BulletProof Security Forum

If you check your website using Google Chrome Developer tools you will see a lot of javascript errors.  For now do these things: purge all cache > LiteSpeed and CloudFlare > deactivate the BPS Pro Plugin Firewall.  Then add the CloudFlare hostname and IP address whitelist rules and save them (do not activate the Plugin Firewall yet) > then check y…[Read more]

Thank you for the response. A couple of additional details:

1. We are not using Cloudflare CDN, but the domain is hosted on Cloudflare. All caching options on Cloudflare CDN are disabled.
2. Exact CDN is being used for static files in combination with Quic.Cloud (LiteSpeed) CDN for the dynamic cache. We are using CDN Mapping options within the…

[Read more]

Ignore Repeated Errors only prevents duplicate php errors from being logged. It does not prevent/ignore php errors when they occur repeatedly. Example: If you look at the timestamp for each individual php error that is logged they will have different timestamps.

In general what I see when I  check your site are these problems:
– You are using…[Read more]

i was also looking for the same

Thanks, i’ll try it on my site

https://en.wikipedia.org/wiki/Cross-site_request_forgery

Limitations

Several things have to happen for cross-site request forgery to succeed:

1. The attacker must target either a site that doesn’t check the referrer header or a victim with a browser or plugin that allows referer spoofing.[22]

2. The attacker must find a form submission at th…

[Read more]

Thanks very much for that update.  I’ll forward your note to the team that did the security scan and we’ll see what response that provokes.  I’ll be back in touch to close the thread.

Thanks again,

Phil.

Either I am missing something here or misunderstanding the use of this phrase “Anti CSRF Tokens”.  From my understanding you ONLY need Anti CSRF Tokens for Forms and nothing else. BPS does offer CSRF attack protection, but does not add or interfere with any existing forms that belong to other plugins, such as Contact Forms or other Forms.  If a…[Read more]

Thanks for your quick response.  BPS was recommended by WPEngine to address the absence of anti-CSRF tokens.  My understanding was that anti-CSRF protection is a default capability of BPS so no additional configuration was carried out.  Just installed and hit “go”!

CORS setup was also criticised in the security review.  We addressed this by a&l…[Read more]

I would need more information to be able to help.  What are you using for your Anti CSRF Token protection?  Are you using CORS?  You cannot use CORS with Anti CSRF Tokens.  WordPress uses Nonces for CSRF protection.  If you want to protect forms (contact, etc.) you can use Google reCaptcha for your forms. It will protect your forms against CSRF…[Read more]

You can ignore this php error. This error only occurs when installing plugins on the WordPress Add New Plugins page. It is caused by the BPS free and BPS Pro plugins having the same plugin folder name => /bulletproof-security/.

Going by the code naming convention it looks like the code belongs to the WooCommerce Blocks plugin.  It is not malicious code. So you can safely restore the file.

Did you deactivate BPS Pro too?  Deactivating BPS Pro turns off the built-in troubleshooting capabilities like turning off the Plugin Firewall.  If you deactivated BPS Pro then activate BPS Pro and deactivate the BPS Pro Plugin Firewall.  Deactivating BPS Pro will turn off AutoRestore|Quarantine, but don’t forget to run the BPS Pro Setup Wi…[Read more]

Sorry, to be more specific, I also disabled all plugins on the site, except one for WPBackUp / Restore and still am getting 403 forbidden on JS files within a plugins respective /lib folders.

If plugin js scripts are being blocked then they might be blocked by the BPS Pro Plugin Firewall. Deactivate the Plugin Firewall and when restoring a website from a backup AutoRestore needs to be turned Off.  After you are done with the website restore, run the Pre-Installation Wizard and Setup Wizard.

The ModSecurity trigger was SQL Injection but I was running an intensive CSV import into a WP Plugin WP_Posts table