Pantheon

Pantheon is a Drupal and WordPress WebOps platform that hosts over 300,000 pages in the cloud and supports over 10 billion page views every month. Pantheon’s container-based, multi-tenant architecture allows businesses to access all of their websites from a single dashboard.

Block IPs in WordPress on Pantheon

This article is about blocking IPs in Pantheon for sites using the WordPress CMS. Prevent unwanted traffic incidents that might result in site outages and billing overages.

Review the nginx-access.log.

Download the nginx-access.log on the LIVE environment. The logs can be accessed using SFTP or by using the provided script from Pantheon’s documentation. Be sure to combine all the logs for a day if the site plan has multiple application containers. Identify the IP that has the highest number of visits and verify it with https://www.abuseipdb.com/

$ cat ~/site-logs/nginx-access.log | awk -F\" '{print $8}' | awk '{print $1}' | sort -n | uniq -c | sort -nr | head -20

Use a WordPress Plugin to Block IPs

Be sure to install the plugin WP Traffic Jammer that can be downloaded at WordPress.org https://wordpress.org/plugins/traffic-jammer. The plugin has a wp-cli command that can be used on a remote wp-cli call using Terminus. It also has a settings page to add a single IP or an IP range.

Block the IP using Terminus.

Use remote wp-cli via terminus to block the IP.

$ terminus wp <sitename>.<env> -- jam block <ip>

To unblock the IP.

$ terminus wp <sitename>.<env> -- jam unblock <ip>

Block the IP on the WordPress Admin Dashboard.

On the Admin Dashboard, you would see the left side menu, click “Traffic Jammer” and add a single IP or IPs, CIDR format can be also used for IP ranges.

Block the IP using a PHP Snippet

Use a PHP snippet that can be added to wp-config.php file. This offers an advantage since it would be triggered before loading all the plugins and themes.

if ( $_SERVER['REMOTE_ADDR'] == '154.84.133.8' ) {
  header( 'HTTP/1.0 403 Forbidden' );
  exit;
}

Terminus 3

What a great way to start a new year with releases, as this is the same for the company offering the best WebOps SAAS (Software as a Service) Platform which is Pantheon. During the last week of December, a new version tag of Terminus has been released, comes version 3.

What is Terminus?

The Terminus command-line interface provides advanced interaction with Pantheon. Terminus enables you to do almost everything in a terminal that you can do in the Pantheon Dashboard, and much more. In practice, some of the features missing on the Dashboard are included in Terminus. Developers can also include in development workflow or as part of a script for deployment using continuous integration.

Operating System Compatibility

As of this writing tested to work on the following platforms

  • MacOS
  • Windows 10 – WSL 2 Ubuntu 20.0
  • Ubuntu 20.0 – this would include Ubuntu under Docker or VirtualBox

Before getting frustrated, included also are the list of platforms that Terminus would not work:

  • Windows 10 – Command Line
  • Windows 10 – Git Bash (MingW)
  • Ubuntu 18.0 and later versions
  • Linux system with coreutils equal to or less than 8.28

Prerequisites Library

  • PHP 7.4 or above
  • PHP Extensions (mbstring, xml, curl, cli)
  • curl
  • git (if you need to include plugins)

Installation

As for the prior version of Terminus, it can be installed in many ways, the new version is limited to work only on the standalone PHAR package. Assuming all the requirements are met. Start the installation on the home folder

cd ~
mkdir ~/terminus && cd ~/terminus 
curl -L https://github.com/pantheon-systems/terminus/releases/download/`curl --silent "https://api.github.com/repos/pantheon-systems/terminus/releases/latest" | perl -nle'print $& while m#"tag_name": "\K[^"]*#g'`/terminus.phar --output terminus
chmod +x terminus
sudo ln -s ~/terminus/terminus /usr/local/bin/terminus

Plugins

The new version of Terminus comes with a plugin manager, installation now can be done using the terminus command

terminus self:plugin:install pantheon-systems/terminus-build-tools-plugin

That would work if the plugin is added to packagist, don’t worry you can add an old plugin by means of adding the path.

terminus self:plugin:install <plugin_name> <path>

To update the latest version of the plugin from packagist:

terminus self:plugin:update <plugin_name>

To remove the plugin:

terminus self:plugin:uninstall <plugin_name>

WinSCP on Pantheon

WinSCP is a popular free SFTP and FTP client for Windows, a powerful file manager that allows you to upload and download files on the Pantheon server. It provides a user-friendly interface for copying files between a local and remote computer using the FTP or SFTP protocol. This software is available only on Microsoft Windows.

Main Features

  • All common operations with files
  • Graphical Interface
  • Integrated text editor
  • Scripting and task automation
  • Translated into many languages

A complete WinSCP guide and an active user forum are freely accessible at the WinSCP site.

Download WinSCP

If you don’t already have WinSCP installed on your computer, download the most recent update and install it from their website.

Open WinSCP

Open WinSCP by accessing the application on the Windows Start menu. Make sure you have your site’s Pantheon SFTP connection information on hand. See the guidelines on how to find the SFTP credentials for your site if you need to get the connection details.

WinSCP

Enter the details from the Site Dashboard Connection Info from Pantheon. Use the password that is being used when logging into the Pantheon User Dashboard. Do check the protocol must be in SFTP and the port number is 2222.

Alternatively, you can also have passwordless access by using an SSH private key. Pantheon doesn’t offer SSH access to a shell environment but it allows it to be used on SFTP protocol.

You should add your public SSH key into your Pantheon account to get the most out of it. SSH keys are a better option for authentication than a basic password since they provide additional security protection. No matter how many sites you work on, you will only need to do this once. See Generate and Add SSH Keys for further information.

Click the Advanced select button, under SSH then click Authentication. Enter a private key in PPK format.

To get the site’s root simply navigate to the code folder and you will be able to download and upload files as normal.

Protecting WordPress login page thru Basic Authentication

Take steps to avoid brute force attacks on the WordPress admin dashboard page. This would add an additional layer to site security and avoid traffic excess. Basic Authentication would facilitate HTTP requests to require a username and a password.

Add Basic Authentication via .htaccess

This is applicable to sites using Apache as the web server, this would not work on hosts with Nginx as their web server. Two simple steps:

Create a .htpasswd file then upload it to your webroot folder, this is the folder mostly where “.htaccess" resides.

Add this line to your .htaccess file

<Files wp-login.php>
AuthUserFile /.htpasswd
AuthName "Security Lock"
AuthType Basic
require valid-user
</Files>

Add Basic Authentication on the wp-config.php file

Sometimes as customers don’t have access to server configuration and PHP would be the fallback method.

if(preg_match('/(wp-login.php)/',$_SERVER['REQUEST_URI'])){
    if (!isset($_SERVER['PHP_AUTH_USER']) || ( $_SERVER['PHP_AUTH_USER'] != 'yourusername' && $_SERVER['PHP_AUTH_PW']   != 'yourpassword')) {
	    header( 'Cache-Control: no-cache, must-revalidate, max-age=0' );
	    header( 'WWW-Authenticate: Basic realm="Security Lock"' );
        header( 'HTTP/1.0 401 Unauthorized' );          
        exit();          
     }
}

Skipping WordPress Background Updates

What is Site Health?

The WordPress admin interface is designed to assist end-users in self-servicing their sites by addressing typical setup difficulties and other aspects of maintaining a healthy online presence. It also gives developers a consistent place to store debugging information.

SiteHealth Dashboard

Why the need to skip background updates?

Some hosts, specially Pantheon.io handle the core updates by means of applying upstream updates, or in some common practice, more sites are now in version control using git. Site owners don’t want to ignore the whole time and miss out on potential problems.

Code snippet to skip the update

Create a file named sitehealth.php put it in wp-content/mu-plugins and put these lines of code.

<?php
/**
 * Plugin Name: Sitehealth 
 * Plugin URI: https://github.com/careydayrit/
 * Description: Skip core update on sites using Git
 * Version: 0.1
 * Author: Carey Dayrit
 * Author URI: https://careydayrit.com/
 *
 * @package sitehealth
 */
 
add_filter('site_status_tests', 'skip_background_updates_tests', 10, 1 );


function skip_background_updates_tests($tests){
    unset($tests['async']['background_updates']);
    return $tests;
}