a frame on another site. Now, there are reasons to have it be framed, but There are many more to not allow it to be framed. Um, this would allow another site to embed your site in a full browser frame and people would not know that they are at the wrong site. There are a lot of reasons you don't want to allow this. So, uh, we're going to turn on the edit X-Frame options and your options are same origin, which means that It can be framed, but only inside itself, which would allow you to frame another page in your first page. I don't know why you'd want to, but you can. You can just simply deny it— can't be done. Uh, you could allow it from everyone. You could allow from specific sites. So if there's one site you want to allow to do this, you can do that. I'm going to choose deny. I don't want my site framed. Then we have serve robots.txt from the file system. Now robots.txt can be managed by a variety of things. Yoast SEO does this, All-in-One SEO does this. There are many, many plugins that manage this. Instead, you can override that and you could say, I'm going to write my own robots.txt and I don't want any other app to manage that. And this is where you would turn that on. And lastly, lastly, we have one of my favorites, WP Fail2Ban. Now we talked about Fail2Ban earlier, but as a server-side thing, uh, dealing with protocols and whatnot. WP Fail2Ban is very similar but works inside WordPress, blocking WordPress-specific things. So for example, it can block failed login attempts. Right here you can see exactly what it does. Block common usernames, admin or root. Those are terrible usernames in WordPress. Block user enumeration. Now this disallows a server or a bot from scanning your website looking for all your users. Protect comments, so it logs suspicious comment behavior. So it's not exactly a spam blocker, but it allows you to see IP addresses that are trying to do bad things. This is a spam blocker, detects and logs spam activity to catch bots and spammers. Then Guard Password Resets. This logs the reset attempts. So, uh, there's nothing really to stop a bot from trying to reset a password on a username 1,000 times, 1 million times, and if nothing else, it's gonna suck up your server resources. Well, this will keep that from happening. And Guard pingbacks. Now pingbacks are when another site links to your site, and theoretically it should be some other blogger talking about how great your site is. In actuality, often it's spammers trying to get links back to their own site, and this option stops that sort of thing from happening. So there we are with the site-specific security options. I recommend 8G. I like the AI blocker, but you may not. Uh, I leave XML-RPC turned off. Uh, I like to deny X-Frame stuff. I don't really care about writing my own robots, but you might. And WP Fail to Ban is amazing. Uh, I recommend having all of this stuff turned on. So there you are with security settings from Xcloud. Now there is another video coming and it's going to feature some more things, so be sure to check that out.
