Virtual Host Security

Description

Specifies the action to be taken when the specified Allowed Login Attempts limit is reached within 5 minutes.

Throttle gradually slows down the speed of the server response, Drop severs the connection without any reply, Deny returns a 403 response, and CAPTCHA or Drop redirects to a CAPTCHA if reCAPTCHA Protection is enabled and drops otherwise.

WP Login CAPTCHA Full Protection can also be selected. This setting will redirect to a CAPTCHA if ReCAPTCHA Protection is enabled regardless of Allowed Login Attempts limit and falls back to use Throttle otherwise.

Default values:
Server level: Throttle
VH level: Inherit Server level setting. If Server level is set to Disable, Throttle will be used.

Syntax

Select from drop down list

Tips

Trusted IPs or sub-networks are not affected.
This can be set at the Server level and overwritten at the Virtual Host level. If not overridden at the Virtual Host level, this setting can also be overridden in a user's docroot .htaccess file using Apache configuration directive WordPressProtect with value 0 (disabled), 1 (use server level setting), throttle, deny, or drop.

Description

Specifies the maximum number of wp-login.php and xmlrpc.php POST attempts allowed by an IP within 5 minutes before the action specified in Protection Mode is taken.

This limit is handled using a quota system where remaining attempts = limit. Each POST attempt will decrease the number of remaining attempts by 1, with the number of remaining attempts increasing back to the set limit over time. An IP will be throttled once the number of remaining attempts for that IP falls to 1/2 the set limit, throttling more as the remaining attempts drops further below the 1/2 mark. When remaining attempts reaches 0, the specified action is taken toward the IP.

In addition to this, if Enable reCAPTCHA is also enabled, an additional per worker protection will be added. If wp-login.php and xmlrpc.php are visited by the same worker at a rate of 4x the set limit in a 30 second time frame, those URLs will be put into reCAPTCHA mode until the number of visits to these files decreases.

Resetting the server will clear blocked IPs.

Default values:
Server-level: 10
VH-Level: Inherit Server level setting

Syntax

Valid Range: 3 - 1000.

Example

Tips

Trusted IPs or sub-networks are not affected.

This can be set at the Server level and overwritten at the Virtual Host level. If not overridden at the Virtual Host level, this setting can also be overridden in a user's docroot .htaccess file using Apache configuration directive WordPressProtect with integer value between 3 and 1000.

Description

Automatically set Jetpack IPs as VHost trusted. Jetpack IPs list is updated dynamically on a daily basis.

Default values:
Server level: No
VH level: Inherit Server level setting.

Syntax

Select from drop down list

Description

Sets a limit for the total output bandwidth in KB/s for this virtual host. Once this limit is reached throttling will occur.

Description

Specifies the maximum number of requests for dynamically generated content coming from a single IP address that can be processed in each second, regardless of the number of connections established. When this limit is reached, all future requests for dynamic content are tar-pitted until the next second. The per client request limit can be set at the server or virtual host level where virtual host level settings override server level settings.

Syntax

Integer number

Tips

Trusted IPs or sub-networks are not effected

Description

The maximum allowed outgoing throughput to a single IP address, regardless of the number of connections established. The real bandwidth may end up being slightly higher than this setting for efficiency reasons. Bandwidth is allocated in 4KB units. Set to 0 to disable throttling. Per-client bandwidth limits (bytes/sec) can be set at the server or virtual host level where virtual host level settings override server level settings.

Syntax

Integer number

Tips

Set the bandwidth in 8KB units for better performance.

Trusted IPs or sub-networks are not affected.

See Also

Inbound Bandwidth (bytes/sec)

Description

The maximum allowed incoming throughput from a single IP address, regardless of the number of connections established. The real bandwidth may end up being slightly higher than this setting for efficiency reasons. Bandwidth is allocated in 1KB units. Set to 0 to disable throttling. Per-client bandwidth limits (bytes/sec) can be set at the server or virtual host level where virtual host level settings override server level settings.

Syntax

Integer number

Tips

Trusted IPs or sub-networks are not affected.

See Also

Outbound Bandwidth (bytes/sec)

Description

Overrides Server level setting Connection Hard Limit with a lower value. Setting this to a value higher than Connection Hard Limit will have no effect.

Once this limit is reached, a 403 response will be returned.

Default value: Not Set

Syntax

Integer number

Description

reCAPTCHA Protection is a service provided as a way to mitigate heavy server load. reCAPTCHA Protection will activate after one of the below situations is hit. Once active, all requests by NON TRUSTED(as configured) clients will be redirected to a reCAPTCHA validation page. After validation, the client will be redirected to their desired page.

The following situations will activate reCAPTCHA Protection:
1. The server or vhost concurrent requests count passes the configured connection limit.
2. Anti-DDoS is enabled and a client is hitting a url in a suspicious manner. The client will redirect to reCAPTCHA first instead of getting denied when triggered.
3. WordPress Brute Force Attack Protection is enabled and action is set to 'CAPTCHA or Drop’. When a brute force attack is detected, the client will redirect to reCAPTCHA first. After max tries is reached, the connection will be dropped, as per the ‘drop’ option.
4. WordPress Brute Force Attack Protection is enabled and action is set to 'WP Login CAPTCHA Full Protection'. The client will always redirect to reCAPTCHA first.
5. A new rewrite rule environment is provided to activate reCAPTCHA via RewriteRules. 'verifycaptcha' can be set to redirect clients to reCAPTCHA. A special value ': deny' can be set to deny the client if it failed too many times. For example, [E=verifycaptcha] will always redirect to reCAPTCHA until verified. [E=verifycaptcha: deny] will redirect to reCAPTCHA until Max Tries is hit, after which the client will be denied.

Description

Enable the reCAPTCHA Protection feature at the current level. This setting must be set to Yes at the Server level before the reCAPTCHA Protection feature can be used.

Default values:
Server-level: Yes
VH-Level: Inherit Server level setting

Syntax

Select from radio box

Description

The site key is the public key provided by Google via its reCAPTCHA service. A default Site Key will be used if not set.

Description

The secret key is the private key provided by Google via its reCAPTCHA service. A default Secret Key will be used if not set.

Description

Specify the reCAPTCHA type to use with the key pairs.
If a key pair has not been provided and this setting is set to Not Set, a default key pair of type Invisible will be used.

Checkbox will display a checkbox reCAPTCHA for the visitor to validate.

Invisible will attempt to validate the reCAPTCHA automatically and if successful, will redirect to the desired page.

hCaptcha can be used to support reCAPTCHA provider hCaptcha.

Default value is Invisible.

Syntax

Select from drop down list

Description

Max Tries specifies the maximum number of reCAPTCHA attempts permitted before denying the visitor.

Default value is 3.

Syntax

Integer number

Description

Sets the expire time of a successful reCAPTCHA submission, after which reCAPTCHA protection will re-trigger for that visitor.

Default value: 86,400 (1 day).

Syntax

Integer value between 30 and 31,536,000 (1 year).

Description

The number of concurrent requests needed to activate reCAPTCHA. reCAPTCHA will be used until concurrent requests drop below this number.

Default value is 15000.

Syntax

Integer number

Description

Specifies what sub networks and/or IP addresses can access the server. At the server level, this setting will affect all virtual hosts. You can also set up access control unique to each virtual host at the virtual host level. Virtual host level settings will NOT override server level settings.

Blocking/Allowing an IP is determined by the combination of the allowed list and the denied list. If you want to block only certain IPs or sub-networks, put * or ALL in the Allowed List and list the blocked IPs or sub-networks in the Denied List. If you want to allow only certain IPs or sub-networks, put * or ALL in the Denied List and list the allowed IPs or sub-networks in the Allowed List. The setting of the smallest scope that fits for an IP will be used to determine access.

Server Level: Trusted IPs or sub-networks must be specified in the Allowed List by adding a trailing "T". Trusted IPs or sub-networks are not affected by connection/throttling limits. Only server level access control can set up trusted IPs/sub-networks.

Tips

Use this at the server level for general restrictions that apply to all virtual hosts.

Description

Specifies the list of IPs or sub-networks allowed. * or ALL are accepted.

Syntax

Comma delimited list of IP addresses or sub-networks. A trailing "T" can be used to indicate a trusted IP or sub-network, such as 192.168.1.*T.

Example

Tips

Trusted IPs or sub-networks set at the server level access control will be excluded from connection/throttling limits.

Description

Specifies the list of IPs or sub-networks disallowed.

Syntax

Comma delimited list of IP addresses or sub-networks. * or ALL are accepted.

Example

Description

Lists all authorization realms for this virtual host. Authorization realms are used to block unauthorized users from accessing protected web pages. A realm is a user directory containing usernames and passwords with optional group classifications. Authorization is performed at the context level. Because different contexts can share the same realm (user database), realms are defined separately from the contexts that use them. You can refer to a realm by these names in a contexts configuration.

Description

Specifies a unique name for the authorization realm.

Description

Specifies how user/group data is stored for an authorization realm. Currently, user/group data can be stored in flat files or on a LDAP server.

Syntax

Select from drop down list

Description

Specifies the location of the user database. For DB type Password File, it is the path to the flat file containing user/password definitions. You can edit this file through the WebAdmin console by clicking on the filename.

Each line of the user file contains a username followed by a colon, followed by a crypt() encrypted password, optionally followed by a colon and group names that user belongs to. Group names are delimitated by commas. If group information is specified in the user database, then the group database will not be checked.

Example:

john:HZ.U8kgjnMOHo:admin,user

ldap://localhost/ou=UserDB,dc=example,dc=com???(&(objectClass=*)(uid=$k))

Syntax

Path to user DB file or LDAP URL (RFC 2255).

Tips

It is recommended to store user password files outside of the document tree. If a user password file has to be placed inside document tree, simply name it with a leading ".ht" like .htuser to prevent it being served as a static file. LiteSpeed Web Server does not serve files prefixed with ".ht".

See Also

Group DB Location, Password Attribute, Member-of Attribute

Description

Specifies the name of the password attribute for a user record stored in an LDAP server. The default value is userPassword.

Syntax

string

Description

Specifies the name of the "Member-of" attribute for a user record stored in an LDAP server. The default value is memberOf. The "Member-of" attribute can be used to specify the group name that the user belongs to.

Syntax

string

Description

Specifies the maximum cache size of the user database. Recently accessed user authentication data will be cached in memory to provide maximum performance.

Syntax

Integer number

Tips

As a larger cache will consume more memory, a higher value may or may not provide better performance. Set it to an appropriate size according to your user database size and site usage.

Description

Specifies how often the backend user database will be checked for changes. Every entry in the cache has a timestamp. When cached data is older than the specified timeout, the backend database will be checked for changes. If there is no change, the timestamp will be reset to the current time, otherwise the new data will be loaded. Sevrer reload and graceful restart will clear the cache immediately.

Syntax

Integer number

Tips

If the backend database does not change very often, set a longer timeout for better performance.

Description

Specifies the location of the group database.

Group information can be set either in the user database or in this standalone group DB. For user authentication, the user DB will be checked first. If the user DB also contains group information, then the group DB will not be checked.

For the DB type Password File, the group DB location should be the path to the flat file containing group definitions. You can edit this file through the WebAdmin console by clicking on the filename.

Each line of a group file should contain a groupname followed by a colon, followed by space delimited group of usernames. Example:

testgroup: user1 user2 user3

ldap://localhost/ou=GroupDB,dc=example,dc=com???(&(objectClass=*)(cn=$k))

Syntax

Filename which can be an absolute path or a relative path to $SERVER_ROOT, $VH_ROOT.

Tips

It is recommended to store a group file outside the document tree. If it has to be placed inside document tree, simply name it with a leading ".ht" like .htgroup, to prevent the file being served as a static file. LiteSpeed Web Server does not serve files prefixed with ".ht".

See Also

User DB Location, Context Require (Authorized Users/Groups), Group Member Attribute

Description

Specifies the name of the "Member" attribute for a group record stored in an LDAP server. The default value is memberUid.

Syntax

string

Description

Specifies the maximum cache size of the group database.

Syntax

Integer number

Tips

As a larger cache will consume more memory, a higher value may or may not provide better performance. Set it to an appropriate size according to your user database size and site usage.

See Also

User DB Max Cache Size

Description

Specifies how often the backend group database will be checked for changes. For more detail please refer to User DB Cache Timeout (secs).

Syntax

Integer number

See Also

User DB Cache Timeout (secs)

Description

Specifies a DN used to bind to the server. If the LDAP server requires authentication, a bind DN and password must be specified. If not specified, anonymous bind will be used.

Syntax

string

See Also

LDAP Bind Password

Description

Specifies a password used to bind to the server. If the LDAP Server requires authentication, a bind DN and password must be specified.

Syntax

string

See Also

LDAP Bind DN

Description

Specifies whether to enable request content deep inspection. This feature is equivalent to Apache's mod_security, which can be used to detect and block requests with ill intention by matching them to known signatures.

Syntax

Select from radio box

Description

Specifies the level of detail of the Web Application Firewall engine's debug output. This value ranges from 0 - 9. 0 disables logging. 9 produces the most detailed log. The the server and virtual host's error log Log Level must be set to at least INFO for this option to take effect. This is useful when testing request filtering rules.

Syntax

Integer number

See Also

Server Log Level, Virtual Host Log Level

Description

Specifies the default actions that should be taken when a censoring rule is met. Default value is deny,log,status:403, which means to deny access with status code 403 and log the incident in the error log.

See Also

Rule Set Action

Description

Specifies whether to check the body of an HTTP POST request. Default is "No".

Syntax

Select from radio box

Description

Rules configured here only work for virtual hosts configured with a native LSWS configuration, not for virtual hosts using Apache httpd.conf.

Description

Give a group of censorship rules a name. For display only.

Syntax

String

Description

Specifies the actions that should be taken when a censoring rule in current ruleset is met. If not set, Default Action will be used.

Syntax

String. This action string uses the same syntax as Apache's mod_security SecDefaultAction directive .

Description

Specifies whether to enable this rule set. With this option, a rule set can be quickly turned on and off without adding or removing the rule set. Default is "Yes".

Syntax

Select from radio box

Description

Specifies a list of censorship rules.

Syntax

String. Syntax of censoring rules follows that of Apache's mod_security directives. "SecFilter", "SecFilterSelective", and "SecRule" can be used here. You can copy and paste security rules from an Apache configuration file.

For more details about rule syntax, please refer to the Mod Security documentation.

Tips

Rules configured here only work for vhosts configured in native LSWS configuration, not for vhosts from Apache httpd.conf.