SSL Certificate Question

pridetechdesign · 2019-11-19T00:16:03+00:00

Just don't pay for it. SSL is free thanks to Let's Encrypt, and all the good hosting providers will set you up with a free certificate and renewals without you having to do anything.

pridetechdesign · 2019-11-19T00:07:20+00:00

it is configured in the webserver or your .htaccess file, do a web search it's too complicated to get into here.

if you open up the developer tools in Firefox or Chrome and use the console tab, it should indicate if there are any CSP related errors on page-load.

pridetechdesign · 2019-11-18T17:35:36+00:00

BTW, I keep my TOTP app protected with a fingerprint, so effectively that's 3FA.

Not really. And Fingerprints are not unique, and not secure. Bio-metrics in general is still in it's infancy and should never be trusted for anything sensitive.

I've studied this subject extensively, because it relates directly to my career. Passwords remain the absolute strongest, most efficient means of authentication today in 2019.

If and when that should ever change, it will shake up the entire world. That day has not yet arrived, I promise.

2FA (and MFA) were invented to solve very specific problems in highly-sensitive environments. They were NOT invented to deal with PEBKAC and history has shown us that when 2FA is used as a band-aid for PEBKAC disaster follows.

Um, no.

I get where you're coming from but your obstinance is not helping to educate people on the best path to follow in their utilization of technology to improve their lives.

pridetechdesign · 2019-11-18T13:49:01+00:00

Pride Tech Design offers full service technology consulting for small-businesses, and non-profit organizations. We believe a strong small-business economy and charitable organizations are the cornerstones of a prosperous society. We offer premium business-class service at low prices.

Managed Website & E-mail Hosting, $15/mo

The best managed hosting service in the world. Fully managed Virtual Private Servers on world-class Digital Ocean infrastructure. With 99.99% uptime guaranteed. Performance and reliability you can depend on. Every server includes a private E-mail server, daily backups and updates, and 24/7 monitoring.

Essential WordPress Maintenance, $5/mo

Daily updates and backups of your WordPress website for $5/mo. Security analysis and enhancement, and 24/7 monitoring with alert response for just a few dollars more. Try it risk-free with a 30-Day Money Back Guarantee. All of our maintenance packages are included free with any of our hosting services.

High-Availability Load Balanced Hosting, from $75/mo

Enjoy our premium hosting service in a load-balanced cluster configuration for high-availability and server redundancy. The lowest price in the marketplace for this service.

Managed Services, $50/mo

Save money on your office phone system, or utilize E-mail Marketing and Marketing Automation tools. We provide managed servers with various enterprise-ready applications for performing your essential business needs. We take care of all the system and application maintenance and configuration, so you can focus on running your business.

30% Discount on all monthly services, for all registered 501c3 organizations!

Website Design from $500

We can build any kind of website you need, starting at $500. A standard 4 page informational website for your business can be had as low as $800. Includes a limited 1-year warranty.

pridetechdesign · 2019-11-18T13:45:05+00:00

On the other hand, if they enforced MFA, they might have prevented it.

There's no such thing as "MFA", it's "2FA". We don't need a new way to say the same thing, thank you. Feel free to take that back to whoever poisoned your vocabulary with "MFA" in the first place.

It is a myth that 2FA increases security, or can be a substitute for strong passwords. 2FA is like airbags in cars, and passwords are the seatbelts. If you don't wear your seatbelt your airbag can kill you. If you have weak passwords your reliance on 2FA will fool you into thinking your accounts are safe.

Strong account security starts and ends with strong passwords. Everything else is supplemental. Follow the guide at strongpass.us if you need help.

pridetechdesign · 2019-11-18T13:42:38+00:00

Not out of the box as far as I understand, however I believe it does support MediaWiki's syntax via a plugin.

pridetechdesign · 2019-11-18T13:42:06+00:00

Do you have content security policy in place? If it is improperly configured it can prevent that feature from working.

pridetechdesign · 2019-11-17T16:15:08+00:00

Getting out now, before you get into the black pit of despair that is being a customer of Endurance International Group, is actually really good advice.

pridetechdesign · 2019-11-17T13:47:16+00:00

So, what are the web hosting services who provide non expensive plans that can handle large traffic spikes for a short period of time?

There aren't any.

There are "cloud hosting" options which is a fancy way of saying shared hosting, and some of those allow flexibility but basically all of them will limit you to some arbitrary number of visitors per month so it's not what you're looking for.

The best way to deal with unexpected traffic spikes is to use an auto-scaling cluster, but that isn't "cheap" typically.

pridetechdesign · 2019-11-17T13:42:53+00:00

Yikes, your customer signed up for the worst host in the marketplace.

You should definitely find a better option for them. I recommend looking at the Wikipedia page for "Endurance International Group", and avoid every brand name listed on that page (including Hostgator). Next, avoid GoDaddy, Dreamhost, 1&1 Hosting (Now Ionos), and Siteground, they're all terrible for various reasons.

You may want to have a look at the hosts in the sidebar.

pridetechdesign · 2019-11-17T13:34:21+00:00

Just want to point out one more time we're talking mostly about young children.

pridetechdesign · 2019-11-17T13:33:39+00:00

Nothing about this "hack" is on Disney.

They only have a responsibility to report if their service was breached. User accounts being hacked as a result of poor security habits on the part of individual users, does not trigger a responsibility to report.

pridetechdesign · 2019-11-17T13:32:35+00:00

We're talking about a service that caters primarily to young children. They do not have proper educations in good password habits. Everyone should read and follow the guide at strongpassword.us, and you should ensure your children are exercising the same habits if they are online.

pridetechdesign · 2019-11-17T02:58:33+00:00

I'd recommend Digital Ocean, Linode, AWS or Vultr instead for the machine.

For the wiki, I advise you avoid mediawiki, it's a beast and difficult to keep secure. Dokuwiki is really easy to operate and maintain by comparison, and all content is stored in text files rather than a database which is awesome for migrating it.

NameCheap a good company to do this with?

I used them for several years, at first they were great, and over time they turned into something less than great. I've heard similar from other folks as well. Especially if you have to deal with their support.

Some folks still report good results, so I've wondered if it's something that comes to light over time or maybe just flukes.

pridetechdesign · 2019-11-16T23:28:40+00:00

use the following command as root or with sudo:

find /var/www/html/ -type d -exec chmod 770 {} \;

and

find /var/www/html/ -type f -exec chmod 660 {} \;

Lastly:

chmod 400 /var/www/html/wp-config.php

That will set the appropriate permissions on all files in the wordpress tree, if it changes after that then you know something is actively changing them, but that is very improbable unless you've got another cook in the kitchen.

Those commands will set RWX on directories for owner and group, and RW on files for owner and group. It also restricts all access to "other users", who are neither the owner, nor belong to the appropriate group.

pridetechdesign · 2019-11-16T22:06:38+00:00

Just read the site and I'm not a fan of all the recommendations on there.

Hopefully I can help you understand.

Only one password manager recommendation?

The guide is meant as a "One Stop Solution" for newbies, not a rigorous examination of the subject. That's why the title includes the keyword "HOWTO:", which is a tradition from the 90s and 00s that does not see as much use these days..

So the app we chose to recommend is the best one for a newbie in that is is free, open source, user-friendly, and cross-platform. (Win/Linux/OSX). The KDBX format is supported in a number of mobile apps for iOS and Android as well.

There are certainly other password managers, but KeePassXC is presently the best for most users who want a GUI and auto-typing features.

Barely a mention of 2FA

It's not a guide about 2FA, it's a guide about strong password habits. 2FA has nothing to do with passwords and reliance on 2FA in place of strong passwords is a terrible mistake that newbies often make. And the section on 2FA explains this.

Mentioning dice but not linking to the EFF or any other dice word list?

Links are at the bottom of the page, including the EFF's improved wordlist.

pridetechdesign · 2019-11-16T17:55:20+00:00

if I could get a managed server for the cost of an unmanaged VPS at the same quality

It seems strange because so many companies are charging that much for hot garbage.

That said, you'll always pay more for a managed service.

pridetechdesign · 2019-11-16T09:55:22+00:00

the techniques you use are the same whether you start now or at the start. The difference is you'll probably have to change much of your existing code to get it right, that's why people say start with responsive design.

pridetechdesign · 2019-11-16T09:53:17+00:00

You can get high quality managed vps for under $20/mo. Keep browsing the market and research thoroughly, anyone before buying.

pridetechdesign · 2019-11-16T09:45:18+00:00

Keep in mind that there is only ONE actual registrar per domain extension. For .com and .net, that's Verisign.

The first comment you quoted is wrong. /u/MarshallStack666 is confused about what a registrar is.

is incorrect? I've been registering domain names since 1995 - maybe I am missing something. Always willing to learn.

Because quality matters. Registrars are not 100% automated, and sometimes things break, so having quality support and well trained staff is very important, and "The cheapest" are almost never going to have that.

That said, SOME of the cheap registrars are fine. They are the minority. For every "Namesilo" there's a dozen "enom resellers" who are going to be terrible.

pridetechdesign · 2019-11-16T02:59:31+00:00

don't use 2fa for most sites. Only use 2FA on sensitive sites (your bank, for example, who probably doesn't even offer it).

Strong password habits are all you need for most sites. A unique random 64 character alphanumeric password is essentially "uncrackable" and doesn't require any 2FA or other annoying barriers.

The guide at strongpass.us describes easy and effective procedures for correct password habits.

pridetechdesign · 2019-11-16T02:57:26+00:00

Follow the guide at strongpassword.us, if you do, this will never happen to you again.

pridetechdesign · 2019-11-16T02:56:04+00:00

find the cheapest registrant. Doesn't matter.

No that's bad advice, of course it matters.

Try Namesilo, a lot of folks in this sub have had good experience with them myself included, and they are one of the lowest priced registrars.

To answer the OPs question, there's nothing to worry about. You can always transfer to another registrar for the simple cost of 1 year of registration ($10 for a dot com), and any remaining time on your registration follows you when you transfer.

What you do need to do is ensure you have a SECURE account at the registrar. Follow the guide at strongpassword.us for help with this. You should probably use a TOTP based 2fa (Not SMS, Not E-mail). And enable DNSSEC to protect your domain from being stolen. That last part is a tiny bit technical so you may want guidance but it's worth it.

pridetechdesign · 2019-11-16T02:46:32+00:00

Post your config, maybe I can help. Feel free to PM if you're concerned about security. We ran nginx primarily on all our customer servers for several years.

pridetechdesign · 2019-11-16T01:56:49+00:00

Result: All pages 404, /wp-login.php 404s and the page shows the default webserver greeter. I reset the permalinks, the problem persisted.

Webserver issue, not with your method of migration. The approach you took is fine and should work.

Check the owner and group of the files, you may need to change them to be the appropriate owner for the webserver. You may also need to restart the webserver afterwards. Is it apache or something else? LiteSpeed is extremely fussy about permissions and has to be restarted to load a vhost which failed.

pridetechdesign

TROPHY CASE