Oct 22, 2026, 7:26 PM@mhoye@cosocial.ca deployment is only easy if you know how to wrangle a CGI enabled reverse proxy into submission. if you have access to a host where this is preconfigured, then sure, but this isn't what i would think of as a standard availability nowadays
Oct 22, 2026, 7:29 PM@amy I don’t know how to do any of that, and I run a custom fork of Wordpress using SQLite that I deploy with rsync.
Oct 22, 2026, 7:37 PMNote: The location of your root web directory in the filesystem on your web server will vary across hosting providers and operating systems. Check with your hosting provider or system administrator if you do not know where this is.https://developer.wordpress.org/advanced-administration/before-install/howto-install/#step-4-upload-the-files
Oct 22, 2026, 8:47 PM@mhoye @amy ive run dozens of WP sites for over a decade on servers i build myself, have written dozens of plugins for wp and also have no idea what you just said...are you able to clarify?
*i remember the term cgi (conmon gateway interface) being used in the context of perl scripting waaay back in the day (before asp and phpbexisted), but as far as im aware have not needed to configure one since then, unless it would have been presented under a different name
Oct 22, 2026, 8:48 PM@nflux@gts.exile.social @mhoye@cosocial.ca you'd have to deploy apache or similar in some fashion to actually run the php, as best i can tell the wordpress installer does not explain how to do this. id be curious what is used if not apache though.
Oct 22, 2026, 8:51 PMOct 22, 2026, 8:55 PM@nflux@gts.exile.social @mhoye@cosocial.ca i am now curious that apache is this easy to use for people who don't touch computers a lot. i always felt it was more complex than alternatives, but i wonder if this is because it does way more out of the box than others. this opinionated style is typically something that annoys me (because i have a very specific known usecase for myself)
Oct 22, 2026, 8:50 PMOct 22, 2026, 8:52 PM@nflux@gts.exile.social @mhoye@cosocial.ca perhaps apache comes out of the box with this, sure, my point was more generally that deploying any dynamic thing is more complicated than static pages
you could equally use python, shell, etc which are all supported by CGI (the thing that runs your PHP)
Oct 22, 2026, 9:00 PM@amy @mhoye right ok. i came from IIS+asp so the idea of having a webserver+[scripting language addon] was just how it was done.
typically apache has been pretty straightforward to deploy for that use case, and along the way i learned how to do other fancier stuff like setting up fwd/rev proxies (e.g to front something like owncast or other "back end" apps via ssl), even over fwd/rev ssh tunnels and the like, so i guess i thought you were suggesting id need some special config on top of basic apache+php installed., rather than outlining how it already worked
Oct 22, 2026, 9:01 PM@nflux@gts.exile.social @mhoye@cosocial.ca in other reverse proxies (nginx, eg) you would need to apply some config to make these scripting langs work. thanks for the insight
and apologies to op, i was overly brash and hostile to your view
Oct 22, 2026, 9:04 PMOct 22, 2026, 9:06 PMOct 22, 2026, 9:06 PM@nflux@gts.exile.social @mhoye@cosocial.ca sqlite gets a thumbs up from me. we love sqlite
Oct 22, 2026, 9:24 PM@amy @mhoye unfortunately once you have your wp up and running, and especially if your site is well ranked by the search engines... that's when your problems start i.e. the bot invasion starts.
after my server got hacked from an out of date plugin in 2015 i got a bit obsessed with this subject and wrote a thing where all my sites work together to protect key endpoints and it seems to have been quite effective (still running, so far 0 hacks and eliminates 99.9% of spam signups).. which was especially relevant in a hostile environment like sexwork and it became something of a USP of my 'hosting'. it could even identify & silently redirect hostile traffic to a severely rate limited vhost (e.g 0.1kb/s) where returning a 100kb animated gif would take ages and quickly "slow loris" logjam attacks over proxychains.
i have no idea how others deal with it tho bc jetpack, cloudflare & wafs like wordfence never really seemed to do much and that stuff was *draining*.
Oct 22, 2026, 9:25 PM@nflux@gts.exile.social @mhoye@cosocial.ca what you're doing is a WAF, but one that actually addresses the attacks you're facing. you are developing an actually effective cloudflare for the attackers you're facing
this is the life of a defender, though typically with something a little sturdier to base on than WP (notorious for its security, as i'm sure you're aware)
Oct 22, 2026, 9:26 PM@nflux@gts.exile.social @mhoye@cosocial.ca CF is a protection racket for DDoS imo.
Oct 22, 2026, 9:32 PMOct 22, 2026, 9:31 PM@amy @mhoye
i guess a waf that actually works then lol. i just soent a long time looking at the sort of requests I was getting in the www logs and patterns between them and then wrote something that eventually got them all.
but yeah wp themselves have some "unusual" views as to what is acceptable security-wise. i *think* they finally (in the last 12mo) changed it so that the json endpoints dont expose all the user details anymore but when i reported that along with a poc tool that scraped usernames and email addresses of users from a "standard" wp install, they replied "that's intended behaviour" 🤯🤦🏼♀️
hypothetically if one were looking to break into a wp site, a good first step would be to have a list of usernames and whether those are admin or not and the json endpoints gave you exactly that, plus email addresses in case you needed a target to socially engineer/phish further access 👌#goodtimes
Oct 22, 2026, 9:34 PM@nflux@gts.exile.social @mhoye@cosocial.ca i'm equal parts shocked and unsurprised that it's trivial to scrape that from WP, and that they dismissed it
wish we could have something better
Oct 22, 2026, 9:38 PM@amy @mhoye
check /wp-json/wp/v2/users/1
vary the last number to scan thru the users.
my "note to self" email about this is from 2018 and my test "canary" for this only stopped responding in the last 12mo (tho maybe they upgraded their security, idk and havent bothered to check any other sites).
it's trivial to disable access but shocking that it isnt by default.
Oct 22, 2026, 9:43 PM@nflux@gts.exile.social @mhoye@cosocial.ca doesn't seem to work on a random wordpress demo thing i found, it lists 1 of the users (the initial one) but returns an error for other users. not convinced this is fully patched on a vanilla instance. let me pull from docker and see
Oct 22, 2026, 10:17 PMOct 22, 2026, 10:21 PM@amy @mhoye you can do a similar trick on the author pages of the site to match userids to usernames (link to author usually on each blog post, if that isnt disabled).
i kept noticing that attackers were trying real usernames but our display names were always deliberately different and I was confused as to where they were getting them from so again went on a bit of a dig about this and built a few poc tools to try and recreate their results (so that I could then block them to infinity)
Oct 22, 2026, 10:23 PM@amy @mhoye *also the initial one is usually an admin, at which point they're one badly configured spf record (and/or missing dmarc) away from getting spoofed+phished, and both of those records are, again, public. you dont generally have to look very far to find a site with shoddy spf/dmarc either., though big mail providers recently *requiring* dmarc to be configured actually helped quite a lot there.
Oct 22, 2026, 10:38 PM@amy @mhoye also the venn diagram of PBN sites on expired+revived domains and badly configured wp sites is basically a circle.
*for everyone else: pbn sites are "personal blog network" sites which is an seo trick where you find an expired site like davestyreshop.com who were popular & well ranked but then dave retired/died/went bust & his domain expired but all the backlinks he accrued over his 20 years in business still exist. you use yandex & some other tools i forget the name of to find domains like that in the first place & also all the existing backlinks and then set up a new site with pages to match those old backlinks so they dont 404. you then scatter links thru that site to yourtyreshop.com (which you're actually trying to promote) & reap the benefit of Dave's 20 years of link building. repeat 3-5x for plenty of organic traffic (albeit relatively low quality, & imho it's better to just write good original content rather than resort to shitty tricks)
Oct 22, 2026, 11:03 PMOct 22, 2026, 11:07 PMOct 23, 2026, 12:32 AMOct 23, 2026, 12:36 AMOct 22, 2026, 11:34 PM@nflux@gts.exile.social @mhoye@cosocial.ca so i did a little bit of hackering. i've got a way to enumerate users based on their ID (which leaks not much more than you get publicly, if anything), though it does allow for easy automation. looks like they have patched some of those holes.
Oct 22, 2026, 11:37 PM@nflux@gts.exile.social @mhoye@cosocial.ca https://github.com/WordPress/WordPress/blob/master/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php#L504-L510 this is what stops you enumerating it normally, ie what i ran into on the demo instance
and this is what's stopping me from enumerating all the juicy fields from a user. you need "edit" permission to do that
https://github.com/WordPress/WordPress/blob/master/wp-includes/rest-api/endpoints/class-wp-rest-controller.php#L588-L596
i will possibly have another look tomorrow because this code does seem overly complex and potentially prone to error. i already found a way to request specific users through the api (with the only pre-req being that they've ever written a post, with my current findings)
Oct 23, 2026, 12:02 AM@nflux@gts.exile.social @mhoye@cosocial.ca i should go the fuck to sleep. not like i would be inclined to contribute patches to wp anyways, fun little nerd snipe though. there's probably something to this if someone really wants to
Oct 23, 2026, 12:12 AM@amy @mhoye well it's good that they've somewhat patched some of these things. the dismissive attitude i got when i reported it put me off pursuing it further, and to some extent my sites' survival depended on not being the easiest pickings, and their policy helped with that.
i guess if they patched it (eventually) perhaps my report *was* actually valid then hmm, whaddya know 🤔
am i allowed to be a bit smug about that, as a treat?
Oct 23, 2026, 12:19 AM@nflux@gts.exile.social @mhoye@cosocial.ca what's really interesting is i cannot see the patch in which they added these checks. the context flag "edit" has always existed since the feature was added
wonder if you had also some kind of auth bypass going on at the time lollll
https://github.com/WordPress/WordPress/blob/e4a7c0a397b07764999aae94f4bf1567ebf4a9d1/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php#L826
Oct 23, 2026, 12:45 AM@amy @mhoye i have no idea. i tested it on random sites periodically to which i had no access and it nearly always worked, both as a way of establishing "do these ppl im considering dealing with have their shit together" and also as a potential freebie to offer them by way of getting freelance work in a "did you realise all your stuff was exposed"-sorta way 🤷🏼♀️ (almost always no and no).
@amy @mhoye well, i'd guess the overwhelming majority of the web (like 95% maybe?) is exactly that: preconfigured shared hosting. most entities wont build binaries to run a simple website when all they need to do is upload some images and edit some text. and hosters wont let you run your own binaries for a reason. (of course; building something like nextcloud in php is plain evil – but thats another topic. hello performance? and yet: copy it to almost any server and got ur own cloud running.)
