wordpress – Ryan Schulze

Statically served wordpress content

January 18, 2022April 1, 2022Ryanstatic content, wordpress

I’m currently still evaluating hugo and jekyll, themes and plugins, as an alternative to the current WordPress site. Until I decide what route to eventually go with, I had a look at WordPress plugins to generate static versions of a site.

Simply Static looked fine and I gave it a spin, it can easily crawl through the site and you can provide additional file/urls/directories to add to the static version (as well as exemptions).

The static version of the website is created regularly and stored locally, so I added a few ansible tasks to set up a periodic rsync of the files to my webserver that serves static content.

I have a HAProxy load balancer in front of my webservers that I have configured to serve the static version of the website first, and fall back to the wordpress server as a backup (that also gives me a nice redundancy, so I can update and reboot servers without causing a downtime).
HAProxy is also configured to always send certain requests (admin interface, search) to the WordPress server since they require PHP. This all happens transparently for the user.

I’m not going to bore with the details since it was all pretty standard stuff. It’s nothing fancy, but it looks reliable and does what it should.

I have this blog entry scheduled to go live in a few days, so we’ll see if all the automatisms work and the static version of the page generated and synced to the webserver.

What plugins is that website running?

May 18, 2011September 27, 2014Ryancms-explorer, drupal, nikito, security, wordpress

While having a look at nikito yesterday I stumbled accross cms-explorer. It’s an interesting little program that checks the themes/modules/plugins installed in common CMS systems (Drupal, WordPress, Joomla! and Mambo), with automatic exploration for Drupal and WordPress. It also has some nice bonus features like providing a list of known issues for plugins found by accessing the OSVDB.org database.

Example output:

Plugin Installed:		wp-content/plugins/hello.php
	URL			http://www.dopefish.de/wp-content/plugins/hello.php
	SVN			http://svn.wp-plugins.org/wp-content/plugins/hello.phptrunk/
	http://osvdb.org/22654	WordPress wp-content/plugins/hello.php Direct Request Path Disclosure
	http://osvdb.org/62684	WordPress wp-content/plugins/hello.php add_action() Function Path Disclosure
Plugin Installed:		wp-content/plugins/devformatter/
	URL			http://www.dopefish.de/wp-content/plugins/devformatter/
	SVN			http://svn.wp-plugins.org/wp-content/plugins/devformatter/trunk/

Plugin Installed: wp-content/plugins/hello.php

URL http://www.dopefish.de/wp-content/plugins/hello.php

SVN http://svn.wp-plugins.org/wp-content/plugins/hello.phptrunk/

http://osvdb.org/22654 WordPress wp-content/plugins/hello.php Direct Request Path Disclosure

http://osvdb.org/62684 WordPress wp-content/plugins/hello.php add_action() Function Path Disclosure

Plugin Installed: wp-content/plugins/devformatter/

URL http://www.dopefish.de/wp-content/plugins/devformatter/

SVN http://svn.wp-plugins.org/wp-content/plugins/devformatter/trunk/

Running it against my own webspace revealed a possible SQL injection I was unaware of. *) Fixed that, will probably replace that plugin completely this week, anything that has stuff so obviously bad in it is generally not all too sane.

*) I normally look at plugins before I install them, must have missed this one. @ PHP programmers: anyone who passes on the content of a $_REQUEST directly to a SQL query without any sanity checking deserves to be flogged with his own code.