I got it “use your own risk”. But actually not risk if you update:
If there is a bug in a plugin, websites are vulnerable to be mass exploited before there is an update released. This is where Pareto Security stands apart from the rest.
1) The function MUST ON. Because admin can not sit there to check log list always Hard ban injection attempts via browser user-agents & Soft Ban Bots
99% of the REAL risks to your website are taken care of by Pareto Security’s default settings. You do not have to active the advanced settings.
==> Your plugin blocked my admin IP ometime actually
==> Solution whitelist IP –and– whitelist browser user-agents –and– whitelist Bots
There was a code error in an earlier version of Pareto Security that caused that. This has now been fixed. Whitelisting IP addresses only works if the web admin is behind a static IP address. Most of the world isn’t.
2) Filter login attempts (Complete remove this feature)
==> No need this feature because this feature is specical, need many log. Can not just simple ON like this
==> Many plugin did a good job. It need allow number re-try, within time frame, temperory block, within time frame then block.
Example, user login setting: https://www.ads-software.com/plugins/all-in-one-wp-security-and-firewall/
No it won’t be removed. Most plugins do a terrible job at this. Users know their username, they often forget their passwords. Because Pareto Security like most security plugins prevents attackers from aggregating the list of usernames, it is only the attacker that does not know what the usernames are.
Pareto Security in advanced mode will block these attempts where a non-registered username is used.
However when it comes to login attacks, it is imperative that the administrators use hard passwords. Even if the username is known, it is impossible for an external attacker to break a good password via hammering the login page.
3) Email alert should allow admin input time for each option, example i setting
+ Low: real time or 15mins / 30mins/ 1 hours
+ Medium & heigh: Real time (or 15mins/15mins / 30mins/ 1 hours)
For the flexible option, depends on web situation
example:
My web on attack, i should ON real time for everything
My web on safe, i should ON 30 mins one for low, 15mins for Medium & heigh
===> Alert is really important for admin quick know what is going on and come back admin to fix issue as soon as everything gone.
Pareto Security works on a different philosophy than other plugins that are 90% graphics and warnings of attacks they missed and 10% preventing attacks.
Pareto Security is 100% about preventing both known and future discovered attacks from being successful
==> Why what happen if log keep 3-12 months for security tracking. There will be long list, we need to track if someone in whilelist try to return hack web everything single month by smart way. One month come with only 1 hack. Slow slow way but smart because we will not see huge attack.
Using Pareto Security in its recommended settings will not result in a very long list of attack logs. Pareto Security only keeps the last 100 attack requests. Even on very busy websites, this will not fill up in a few months.
In default mode only attacks that are real are logged. If you see an entry in there, it will be because an attacker is having a go at your website.
In advanced mode this is different. Many of the log records will be of normal bots doing what normal bots do, and a small element of those will be attack tools that are doing reconnaissance learning about your websites weaknesses – attackers taking their time so as not to be discovered.
It really doesn’t matter that much, because there will come a point when that attacker will have to make a malicious request, and when they do, Pareto Security will block the request and ban the IP address.
That is its principle purpose.
100% about being an application firewall, and 0% about being a graphic Disney world to trick users into thinking they are getting better security than they think they are.
