admin-ajax.php如何工作？

admin-ajax.php是 WordPress AJAX API 的一部分,是的,它确实处理来自后端和前端的请求.尽量不要担心它在wp-admin中的事实.我认为这也是一个奇怪的地方,但它本身并不是安全问题.我不知道这与"枚举管理员"有什么关系.

admin-ajax.php is part of the WordPress AJAX API, and yes, it does handle requests from both backend and front. Try not to worry about the fact that it is in wp-admin. I think that is a strange place for it too, but it is not a security problem in itself. How this relates to "enumerate the admins", I don't know.

对于未经身份验证和不受信任的用户,您需要对VPN/防火墙/Apache .htaccess设置两个特定的例外,即:

• example.com/wp-admin/admin-post.php
• example.com/wp-admin/admin-ajax.php

这些是内部WP以及各种插件所使用的两个自动魔术终结点.

以下是admin-post.php的功能的一些解释:

• https://www.sitepoint.com/handling-post-requests-the-wordpress-way/

admin-ajax.php的工作方式非常相似,有用的解释是此处.

For unauthenticated and untrusted users, you'll want to make two specific exceptions to your VPN / Firewall / Apache .htaccess, which are:

• example.com/wp-admin/admin-post.php
• example.com/wp-admin/admin-ajax.php

These are two auto-magic endpoints used by a lot by both internal WP and also various plugins.

Here's some explanation of what admin-post.php does:

• https://www.sitepoint.com/handling-post-requests-the-wordpress-way/

admin-ajax.php works in a very similar way, and a helpful explanation is here.

如果您想限制对WP后端的访问(例如: wp-admin ),只需在 wp-admin <上使用 .htaccess 规则目录.

请查看本文以了解总体概述:使用.htaccess密码保护目录

也请针对您的特定情况查看此主题:密码保护/wp-admin/

If you want to limit access to the WP backend (ex: wp-admin), just use a .htaccess rule on the wp-admin directory.

Check out this article for a general overview: Password Protect a Directory Using .htaccess

Also check out this topic for your specific case: Password protecting /wp-admin/

我个人认为这是一个可怕的主意.大约两个月前,我们的开发总监坚持我们这样做,这与开发团队的建议背道而驰.对于我们来说,这是一场真正的噩梦和令人难以置信的痛苦,不仅会杀死ajax,还会给我们带来许多管理问题.

我们有40名正式员工和4位开发人员试图偶尔使用vpn,而且口吃不全,而且所有用户现在都需要两套密码,一套用于wp,一套用于vpn,而不仅仅是个人使用的共享密码.是的,我的意思是您还将如何进行安全审核.记住一个安全密码就足够了,更不用说两个了.

增加了一个问题,很多人不知道如何使用vpn,通常这只会引起更多问题.

最终,这是一个糟糕的主意,通常由不了解或不了解WordPress的管理人员或更高级别的人提出.他们从可怕的角度看待它,因为它是开源的,所以它也必须是一个安全问题,里面充斥着容易被窃听的漏洞等等.

WordPress是安全的,将wp-admin留在vpn后面不仅使人恐惧,它给团队中的每个成员带来了噩梦

为什么对WordPress而言管理类型不信任,他们似乎忘记了主要站点使用WordPress而不使用vpn,例如以mashable为例.

所以回顾一下:

Ajax无法在vpn后面运行.

出于上述原因,vpn是一个可怕的想法

WordPress是安全的,如果您保持它和插件为最新状态,它将保持不变.

听您的开发人员,您将为其专业知识付费.我可以向您保证,没有任何事情会破坏工作关系,例如不将您的信任放在个人身上,而必须检查他们的知识.

如果您确实要使用vpn,请确保购买足够的用户许可证.

My personal opinion is that this is a god awful idea. About two months ago our director of development insisted we do just this, much against the advice of the Dev team. It's a genuine nightmare and an incredible pain for us, not only does it kill ajax all together it presents so many administration issues for us.

We have 40 regular staff and 4 devs trying to use the vpn at times and it just stutters, along with that all users now require two sets of passwords one for wp and one for vpn and that's not just a shared password it's individual ones, I mean how else would you do a security audit. It's hard enough to remember one secure password, let alone two.

Add to the issue that a lot of people do not know how to use a vpn and often that just causes more issues.

Ultimately it's a terrible idea and it's often put forward by management or higher who do not know or understand WordPress. They see it in a terrible light, that because it's open source it must also be a security issue, filled with easily tapped exploits and so on.... its getting old.

WordPress is secure and sticking wp-admin behind a vpn is not only fear mongering it presents a nightmare for every member of the team

Why is it that management types have no trust when it comes to WordPress, they seem to forget major sites use WordPress and don't use vpns, look at mashable for example.

So to recap:

Ajax won't work behind a vpn.

Vpn is a terrible idea for reasons mentioned above

WordPress is secure and will remain so if you keep it and plugins up to date.

Listen to your Dev, you pay them for their expertise. I can promise you, that nothing undermines a working relationship like not putting your trust into an individual and having to check up on their knowledge.

If you do go with vpn, be sure to buy enough user licenses.