<?php

[0] Fix | Delete

if (!defined('WORDFENCE_VERSION')) { exit; }

[1] Fix | Delete

/**

[2] Fix | Delete

* Presents the Brute Force Protection group.

[3] Fix | Delete

*

[4] Fix | Delete

* Expects $firewall, $waf, and $stateKey.

[5] Fix | Delete

*

[6] Fix | Delete

* @var wfFirewall $firewall

[7] Fix | Delete

* @var wfWAF $waf

[8] Fix | Delete

* @var string $stateKey The key under which the collapse state is stored.

[9] Fix | Delete

* @var bool $collapseable If defined, specifies whether or not this grouping can be collapsed. Defaults to true.

[10] Fix | Delete

*/

[11] Fix | Delete

[12] Fix | Delete

$config = $waf->getStorageEngine();

[13] Fix | Delete

[14] Fix | Delete

if (!isset($collapseable)) {

[15] Fix | Delete

$collapseable = true;

[16] Fix | Delete

}

[17] Fix | Delete

?>

[18] Fix | Delete

<div class="wf-row">

[19] Fix | Delete

<div class="wf-col-xs-12">

[20] Fix | Delete

<div class="wf-block<?php if (!$collapseable) { echo ' wf-always-active'; } else { echo (wfPersistenceController::shared()->isActive($stateKey) ? ' wf-active' : ''); } ?>" data-persistence-key="<?php echo esc_attr($stateKey); ?>">

[21] Fix | Delete

<div class="wf-block-header">

[22] Fix | Delete

<div class="wf-block-header-content">

[23] Fix | Delete

<div class="wf-block-title">

[24] Fix | Delete

<strong><?php esc_html_e('Brute Force Protection', 'wordfence'); ?></strong>

[25] Fix | Delete

</div>

[26] Fix | Delete

<?php if ($collapseable): ?><div class="wf-block-header-action"><div class="wf-block-header-action-disclosure" role="checkbox" aria-checked="<?php echo (wfPersistenceController::shared()->isActive($stateKey) ? 'true' : 'false'); ?>" tabindex="0"></div></div><?php endif; ?>

[27] Fix | Delete

</div>

[28] Fix | Delete

</div>

[29] Fix | Delete

<div class="wf-block-content">

[30] Fix | Delete

<ul class="wf-block-list">

[31] Fix | Delete

<li>

[32] Fix | Delete

<?php

[33] Fix | Delete

echo wfView::create('options/option-switch', array(

[34] Fix | Delete

'optionName' => 'loginSecurityEnabled',

[35] Fix | Delete

'value' => wfConfig::get('loginSecurityEnabled') ? '1': '0',

[36] Fix | Delete

'titleHTML' => '<strong>' . esc_html__('Enable brute force protection', 'wordfence') . '</strong>',

[37] Fix | Delete

'subtitle' => __('This option enables all "Brute Force Protection" options, including strong password enforcement and invalid login throttling. You can modify individual options below.', 'wordfence'),

[38] Fix | Delete

'states' => array(

[39] Fix | Delete

array('value' => '0', 'label' => __('Off', 'wordfence')),

[40] Fix | Delete

array('value' => '1', 'label' => __('On', 'wordfence')),

[41] Fix | Delete

),

[42] Fix | Delete

'helpLink' => wfSupportController::supportURL(wfSupportController::ITEM_FIREWALL_WAF_OPTION_ENABLE_LOGIN_SECURITY),

[43] Fix | Delete

'noSpacer' => true,

[44] Fix | Delete

'alignment' => 'wf-right',

[45] Fix | Delete

))->render();

[46] Fix | Delete

?>

[47] Fix | Delete

</li>

[48] Fix | Delete

<li>

[49] Fix | Delete

<?php

[50] Fix | Delete

$breakpoints = array(2, 3, 4, 5, 6, 7, 8, 9, 10, 20, 30, 40, 50, 100, 200, 500);

[51] Fix | Delete

$options = array();

[52] Fix | Delete

foreach ($breakpoints as $b) {

[53] Fix | Delete

$options[] = array('value' => $b, 'label' => $b);

[54] Fix | Delete

}

[55] Fix | Delete

echo wfView::create('options/option-select', array(

[56] Fix | Delete

'selectOptionName' => 'loginSec_maxFailures',

[57] Fix | Delete

'selectOptions' => $options,

[58] Fix | Delete

'selectValue' => wfConfig::get('loginSec_maxFailures'),

[59] Fix | Delete

'title' => __('Lock out after how many login failures', 'wordfence'),

[60] Fix | Delete

'helpLink' => wfSupportController::supportURL(wfSupportController::ITEM_FIREWALL_WAF_OPTION_LOCK_OUT_FAILURE_COUNT),

[61] Fix | Delete

))->render();

[62] Fix | Delete

?>

[63] Fix | Delete

</li>

[64] Fix | Delete

<li>

[65] Fix | Delete

<?php

[66] Fix | Delete

$breakpoints = array(1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 20, 30, 40, 50, 100, 200, 500);

[67] Fix | Delete

$options = array();

[68] Fix | Delete

foreach ($breakpoints as $b) {

[69] Fix | Delete

$options[] = array('value' => $b, 'label' => $b);

[70] Fix | Delete

}

[71] Fix | Delete

echo wfView::create('options/option-select', array(

[72] Fix | Delete

'selectOptionName' => 'loginSec_maxForgotPasswd',

[73] Fix | Delete

'selectOptions' => $options,

[74] Fix | Delete

'selectValue' => wfConfig::get('loginSec_maxForgotPasswd'),

[75] Fix | Delete

'title' => __('Lock out after how many forgot password attempts', 'wordfence'),

[76] Fix | Delete

'helpLink' => wfSupportController::supportURL(wfSupportController::ITEM_FIREWALL_WAF_OPTION_LOCK_OUT_FORGOT_PASSWORD_COUNT),

[77] Fix | Delete

))->render();

[78] Fix | Delete

?>

[79] Fix | Delete

</li>

[80] Fix | Delete

<li>

[81] Fix | Delete

<?php

[82] Fix | Delete

$breakpoints = array(5, 10, 30, 60, 120, 240, 360, 720, 1440);

[83] Fix | Delete

$options = array();

[84] Fix | Delete

foreach ($breakpoints as $b) {

[85] Fix | Delete

$options[] = array('value' => $b, 'label' => wfUtils::makeDuration($b * 60));

[86] Fix | Delete

}

[87] Fix | Delete

echo wfView::create('options/option-select', array(

[88] Fix | Delete

'selectOptionName' => 'loginSec_countFailMins',

[89] Fix | Delete

'selectOptions' => $options,

[90] Fix | Delete

'selectValue' => wfConfig::getInt('loginSec_countFailMins'),

[91] Fix | Delete

'title' => __('Count failures over what time period', 'wordfence'),

[92] Fix | Delete

'helpLink' => wfSupportController::supportURL(wfSupportController::ITEM_FIREWALL_WAF_OPTION_COUNT_TIME_PERIOD),

[93] Fix | Delete

))->render();

[94] Fix | Delete

?>

[95] Fix | Delete

</li>

[96] Fix | Delete

<li>

[97] Fix | Delete

<?php

[98] Fix | Delete

$breakpoints = array(5, 10, 30, 60, 120, 240, 360, 720, 1440, 2880, 7200, 14400, 28800, 43200, 86400);

[99] Fix | Delete

$options = array();

[100] Fix | Delete

foreach ($breakpoints as $b) {

[101] Fix | Delete

$options[] = array('value' => $b, 'label' => wfUtils::makeDuration($b * 60));

[102] Fix | Delete

}

[103] Fix | Delete

echo wfView::create('options/option-select', array(

[104] Fix | Delete

'selectOptionName' => 'loginSec_lockoutMins',

[105] Fix | Delete

'selectOptions' => $options,

[106] Fix | Delete

'selectValue' => wfConfig::getInt('loginSec_lockoutMins'),

[107] Fix | Delete

'title' => __('Amount of time a user is locked out', 'wordfence'),

[108] Fix | Delete

'helpLink' => wfSupportController::supportURL(wfSupportController::ITEM_FIREWALL_WAF_OPTION_LOCKOUT_DURATION),

[109] Fix | Delete

))->render();

[110] Fix | Delete

?>

[111] Fix | Delete

</li>

[112] Fix | Delete

<li>

[113] Fix | Delete

<?php

[114] Fix | Delete

echo wfView::create('options/option-toggled', array(

[115] Fix | Delete

'optionName' => 'loginSec_lockInvalidUsers',

[116] Fix | Delete

'enabledValue' => 1,

[117] Fix | Delete

'disabledValue' => 0,

[118] Fix | Delete

'value' => wfConfig::get('loginSec_lockInvalidUsers') ? 1 : 0,

[119] Fix | Delete

'title' => __('Immediately lock out invalid usernames', 'wordfence'),

[120] Fix | Delete

'helpLink' => wfSupportController::supportURL(wfSupportController::ITEM_FIREWALL_WAF_OPTION_IMMEDIATELY_LOCK_OUT_INVALID_USERS),

[121] Fix | Delete

))->render();

[122] Fix | Delete

?>

[123] Fix | Delete

</li>

[124] Fix | Delete

<li>

[125] Fix | Delete

<?php

[126] Fix | Delete

$blacklist = wfConfig::get('loginSec_userBlacklist', '');

[127] Fix | Delete

if (empty($blacklist)) {

[128] Fix | Delete

$users = array();

[129] Fix | Delete

}

[130] Fix | Delete

else {

[131] Fix | Delete

$users = explode("\n", wfUtils::cleanupOneEntryPerLine($blacklist));

[132] Fix | Delete

}

[133] Fix | Delete

[134] Fix | Delete

echo wfView::create('options/option-token', array(

[135] Fix | Delete

'tokenOptionName' => 'loginSec_userBlacklist',

[136] Fix | Delete

'tokenValue' => $users,

[137] Fix | Delete

'title' => __('Immediately block the IP of users who try to sign in as these usernames', 'wordfence'),

[138] Fix | Delete

'subtitle' => __('Hit enter to add a username', 'wordfence'),

[139] Fix | Delete

'helpLink' => wfSupportController::supportURL(wfSupportController::ITEM_FIREWALL_WAF_OPTION_IMMEDIATELY_BLOCK_USERS),

[140] Fix | Delete

))->render();

[141] Fix | Delete

?>

[142] Fix | Delete

</li>

[143] Fix | Delete

<li>

[144] Fix | Delete

<?php

[145] Fix | Delete

echo wfView::create('options/option-toggled-select', array(

[146] Fix | Delete

'toggleOptionName' => 'loginSec_breachPasswds_enabled',

[147] Fix | Delete

'enabledToggleValue' => 1,

[148] Fix | Delete

'disabledToggleValue' => 0,

[149] Fix | Delete

'toggleValue' => !!wfConfig::get('loginSec_breachPasswds_enabled') ? 1 : 0,

[150] Fix | Delete

'selectOptionName' => 'loginSec_breachPasswds',

[151] Fix | Delete

'selectOptions' => array(array('value' => 'admins', 'label' => __('For admins only', 'wordfence')), array('value' => 'pubs', 'label' => __('For all users with "publish posts" capability', 'wordfence'))),

[152] Fix | Delete

'selectValue' => wfConfig::get('loginSec_breachPasswds'),

[153] Fix | Delete

'title' => __('Prevent the use of passwords leaked in data breaches', 'wordfence'),

[154] Fix | Delete

'helpLink' => wfSupportController::supportURL(wfSupportController::ITEM_FIREWALL_WAF_OPTION_PREVENT_BREACH_PASSWORDS),

[155] Fix | Delete

))->render();

[156] Fix | Delete

?>

[157] Fix | Delete

</li>

[158] Fix | Delete

<li>

[159] Fix | Delete

<?php

[160] Fix | Delete

echo wfView::create('options/option-label', array(

[161] Fix | Delete

'titleHTML' => '<strong>' . esc_html__('Additional Options', 'wordfence') . '</strong>',

[162] Fix | Delete

'noSpacer' => true,

[163] Fix | Delete

))->render();

[164] Fix | Delete

?>

[165] Fix | Delete

</li>

[166] Fix | Delete

<li>

[167] Fix | Delete

<?php

[168] Fix | Delete

echo wfView::create('options/option-toggled-select', array(

[169] Fix | Delete

'toggleOptionName' => 'loginSec_strongPasswds_enabled',

[170] Fix | Delete

'enabledToggleValue' => 1,

[171] Fix | Delete

'disabledToggleValue' => 0,

[172] Fix | Delete

'toggleValue' => !!wfConfig::get('loginSec_strongPasswds_enabled') ? 1 : 0,

[173] Fix | Delete

'selectOptionName' => 'loginSec_strongPasswds',

[174] Fix | Delete

'selectOptions' => array(array('value' => 'pubs', 'label' => __('Force admins and publishers to use strong passwords (recommended)', 'wordfence')), array('value' => 'all', 'label' => __('Force all members to use strong passwords', 'wordfence'))),

[175] Fix | Delete

'selectValue' => wfConfig::get('loginSec_strongPasswds'),

[176] Fix | Delete

'title' => __('Enforce strong passwords', 'wordfence'),

[177] Fix | Delete

'helpLink' => wfSupportController::supportURL(wfSupportController::ITEM_FIREWALL_WAF_OPTION_ENFORCE_STRONG_PASSWORDS),

[178] Fix | Delete

))->render();

[179] Fix | Delete

?>

[180] Fix | Delete

</li>

[181] Fix | Delete

<li>

[182] Fix | Delete

<?php

[183] Fix | Delete

echo wfView::create('options/option-toggled', array(

[184] Fix | Delete

'optionName' => 'loginSec_maskLoginErrors',

[185] Fix | Delete

'enabledValue' => 1,

[186] Fix | Delete

'disabledValue' => 0,

[187] Fix | Delete

'value' => wfConfig::get('loginSec_maskLoginErrors') ? 1 : 0,

[188] Fix | Delete

'title' => __('Don\'t let WordPress reveal valid users in login errors', 'wordfence'),

[189] Fix | Delete

'helpLink' => wfSupportController::supportURL(wfSupportController::ITEM_FIREWALL_WAF_OPTION_MASK_LOGIN_ERRORS),

[190] Fix | Delete

))->render();

[191] Fix | Delete

?>

[192] Fix | Delete

</li>

[193] Fix | Delete

<li>

[194] Fix | Delete

<?php

[195] Fix | Delete

echo wfView::create('options/option-toggled', array(

[196] Fix | Delete

'optionName' => 'loginSec_blockAdminReg',

[197] Fix | Delete

'enabledValue' => 1,

[198] Fix | Delete

'disabledValue' => 0,

[199] Fix | Delete

'value' => wfConfig::get('loginSec_blockAdminReg') ? 1 : 0,

[200] Fix | Delete

'title' => __('Prevent users registering \'admin\' username if it doesn\'t exist', 'wordfence'),

[201] Fix | Delete

'helpLink' => wfSupportController::supportURL(wfSupportController::ITEM_FIREWALL_WAF_OPTION_PREVENT_ADMIN_REGISTRATION),

[202] Fix | Delete

))->render();

[203] Fix | Delete

?>

[204] Fix | Delete

</li>

[205] Fix | Delete

<li>

[206] Fix | Delete

<?php

[207] Fix | Delete

echo wfView::create('options/option-toggled', array(

[208] Fix | Delete

'optionName' => 'loginSec_disableAuthorScan',

[209] Fix | Delete

'enabledValue' => 1,

[210] Fix | Delete

'disabledValue' => 0,

[211] Fix | Delete

'value' => wfConfig::get('loginSec_disableAuthorScan') ? 1 : 0,

[212] Fix | Delete

'title' => __('Prevent discovery of usernames through \'/?author=N\' scans, the oEmbed API, the WordPress REST API, and WordPress XML Sitemaps', 'wordfence'),

[213] Fix | Delete

'helpLink' => wfSupportController::supportURL(wfSupportController::ITEM_FIREWALL_WAF_OPTION_PREVENT_AUTHOR_SCAN),

[214] Fix | Delete

))->render();

[215] Fix | Delete

?>

[216] Fix | Delete

</li>

[217] Fix | Delete

<li>

[218] Fix | Delete

<?php

[219] Fix | Delete

echo wfView::create('options/option-toggled', array(

[220] Fix | Delete

'optionName' => 'loginSec_disableApplicationPasswords',

[221] Fix | Delete

'enabledValue' => 1,

[222] Fix | Delete

'disabledValue' => 0,

[223] Fix | Delete

'value' => wfConfig::get('loginSec_disableApplicationPasswords') ? 1 : 0,

[224] Fix | Delete

'title' => __('Disable WordPress application passwords', 'wordfence'),

[225] Fix | Delete

'helpLink' => wfSupportController::supportURL(wfSupportController::ITEM_FIREWALL_WAF_OPTION_DISABLE_APPLICATION_PASSWORDS),

[226] Fix | Delete

))->render();

[227] Fix | Delete

?>

[228] Fix | Delete

</li>

[229] Fix | Delete

<li>

[230] Fix | Delete

<?php

[231] Fix | Delete

echo wfView::create('options/option-toggled', array(

[232] Fix | Delete

'optionName' => 'other_blockBadPOST',

[233] Fix | Delete

'enabledValue' => 1,

[234] Fix | Delete

'disabledValue' => 0,

[235] Fix | Delete

'value' => wfConfig::get('other_blockBadPOST') ? 1 : 0,

[236] Fix | Delete

'title' => __('Block IPs who send POST requests with blank User-Agent and Referer', 'wordfence'),

[237] Fix | Delete

'subtitleHTML' => esc_html__('If you use external services that may send POST requests without these headers, do not use this option, as they will be blocked.', 'wordfence'),

[238] Fix | Delete

'helpLink' => wfSupportController::supportURL(wfSupportController::ITEM_FIREWALL_WAF_OPTION_BLOCK_BAD_POST),

[239] Fix | Delete

))->render();

[240] Fix | Delete

?>

[241] Fix | Delete

</li>

[242] Fix | Delete

<li>

[243] Fix | Delete

<?php

[244] Fix | Delete

echo wfView::create('options/option-textarea', array(

[245] Fix | Delete

'textOptionName' => 'blockCustomText',

[246] Fix | Delete

'textValue' => wfConfig::get('blockCustomText'),

[247] Fix | Delete

'title' => __('Custom text shown on block pages', 'wordfence'),

[248] Fix | Delete

'alignTitle' => 'top',

[249] Fix | Delete

'subtitleHTML' => esc_html__('HTML tags will be stripped prior to output and line breaks will be converted into the appropriate tags.', 'wordfence'),

[250] Fix | Delete

'subtitlePosition' => 'value',

[251] Fix | Delete

'helpLink' => wfSupportController::supportURL(wfSupportController::ITEM_FIREWALL_WAF_OPTION_CUSTOM_BLOCK_TEXT),

[252] Fix | Delete

))->render();

[253] Fix | Delete

?>

[254] Fix | Delete

</li>

[255] Fix | Delete

<li>

[256] Fix | Delete

<?php

[257] Fix | Delete

echo wfView::create('options/option-toggled', array(

[258] Fix | Delete

'optionName' => 'other_pwStrengthOnUpdate',

[259] Fix | Delete

'enabledValue' => 1,

[260] Fix | Delete

'disabledValue' => 0,

[261] Fix | Delete

'value' => wfConfig::get('other_pwStrengthOnUpdate') ? 1 : 0,

[262] Fix | Delete

'title' => __('Check password strength on profile update', 'wordfence'),

[263] Fix | Delete

'helpLink' => wfSupportController::supportURL(wfSupportController::ITEM_FIREWALL_WAF_OPTION_CHECK_PASSWORD),

[264] Fix | Delete

))->render();

[265] Fix | Delete

?>

[266] Fix | Delete

</li>

[267] Fix | Delete

<li>

[268] Fix | Delete

<?php

[269] Fix | Delete

echo wfView::create('options/option-toggled', array(

[270] Fix | Delete

'optionName' => 'other_WFNet',

[271] Fix | Delete

'enabledValue' => 1,

[272] Fix | Delete

'disabledValue' => 0,

[273] Fix | Delete

'value' => wfConfig::get('other_WFNet') ? 1 : 0,

[274] Fix | Delete

'title' => __('Participate in the Real-Time Wordfence Security Network', 'wordfence'),

[275] Fix | Delete

'helpLink' => wfSupportController::supportURL(wfSupportController::ITEM_FIREWALL_WAF_OPTION_PARTICIPATE_WFSN),

[276] Fix | Delete

))->render();

[277] Fix | Delete

?>

[278] Fix | Delete

</li>

[279] Fix | Delete

</ul>

[280] Fix | Delete

</div>

[281] Fix | Delete

</div>

[282] Fix | Delete

</div>

[283] Fix | Delete

</div> <!-- end brute force protection -->

[284] Fix | Delete