How To Secure Your Admin Login Page

[@cpuuk]

Secure deployment should be the default install, and then people could look up how to make it less secure.

[@aetheralmeowstic2392]

Knowing people, no one would use that except the most experienced people.

[@FunctionGermany]

wordpress would drop like half it's userbase then 😂

[@rkvkydqf]

I don't really see how the defaults are any bad. Most problems come from brute-forcing a password, which is really the fault of the user. Rate limits can be quite useful as well, but they heavily depend on what normal traffic looks like for a given website.

[@robmorgan1214]

It's called fedora server with se Linux on by default. You can't make it do anything without a 6 inch thick neck beard and everyone who's ever posted on stack overflow on speed dial... it's my daily driver.

[@robmorgan1214]

My preference when it comes to security is to simply lock the door before removing it from the universe and gently placing it in the set of all sets that contains neither itself nor my door.

[@laetvm6793]

*Ernst Zermelo wants to know your location*

[@trajectoryunown]

The default settings in KeePassXC are universal from what I've seen; 20 characters, same character types, between 90-125 bits of entropy. I use Arch btw. First learned how awesome password managers were when I got a free trial of NordPass, but having all my passwords stored on someone else's computer never sat right with me. Switched to KeePassXC and never looked back. Absolutely fantastic. Having everything in a single, small file makes transferring everything a breeze.

[@DeeezNuts]

the thing with storing my passwords is, i can't manage a DB i have a single drive if it fails i am doomed and i need to access my passwords in college from my phone and such, so i settled with Bit Warden. I just switched to Arch btw.

[@meze2095]

@@DeeezNuts i mean just save it to a cloud or something, still better than completely relying on using an online service

[@Vysair]

@@DeeezNuts adding more to Meze's reply, you can just autosync the files/database using cloud like One Drive and pCloud.

[@nac5605]

“I use Arch btw” lmaoo

[@hihihihi3806]

@@meze2095 I save my KeePass .kdbx file to a usb I use for storing files

[@BlueJDev]

some great advice here. Don't forget to turn off the link that literally tells people your admin username as well. I forgot the link tho... loginizer has saved me a lot of headache also, this works similar to the lock out feature shown.

[@_apicius]

wp-config.php

[@nes999]

I'm sure these videos are as popular as some of the more drams/click baity. However, this sort of stuff is hard to get good solid info on. I really look forward to more.

[@trill_]

There's lots of documentation and books about website security out there. Or anything about websites for that matter.

[@maximusdecimus2350]

Dude, thank you for your content. I wish I had time to watch it all but what I do catch I always enjoy and most of the time I am learning something. Keep it up.

[@conceptrat]

Just to add to the changing login page URL piece. If the people using the login page have Google caching enabled on their browser then the login URL could end up in Google's cache which could then be found using Google Dorks.

[@DeeezNuts]

isn't there meta tags to prevent google from indexing? will it work or no.

[@DeeezNuts]

@@wwxkz probably idk, not web dev

[@ScienceOrbits]

@@wwxkz but then the hacker would just search for the robots.txt file

[@greyshopleskin2315]

@@ScienceOrbits yes but say you put allow /home or something, and deny /* There's no useful info

[@MEN101]

My sites get attacked everyday, 100s of times. I’ve limited the amount of tries for a user admin down to 2. Great tips bro.

[@Vixel4076]

5:20 fun fact/reminder! KeepassXC (or anything that can read the used database format) also acts as an 2FA Authenticator. More specifically TOTP, Timed One Time Passwords. This can be set up by right clicking an account entry and setting up TOTP then inserting the Secret Key. This allows a more ease of use with KPXC's browser integration allowing autofilling TOTP codes, the TOTP can be shown in KPXC too and I dont have to pull out my phone every time i need to log in. Android users have KeepassDX which can read these database files and show said TOTP. Obviously The security or safety of the 2FA and other passwords are as strong as your .kdbx file/setup, so be sure to secure that aswell. I personally use this method as it is less bloat when everything is handled by one single format rather than spreading off to several apps. Addendum 1/19Oct2022 Seems like theres a dispute that this defeat the purpose of 2FA. While I am aware of such fact, its rather up to you to decide whether or not you want such configuration above. For optimal security, if you call it that, you can use the above method but keep passwords and TOTP codes in seperate *database files* with seperate passwords to access each database file. I will say this, you choose how you secure things. There are many solutions out there and you can still get away with great security while having ease of use.

[@HyuLilium]

I've read that having your 2FA in the same place as your passwords defeats the purpose of 2FA. That's why I use aegis which is password protected.

[@SuperTort0ise]

@@HyuLilium yeah isn't the whole point to have "two" factors?

[@1yaz]

@@HyuLilium not necessarily.

[@1yaz]

@@SuperTort0ise You still have two factors assuming your keepass database is not compromised. Which is why you should keep your database on a disconnected device.

[@Vixel4076]

@@HyuLilium accessing the database file also requires a password so using aegis or kpxc will most likely produce the same results. if you're concerned with such attack vector then you are free to make another database file with a different strong password, which some would do. I will still stick to KPXC just because I can bring the database file anywhere and interoperate between other apps like the aforementioned KPDX on android. Whatever it may be, its better off than letting your browser/google account handle all the passwords.

[@seans2021]

Good to see some based WordPress security content on this channel. Is WordPress perfect? Nah. But it's the fastest and most reliable open source solution for a flexible website, and it's accessible bc people who can't code can still edit the content. The haters are salty cuz their open source CMS alternative either doesn't exist or doesn't even come close to the 43% Internet marketshare that WordPress has and will continue to have. 🤷

[@Keniisu]

Love to see some WordPress support in the comments

[@rkvkydqf]

Honestly, I don't really like WordPress. It does have a huge ecosystem of plugins and does its job quite well, but to me, it usually seems a bit overkill for what usually amounts to something that could be done with static Html/CSS. No hate towards WordPress, they've found a certain niche and filled it reasonably well. Also, let's not judge products by market share, since then Windows would be the best OS of all time. :)

[@Fractal_32]

@@rkvkydqf if you’re talking consumer computers, if you count everything else (servers, phones, etc.) you would see the Linux kernel dominates windows.

[@seans2021]

@@rkvkydqf I agree that a CMS in general is overkill if you are just trying to serve up a simple static site. But what if you need a database and dynamic content? e-commerce perhaps? Well then static just won't do. It really is about knowing what is the right tool for the job. Static sites are good for simple projects that won't require constant content updates. WordPress is my go-to for anything that I may need to hand off to a no-code client (most clients) or anything I may need to significantly expand functionality later (most projects). If you are handing off a website to a client who knows nothing about code, a static site makes them feel like they don't have control over their own website. They will have no idea what to do with the HTML/Css/Js. WordPress and Windows aren't at the top bc they're the "best." they're at the top bc they're the most accessible and most practical for the most people. Although as another commenter said Linux beats Windows if you include non-PCs. Based open source software 😁 For me it's about the time it saves & the empowerment it gives clients, especially those with a smaller budget. With WordPress, you don't have to keep reinventing the wheel. Just install the right plugin. Maybe you will have to add some custom code for it to do EXACTLY what you want, but that is the fun part. I am not trying to convince anybody WordPress is great for every situation, but it is popular for a reason. 😃

[@alainportant6412]

@@rkvkydqf Wordpress is not a "niche", 43% marketshare is not a "niche". As far as "learn to code" goes, well, nobody gives a shit about learning HTML/CSS. What's more, 90% of us simply don't have the minimum required IQ to even comprehend abstract concept behind computer code.

[@perthecther__203]

banger upload, as always

[@georgebaraza9141]

Good video on website security for web developers like me. I use WordPress as one of my frameworks for developing my sites and this will be helpful for me in work.

[@travis5732]

You could also add the rules to the Apache includes files, instead of the htaccess. Nice vid!

[@seikatsu2302]

Me and my boys on the way to secure our admin login page

[@DrXJ]

Always down to human error and laziness if u ask me. Even if there are bullet proof ways of security.. Thank you for teaching us lazies a better way.☺️

[@0xfeedcafe]

You can also do it creating your own CA and giving certificates to the people who can access the admin pages

[@CoolPage994]

Wasn’t thinking of it like that. Thankg g

[@diegosamayoa4782]

I think that would be interesting if you make some introduction video about pentesting or something similar

[@anon_y_mousse]

I think my favorite method of securing a computer is to disconnect it from the internet. Absolute banger.

[@Fractal_32]

Have you heard of “Stuxnet”? If you have not you will be really disappointed in your idea.

[@the_null_man]

How to secure your WordPress page: •don't use WordPress

[@pluto8404]

preferred security measures are to use ups http requests. only downside is the 5-10 business day latency.

[@hypnos4754]

@@pluto8404 Ever heard of a reverse-proxy?

[@the_null_man]

KZbin on their way to let the spammers do their thing, yet not allowing normal human beings comment.

[@hanna_GG2]

THANKS

[@realcartoongirl]

@@the_null_man yah i say the Fun word and my comment get deleted by youtube immediately

[@cyborghobo7847]

I'm making a WordPress site soon good timing man.

[@ME-L3U]

I love these types of videos.

[@maxtheo]

just the video i needed right now! thanks kenny!

Two tips to secure your webserver better: Restrict the permissions that a service has (`systemd-analyze security`), run everything if possible as a regular user, systemd can do that without those services using root first. Not directly related to the webserver but: encrypt your passwords using hardware by using a smartcard such as a yubykey or a regular pgp-smartcard.

[@someone7826]

+ Enforce SSL

[@Sv5YpWTwd9otTA4So83f]

One tip to secure your server: Uninstall systemd

@@Sv5YpWTwd9otTA4So83f And have less security? Stupid argument you make there but I guess you didn't got your fish.

[@perpetualcollapse]

I've just used landchad and set up the website for my old high school's meme page and my personal website

[@UltraNyan]

I just connected Fail2Ban to my apache log so when you fail wp-login or any other app that gives the same login error token for 2 times you get your ip banned serverwide for 24 hours

[@seans2021]

Newb cosplaying as a sysadmin here. Any tips or resources you could share to help protect our WordPress/Php sites on on a linux-based Apache server? Sounds like you know what is up. Best regards.

[@deathpacito6]

I run my own website locally and i get a suprising amount of requests trying to post or get to miscellaneous admin login pages for nearly every single framework default admin route

[@Dave-ie1fs]

Definitely need led this thank you so much! Love the channel btw both on here and on Odysee

[@leapbtw]

on my way to secure wordpress hello world page

[@Ootgreet1]

The entire concept of WordPress (and other CMSs) really gets under my skin, because: you're exposing powerful admin code directly to the public internet when you deploy one of these sites. While at the same time the profile of the individuals who use WordPress for their sites is very normie and end userish and heads down... they install gobs of anonymously written plugins and then they wonder why sh*t has to be constantly updated and fixed, or they wonder why they get hacked. That admin code is out there on the web inside every WordPress instance which is 98% of the time being used to deliver static pages. Frontpage '98 got it exactly right IMO - no code on the server and make the dummy build their site locally.

[@JRLarsen]

Not using the default username can help against brute force attacks

[@monkaSisLife]

The problem is, WP has a small problem when it comes to finding out a username. With a specific url I can tell you your Admin Username

[@fedo9644]

@@monkaSisLife do you know the url or any article where it's described?

[@linminsu3443]

@@fedo9644 I think he meant, given a url I can determine the admin username from that url.

[@someone7826]

The default username allows for rainbow table attacks on the credential database. Though a strong password mitigates this thread.

[@rkvkydqf]

A username is relatively easy to figure out because it wasn't ever intended as private data. A secure password would be a much more productive use of time.

[@MyEarsHurts]

Person: I finally made this website I worked 10 years on and it's finally open! SQL injections: allow me to introduce myself

[@Chris-on5bt]

Also on weird usernames, at least with WordPress there are multiple widely known methods of dumping the names of the user accounts.

[@lever1209]

you should make a video about hardening different web facing servers, for example I have a git server and some of the people using it need some software that doesn't let you set a custom port, so I needed to go figure out extra precautions if I'm going to use the default port for SSH

[@JordanPlayz158]

What are the extra precautions? Changing the port doesn't do much to ssh security wise, nor changing it back, you might just get failed ssh attempts in your logs which can be managed with fail2ban

[@someone7826]

Changing ports is just security through obscurity.

[@indignantvapid]

Adding captcha is also another important step imo.

[@stoneHeHenge]

Behold! I present to you THE BEST PHP security tip - don't use php

[@lgibson02]

There's no inherent security issues with PHP. A lot of amateur developers are attracted to the language for some reason though, you definitely see a lot more insecure configs and code from PHP land.

[@sleepyyui]

hackers hate this tip

[@qbasic16]

Imagine blaming a programming language instead of the actually horrible developers working on and with WP.

[@wiger_]

THE BEST COMPUTER security tip - don't use computers

[@TheDragShot]

@@lgibson02 it's all of those free hosting providers. They all accept nothing but PHP for scripting.

[@BradenJohnYoung]

Good guide!

[@ItsKingMyles]

I love doing an assessment and finding wp

[@CU.SpaceCowboy]

i either set custom useragent to access site else redirect to google and/or change server root to unique string or if behind rev proxy just proxypass at wtv uri i want. unique user-agent can f up though because some api use default user-agent even if assigned specifically. it’s annoying but aside from that its cool

[@DexieTheSheep]

4:07 To be fair, it's still a good idea to do this, but not for actual security. It's just helpful for deterring script kiddies who use bots and tools that scan for default admin accounts, but it's not like they'll be able to get in anyway if you have a good password. Not a WordPress user, but I don't use "admin" as my admin username on my site, because just in case some zero-day comes out in any of my dependencies, people can't just run a script to scan the web for vulnerable stuff (aka what those goobers tried to do to my patched Minecraft server back when Log4j came out) and try logging in with that username. It's such a minor use of your time, and there's pretty much no downside, so why not get the marginal security benefit? Plus, let's be real, an actual username is a lot cooler than just "admin." But yeah, this is NOT the top-tier brick wall defense that those WordPress security guides you mentioned make it out to be. Great video, hopefully some newbies will stop getting their sites hacked.

[@Sv5YpWTwd9otTA4So83f]

Yup. No reason to use an admin username that isn't at least twenty characters and a mix of random letters and numbers.

[@alainportant6412]

@@Sv5YpWTwd9otTA4So83f typing "admin" on my own website makes me feel powerful

[@N00N01]

Not going to tell, but my DTL account is the series/company of my favourite youtuber of my favourite game, wich is many of the diffrent games i play

11:49 What about using a tls client cert to secure the websites admin panel? About using the password in the /login url: the log will also appear in the server logs.

[@crypt0pure78]

thank u man ,can u please teach us how to setup an onion site on the tor network ? if you haven't already

[@medit_69]

didnt onionshare already do that?

[@crypt0pure78]

@@medit_69 i didnt know that amma go check it thank you

[@hypnos4754]

Solution: don't use bloated front-ends

[@technoman9000]

I wish I could, but everyone is so lazy they throw in 10MB of Javascript and a database to deliver what amounts to a simple HTML page...

[@linux_fox]

@Sdendix Pir nothing. you have to write html yourself

[@ChristopherJohnJackson]

It make static site generators look like a more saner option! In terms of security! 😮

[@pistachioguy934]

Why do you have chrome installed...

[@jlf_]

Also, Http Basic Auth can be helpful, easier then VPN

[@covnicorn]

Based and security pilled

[@CU.SpaceCowboy]

if site to be accessed by custom api only you could add guid or wtv to json dat in post/get request and restrict site by checking sql for allowed guid. the site could be set to only require specific parameters in json yo access regardless of whether its allowed as well. this is more of a malware type of technique though

[@seafighter4]

Nice video, but "changing the admin account's name is just security through obscurity, so let's not bother with that" and "changing the login page name is security through obscurity, but we can use a generated cryptic url, so we are going to do that" doesn't track with me.

[@NoahGooder]

I remember back in the day when all you needed to hack into any website was an sqli area. then you just needed to guess what directory thier admin page was stored in.

[@Mi.i.i]

Are you making a vid about the intel 12 gen chip info leaking. Havent seen much about it

[@jmtradacc]

Login: admin Password: admin

[@medit_69]

the actual security in my neighborhood wifi connections

[@bardoomguy]

make sure you use a password manager to remember that

[@syahrezank]

Kenny, what about cloudflare tunnel? can that be used as alternative to self-made vpn?

Configure certificate based authentication. That way you don't have to deal with WordPress being bad at security on that front at least.

[@Super-360]

Wondering why @mentaloutlaw hasn't done a video on what paypal is up to?

[@johnsmith8981]

Oracle has an always free cloud tier that could run a VPN server. I don't know if the IP is static and if it's private though 🤔

[@jeffmoss118]

Nice video. +5 BAT 🦇🦇🦇🦇🦇

[@tonkmonster]

Good job

[@salvatoretrupia2672]

great stuff

[@anythingbutASIC]

Yes.. Content.. show these noobs how its done.. This goes for over the internet exposed SSH terminals as well.

[@theloststarbounder]

How much RAM and CPU cores gets wasted by Ubuntu? Did they made it run on a NVMe like it was supposed to run (instantly open any app) or it's still using these crappy snaps that makes it run slower than on a HDD? I'd check myself but it runs like dogshit on a VM (the only distro that does that) and last time I ran it inside a VM it had an invisible overlay making a whole screen region unclickable until I installed KDE on it... I don't bother to run it on real hardware any soon neither...

[@Clopper6]

Thank you

[@FGj-xj7rd]

The amount of protection is huge 😂

[@Fractal_32]

He’s a Gentoo Linux user what do you expect? XD

[@artbanks27]

The chad way. Username: admin Password: password

[@rpm10k.]

Should put a fake login page in place of the original if you're going to move it

[@kentaviousaurelius]

What kind of linux distro are you using right now?🤔

[@fernandomota7193]

Truly odd times these we live in, Kenny is even using Ubuntu.

[@vargdog6602]

More wordpress videos soon?

[@ultimatums1]

can you do a video on the telemetry that constantly gets uploaded out of the android phone and how to analyze it?

[@FunctionGermany]

that would be cool

[@nes999]

This sounds stupid, but are there any non crypto options for donating? I feel borderline greedy for taking this man's info without atleast throwing some appreciation.

[@alsonsulos8547]

What are your thoughts on security keys?

[@midimusicforever]

Good stuff!

[@realcoy2115]

Wordfence pwns, just make sure you know what option is set for when login attempts using your actual username exceed the limit, you don't wanna lock yourself out.

[@SimoAtlas]

Well at least they should use zero trust implantation from a service like cloudflare and follow the best practices server side and front side

[@crowlsyong]

3:21 I thought Ubuntu was starting being deprecated from the serious linux community due to SNAP, kinda suprised that you're running it.

[@Wasper216]

It’s become so annoying with WP. When you’ve set up a new WP site, within 24 hours the first bots try to hack your login…

[@x1010xyz]

Tor-wise how did Ulbricht's IP leak via his login page when the FBI was inspecting packets?

[@benbertheau]

why do you have chrome

[@Ataraxia_Atom]

Have you used yubikeys for 2FA? I have mine arriving on Monday and I'm stoked to get them set up for my vaultwarden

[@KlMJONG-UN]

My school website lmao is ran on WordPress and it has my student number and everything in there lmao. I wanted to breach it, ethically, to show them how easy it is

[@alainportant6412]

so why didn't you do it ? you can't

[@Plisskien]

Maybe video about cloudflare?

[@0xshaheen]

Wordfence has the option to change the login page url, I would recommend doing it that way because less plugins means more security

[@tralphstreet]

Is there a general way to protect an entire homelab like this? Like, have a single open port with a single entry point.

[@SuperChristb]

A selfhosted VPN like wireguard and keeping all your other services on the internal network would probably suffice for that usecase.

[@lucienfaure9158]

A reverse proxy like nginx or caddy

[@SuperChristb]

@liQQiRichii Wireguard is really easy if you use a docker container tho. I set mine up in like 10 minutes. It’s also built in the kernel so I think long term Wireguard will be fine too.

[@Sam_Kings]

I first read the the title as ‘how to seduce your admin login page.’

[@Ultrajamz]

No love for django chads?

[@worldwide_wes]

Don’t most sites lock you out after so many failed attempts? Curious how brute force works in these cases if anyone doesn’t mind explaining

[@billeterk]

Distributed attacks

[@worldwide_wes]

Ahh thanks so like zombie machines each getting 3 attempts at a time?

[@DeeezNuts]

@@worldwide_wes but thats gonna get the account flagged, multiple devices trying to access 1 account is sus

[@worldwide_wes]

@@DeeezNuts well that was my initial question

[@user-ng6ye4mr1z]

what OS is this guy using?

[@TimeWarpTech]

Kenny installed chrome? unbelivable

[@Glicole_]

how about timing out retry for specific account? not for ip

14:00: Make sure to hide the version number of your webserver here.

[@someone7826]

That’s just security through obscurity. The version can be determined anyways.

@@someone7826 Showing which version is used is like outright showing the attackers the list of CVE's im affected by.

[@someone7826]

@ The attacker will find out anyways. That measurement provides a false sense of safety.

[@alainportant6412]

@@someone7826 I'm so done with this "security through obscurity" garbage putdown. Obfuscation is a reduction of attack surface. Yes, by itself, it's not very useful. And if used improperly, its worthless. But it's a support tool in a combined arms approach. Changing usernames to something that's as hard to predict as the password, AND creating automatic ban procedures for any IP/thumbprint combos that ever attempt to login with default usernames, is an easy layer of cloth against the wind. Apply the same to URLs and ports and now it's three layers against the wind. Combine that with other layers and you're all the more insulated.

[@W_0_W]

It turns out that anyone can ban the admin for 4 hours, just by entering the wrong password 20 times?

[@rkvkydqf]

(ban their own IP from logging in for 4 hours)

[@abe-danger]

could add something like mac address filtering, also, one cant hack a password if you dont use a password!

[@arduinoguru7233]

Honesty Whitelisting is the best way to secure anything, not WP only .

[@nite957]

ok but then how do you securely communicate all this to colleagues?

[@nutelhere]

pgp or on paper

[@dontannoyme]

Using this program at work lol

[@Ginfidel]

I'm so done with this "security through obscurity" garbage putdown. *Obfuscation is a reduction of attack surface.* Yes, by itself, it's not very useful. And if used improperly, its worthless. But it's a support tool in a combined arms approach. Changing usernames to something that's as hard to predict as the password, AND creating automatic ban procedures for any IP/thumbprint combos that ever attempt to login with default usernames, is an easy layer of cloth against the wind. Apply the same to URLs and ports and now it's three layers against the wind. Combine that with other layers and you're all the more insulated.

[@pidojaspdpaidipashdisao572]

Kenny my man, i am hosting hentai on my site not nuclear launch codes

[@qbasic16]

FBI, OPEN UP!

[@fedo9644]

@@qbasic16 hentai is not illegal. It's just animated porn

[@nabbikill]

11:23 an easy way to do this without a VPN is to use ssh tunneling, no need for VPNs

[@cd.NekOwareLGBT]

My friend's site was getting scanned as if it was WP, but it was not running off of WP, which was kinda funny.

[@Psiaqu]

How do you backup your Aegis vault?

[@rkvkydqf]

Settings.