wp_wfConfig too large

Linux, MySQL

While debugging some bottlenecks in one of my servers…

i’v realised that one of my db queries to Wordfence tables were causing it.

Solution was to… uninstall wordfence – to clean all their tables – anda reinstall it.

After removing it 23:30, CPU usage and Load Average was a significantly reduced.

Remove prices from WooCommerce

woocommerce, Wordpress

We can simple use a plugin for it. YITH WooCommerce Catalog Mode can do the work.

Although this might not be enough if you want to remove prices from Google results.

Add the following to your functions.php located at your theme page.

add_filter( 'woocommerce_structured_data_product_offer', '__return_empty_array' );

Test your page results according to Google at
https://search.google.com/test/rich-results?hl=pt-br

Google Support – About sale price annotations
https://support.google.com/merchants/answer/9017019?hl=en&sjid=11620160989609311719-EU

Google Merchant Center
https://www.google.com/retail/solutions/merchant-center/

Web Application Security Checklist by probely

Uncategorized

The checklist

General security

  •  I use prepared statements in SQL queries
  •  I do not concatenate any other input data to SQL queries other than the bound parameters
  •  I validate all input data server-side
  •  I encode all input data before sending the response to the browser
  •  I have disabled directory listing in the web server
  •  I include a CSRF token in requests that change state (or I use the SameSite cookie attribute for the session cookie)
  •  I do not show errors with stack traces, source code, full paths or any other internal data.
  •  I verify the content type of uploaded files and delete the bad ones
  •  If I handle XML files, I disabled external entity and DTD processing
  •  I use HTTPS and I send the Strict-Transport-Security header
  •  I only accept TLS 1.2 or higher
  •  I set the Secure, HttpOnly and SameSite=lax attributes in session cookies
  •  I set the Secure attribute in all other cookies, and if possible HttpOnly also
  •  All 3rd-party JavaScript libraries that my app uses, are updated to the latest version

    I have a login feature and cannot use an already existent service:
  •  I store passwords using a strong cryptographic function (scrypt, argon2, bcrypt, or PBKDF2)
  •  I ask for the current password to set a new password, email or any other information used in the password reset process
  •  I only accept passwords longer than 12 chars and reject common passwords (top 1000)
  •  I support multi-factor authentication
  •  I limit the number of attempts to endpoints such as login, password reset and 2FA validation
  •  I use the language libraries to create and validate JSON Web Tokens (JWT)
  •  I destroy the session server-side and invalidate the matching JSON Web Token (JWT) when the user logs out
  •  I destroy the password reset token after it is used and after a pre-defined time
  • version 1.1

Read more at

https://github.com/Probely/security_checklist

https://www.probely.com

Real IP on nginx with Cloudflare

CloudFlare, nginx

Create the following file

/etc/nginx/cloudflare

with the following content

# Cloudflare IP addresses
# sources
# https://www.cloudflare.com/ips-v4/
# https://www.cloudflare.com/ips-v6/
#
# IPv4
set_real_ip_from 103.21.244.0/22;
set_real_ip_from 103.22.200.0/22;
set_real_ip_from 103.31.4.0/22;
set_real_ip_from 104.16.0.0/12;
set_real_ip_from 108.162.192.0/18;
set_real_ip_from 131.0.72.0/22;
set_real_ip_from 141.101.64.0/18;
set_real_ip_from 162.158.0.0/15;
set_real_ip_from 172.64.0.0/13;
set_real_ip_from 173.245.48.0/20;
set_real_ip_from 188.114.96.0/20;
set_real_ip_from 190.93.240.0/20;
set_real_ip_from 197.234.240.0/22;
set_real_ip_from 198.41.128.0/17;

# IPv6
set_real_ip_from 2400:cb00::/32;
set_real_ip_from 2405:8100::/32;
set_real_ip_from 2405:b500::/32;
set_real_ip_from 2606:4700::/32;
set_real_ip_from 2803:f800::/32;
set_real_ip_from 2c0f:f248::/32;
set_real_ip_from 2a06:98c0::/29;

real_ip_header CF-Connecting-IP;

The on /etc/nginx/nginx.conf inside http{….}

include /etc/nginx/cloudflare;

Test nginx configurations with nginx -t and if successful stop & start nginx.