6. Tools

Our Web Application Firewall (WAF) monitors the IP addresses and user agents attempting to access your site and filters out traffic that is known to be unsafe or that you have identified as unwanted.

The key distinction between our WAF and typical site security protocols is that a security plugin protects a site at the point of attack, whereas a WAF prevents unwanted traffic from ever reaching its intended target in the first place (learn more about how WAFs work).

Our WAF protects sites from attacks such as cross-site request forgeries, cross-site-scripting (XSS), file inclusions, and SQL injections.

Configuring your WAF

A WAF protects against vulnerabilities and filters out attacks and malicious traffic by requiring all traffic to pass a set of rules before it ever reaches your WordPress site. WPMU DEV has a custom set of WAF rules and allows you to add your own, as follows:

• IP Allowlist
• IP Blocklist
• User Agent Allowlist
• User Agent Blocklist
• URL Allowlist
• URL Blocklist
• Disable Rule IDs

Click On/Off in the Web Application Firewall row to enable/disable the feature.

Then click the toggle switch in the popup to access the configuration panel.

WPMU DEV maintains a set of rules that will identify and block known, unsafe traffic, but admins can allowlist or blocklist IP addresses and user agents as they see fit using this configuration panel.

IP Allowlist/Blocklist

The IP or Internet Protocol address is a unique number that is linked to all online activity for a given user. You can block or grant access to specific machines, locations or users with the IP Allowlist/Blocklist fields.

You can Allowlist or Blocklist an IP address by entering it into the fields provided or by entering an IP range in CIDR notation. This is done by specifying the number of bits used for the network portion of the address in the following format: start of IP address range/number of network bits. For example, entering the range from 192.168.100.0 to 192.168.103.255 should be written as 192.168.100.0/22 and 192.168.100.0 to 192.168.101.255 would be 192.168.100.0/23. More information on this can be found in this DigitalOcean article or on the Petri site.

Enter only one IP address or range per line, and click Save to save.

This makes it easy to block attacks quickly before they reach your server or allowlist your own IP or team member’s IP so they can bypass the WAF.

User Agent Allowlist/Blocklist

The user agent is the system information being used to access your site, including:

• The browser application name and version
• The host operating system and language

Often this information can be used to block a botnet that is originating from too many IPs to block but is using the same User Agent for its attack. You can view visitor User Agents in your access log.

Use the Allowlist field if you need to allow a good bot that doesn’t use specific IPs to bypass firewall rules. Remember, User Agents can easily be spoofed by bots, so allowlisting them should be done only when you can’t allowlist by IPs.

You can Allowlist or Blocklist a user agent by entering it into the fields provided. An example of a correctly formatted user agent to enter into the field is Mozilla/5.0 (Linux; Android 9; moto e(6s)) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.92 Mobile Safari/537.36. Enter only one agent per line, and click Save to save.

URL Allowlist/Blocklist

In the unlikely event that any site URLs get blocked, possibly due to embedded content, you can add them to the URL Allowlist as relative URLs.

You can also explicitly block any relative URL by adding it to the URL Blocklist.

Disabled Rule Ids

You can also disable specific firewall rule IDs that appear in the WAF log under the Logs tab (see below).

Remember, when activating, deactivating or editing rules in the WAF, click the Save button to save your changes.

WAF Logs

WAF Logs for a specific site can be found in Hosting under the Logs tab.

Logs can be used to see where attacks are coming from, what requests were blocked, what rules those requests triggered, and changes that can be made to minimize false alarms. For example, if you are performing a valid action on your site and get blocked, you can find information on why in the WAF log and perhaps allowlist the IP or disable a specific firewall rule ID. More information about the WAF Logs can be found under the Logs document.

You can convert your site into a Multisite network by clicking the On/Off button in the Multisite row to open the configuration popup.

If you are uncertain which Multisite installation– Subdirectory and Subdomain– is right for you, see our WordPress Multisite documentation for guidance.

When you’re ready, choose the Multisite installation you prefer and click Continue.

If you are absolutely certain you wish to continue, type CONVERT at the confirmation step. Then click Confirm and Convert to begin the conversion.

The time it takes to convert depends largely on the size of the site, but it could range from just a few seconds to several minutes. A success notification will appear in The Hub when the conversion is complete.

For more information about Multisite networks, see our Multisite documentation and check out our Ultimate Guide to Multisite on the blog.

If you have chosen to go with a subdomain multisite, you will need to either generate a free Wildcard SSL certificate in your Hub or provide a custom wildcard certificate. This will ensure that you can serve your domain over HTTPS, which we require. This is covered in detail in our wildcard certificates documentation.

If you change your mind after converting your site to multisite, you can restore the automatic backup that was made before the site was converted. You’ll see that backup labeled pre convert to multisite under the Backups tab of your site.

It is our policy to only provide support for the latest supported PHP versions. This is both to make sure our sites are secure, and to provide you with the fastest most performant hosting service we can!

Note that some third party plugins may occasionally be out of date and cause issues with the latest version of PHP. In that case you can look for updates, alternatives, or worst case, we do support downgrading your PHP version to older ones that still provide security patches.

To upgrade or downgrade your PHP version, click the current PHP version number.

A list of available supported PHP versions will be displayed in the modal. Choose the version you wish to install, and click Apply.

Currently we default all newly-created sites to the latest release of PHP 8.0. However, the ionCube loader is not yet supported by PHP 8.0 or 8.1, so sites dependent on this extension should not update to either of those versions. If you choose one of those versions, a notice will pop up to remind you to downgrade to version 7.4 if your site requires the ionCube loader.

WPMU DEV gives you access to easily edit and manage your Database from the phpMyAdmin database manager.

From the Tools tab, click the Manage Database link to open phpMyAdmin.

phpMyAdmin includes tools for managing and viewing databases:

• SQL
• Status info
• Export
• Import
• Settings
• Variables
• Charset
• Engines
• Plugins

WPMU DEV also gives you access to easily edit and manage your website files using a file manager interface in case you don’t want to mess around with SFTP.

From the Tools tab, click the Manage Files link to open the File Manager in a new tab.

The left panel allows you to navigate through files and logs from both the production server and the staging server.

The main toolbar at the top of the page offers features such as adding new folders and files, as well as uploading new documents.

If a tool is grayed out, it is unavailable for the selected location or document. To interact with folders and files without using the toolbar, right click on the location and a pop-up menu will appear. The pop-up menu includes features that are offered on the toolbar like open, download, and preview.

We leverage Object Cache at the database level, and this is enabled by default on all sites we host.

Object Cache improves performance by minimizing server load related to queries that are frequently called by WordPress, plugins, and themes. Because of this, you may need to clear Object Cache from your Hosting Hub after using a plugin that interacts directly with the database in ways outside of normal WordPress guidelines or if you make changes directly in your database using phpMyAdmin.

The object cache should only be flushed if absolutely necessary. It is usually not needed except after making direct database edits or during development. If you aren’t sure, contact support, and we’ll help you out.

To clear cache, click Clear in the Object Cache row.

A “Are you sure?” pop-up will verify you would like to clear your cache. Click Continue to flush object cache.

Note that the Object Cache is not enabled on staging sites.

This is page caching at the server level using FastCGI. Much faster than any PHP plugin, Static Server Cache greatly speeds up your site and allows for an average of 10 times more concurrent visitors.

Static Server Cache can be toggled On or Off by clicking the button to the right.

Clicking the On/Off toggle will pop open a modal window with additional options that you can configure. Your configuration here will be saved even if you temporarily disable the cache for any reason.

• Enable / Disable Static Server Cache – Toggle the cache on or off while keeping other options saved.
• Allow Caching Query String (Params) – Enter any query strings (e.g., ref, utm_source, utm_medium, utm_campaign, etc), one per line, that you want to be cached.
• Exclude Urls From Caching – Enter any site URLs or URL strings that you don’t want cached. E.g., if you add /blog it will also exclude /blog/samplepost or parentpage/blog/ from the cache. See also Static server cache exclusions on a multisite network.
• Cache Lifetime – Select the expiry time for the cache. Cache will regenerate automatically each time it clears.

When it’s enabled, simply click the Clear button if you need to clear the Static Server Cache, then click the Continue button in the modal to confirm. Note that this cache also clears itself automatically every hour.

Static server cache exclusions on a multisite network

On a subdirectory multisite installation, if you have more than one subsite where each site has a page with the same slug (e.g., about), and you only want to exclude the about page on a specific subsite, you need to include the site directory in the URL (e.g., site1/about/). Otherwise, if you add /about only, all the pages with the slug about on all subsites won’t get cached.

On a subdomain multisite installation, you can’t exclude a specific page that shares the same slug on another subsite in the same network as you can only exclude relative URLs from being cached.

Compatibility

Our Static Server Cache is fully integrated with our Hummingbird performance plugin, meaning that any action or process in Hummingbird that triggers the clearing of page cache will also clear the Static Server Cache.

So if you have Page Caching enabled in Hummingbird, and click a Clear Cache button in the plugin, Static Server Cache will clear as well. Or if you have options like “Clear cache on interval” or “Clear full cache when post/page is updated” enabled in Hummingbird, Static Server Cache will respect those settings too.

WooCommerce is supported by default, meaning that any dynamic process in Woo is not cached. So if a user adds items to their cart, etc, that would not be cached by the Static Server Cache, so no worries there.

What does it cache exactly?

The following should give you a good idea about what does and does not get cached when Static Server Cache is enabled.

• GET/HEAD requests are cached (that’s your content; meaning all your posts, pages, etc.).
• POST requests are skipped (for example, forms or any other frontend submission).
• Query strings are skipped.
• wp-admin, xmlrpc, wp-*.php, feed, index.php, sitemap URIs are skipped.
• Cache is skipped if these cookies are found: comment_author, wordpress_, wp-postpass, wordpress_no_cache, wordpress_logged_in, woocommerce_items_in_cart.
• Cache is skipped if these WooCommerce URIs are found: /store, /cart, /my-account, /checkout, /addons.
• The max size of any item is 1Gb.

Are any query strings cached by default?

Newly created sites will have the following query strings cached by default. Note that no query strings are cached by default on existing sites, so you can add any that you may need according to your site’s current configuration.

ref
utm_source
utm_medium
utm_campaign
utm_term
utm_content
utm_expid
fbclid
fb_action_ids
fb_action_types
fb_source
mc_cid
mc_eid
gclid
dclid
_ga
campaignid
adgroupid
_ke
cn-reloaded
age-verified
ao_noptimize
usqp
mkt_tok
epik
ck_subscriber_id

How to see if it’s working

To check any page to see if it’s being cached by our Static Server Cache, pop open your browser’s developer tools, and click on the Network tab. Then reload your page.

Have a look at the Response Headers for the main document type of your page, and look for x-cache where you’ll see the following possible values.

• x-cache: BYPASS – Cache is bypassed for any reason (URL parameter, cookie, WooCommerce, logged in etc.).
• x-cache: MISS – It will be cached on next page load.
• x-cache: HIT – Cache is served.

Note that the Static Server Cache is not enabled on staging sites.

The wp-config.php file is located in the root of your WordPress file directory and contains your website’s base configuration details, such as database-connection information. If you migrated a site from another host, this information might need to be reset.

Click Reset in the WP-Config row.

Then click the Confirm Reset button to reset the wp-config.php file. This will reset the file back to the default state, and anything you may have added or changed in it will be lost.

Click the Close button to exit without resetting the file.

Use this option to migrate a 3rd-party hosted site into your existing WPMU DEV hosted site.

Sites can be migrated to WPMU DEV hosting using our migration tool or by requesting a manual migration by our hosting support team.

We recommend using the migration tool because it simplifies and accelerates the process and automatically resolves issues that occasionally interfere with a smooth migration.

All sites hosted by WPMU DEV have measures enabled by default at the server level to help prevent bruteforce attacks. This is to help ensure your site’s server never goes down due to a bot attack on the most commonly targeted WordPress URIs: /wp-login.php & /xmlrpc.php

You can disable this protection if you wish, or keep it enabled and add specific IP addresses or ranges (in CIDR notation) to exempt them from this protection. Click the On link to the right of the feature to open the options modal.

The /wp-login.php and /xmlrpc.php URIs are continuously monitored on our hosting, and if either of them receives more than 1 request every 2 seconds (30 requests/min) from a single IP address, rate limiting will be applied automatically to block access to any user with that IP, and a 429 error page will be displayed to that user.

This will throttle the connections a bit and help avoid having the server instantly go down due to an attack. If the connection is throttled 30 times within the last 30 minutes, then the attacking IP will be banned for 1 hour to help even more.

Any such 429 error will be logged by your server and can be viewed in the Access Logs in your Hub.

You can customize and brand the Error 429 page if you wish, just like any other default server error page, by following the directions in our Customizing Error Pages documentation.

Note that only the URIs noted above are monitored, and rate-limited if attacked. For example, if you have modified your wp-login.php slug using the Mask Login feature in Defender, and that custom slug is discovered and attacked by a malicious bot, your custom login would not be protected by these measures. We, therefore, recommend that any such custom login not be too obvious; don’t make it easy for bad actors to guess.

Also note that, while these measures can help mitigate the effects of DoS/DDoS attacks, they should not be considered as full protection for such attacks. You may want to consider using the robust protection options offered by CloudFlare for that.

This option enables you to easily integrate the performance monitoring features available from New Relic so you can view real-time data to help you when debugging issues on your site.

Begin by logging into your account at New Relic, or create a free account there now if you don’t already have one.

The only thing you need from your New Relic account for this integration is your License Key, which you’ll find here. If that link doesn’t work for you, click the API Keys option in your New Relic account profile menu to get to the correct page.

On the API Keys page in your New Relic account, click the three-dot icon at the far right of the License Key row you’ll see there, and select the Copy Key option to copy your key to your clipboard.

Now, back on the Tools screen of your site in your Hub, click the Off link next to New Relic Monitoring. That will pop open a modal window where you’ll be prompted to enter the License Key you just copied.

Then enter any name you like in the App Name field. This is the name for the app that will be automatically created in your New Relic account once you enable this integration.

Once both your License Key and App Name have been entered, enable the integration by clicking the Enable / Disable New Relic toggle at the top of the modal. Then click Save at the bottom.

To disable New Relic Monitoring on your site, simply click the Enable / Disable New Relic toggle again. Your license key will still be saved there if you simply disable the tool. However, you can delete that data before saving if you wish.

To view any site performance data recorded during any time period this monitoring feature was active, first go to the Home screen in your New Relic account by clicking the New Relic logo at the top left. Then click the APM link in the main menu, and click on the name of the app you entered earlier in your Hub.

You’ll find tons of useful data displayed that you can filter for any time or date range you need. You can even backtrack several months to view any data that was recorded during time periods this integration was active for your site.

Some of the most useful data can be found by clicking on the WordPress Hooks and WordPress Plugins and Themes options in the left-hand menu on that screen.

The data on those screens will help you glean valuable insight into the most sluggish processes, plugins & themes on your site.

There are way too many additional settings and configuration options at New Relic to get into here, but you’ll find they have useful and extensive documentation here that you can explore to familiarize yourself with how things work there.

Remember to disable New Relic Monitoring once you’re finished debugging things on your site.

This option enables you to easily integrate the performance profiling features available from Blackfire and get valuable data to help you when debugging issues on your site.

Begin by logging into your account at Blackfire or create an account there now if you don’t already have one.

Once logged-in to your Blackfire account, you’ll be prompted to create an Organization under which your site profiles will be logged. This can be anything you like really, as long as it’s recognizable to you.

Once you’ve created your organization, click the User Credentials option in your Blackfire account profile menu at th bottom-left.

On the User Credentials page, scroll down to the bottom where you’ll see a section titled My Server Credentials. Copy both the Server ID and Server Token to your clipboard or a plain text file.

Now, back on the Tools screen of your site in your Hub, click the Off link next to Blackfire Profiling. That will pop open a modal window where you’ll be prompted to enter the Server ID and Server Token you just copied.

Once both your Server ID and Server Token have been entered, enable the integration by clicking the Enable / Disable Blackfire toggle at the top of the modal. Then click Save at the bottom.

To disable Blackfire Profiler on your site, simply click the Enable / Disable Blackfire toggle again. Your server ID and token will still be saved there if you simply disable the tool. However, you can delete that data before saving if you wish.

Now that Blackfire is enabled for your site, you need to install one of their browser extensions so the profiler can run. Select the extension you want according to the browser you’re using:

• Firefox
• Chrome

Once you have the extension installed in your preferred browser, click the Blackfire icon in your browser toolbar to launch the profiler. Then click the big red Profile! button.

The tool will pop open as a bar pinned to the top of your browser, and begin running a profile of your site. You can give the profile a distinct Name while it’s running, or after it has completed, so you can find it easily in your Blackfire dashboard afterwards.

Once the profiler has finished, that top bar will populate with a summary overview of several useful metrics to help you diagnose possible issues with your site.

Click any of those metrics, or any other button in that bar, to open the corresponding page in your Blackfire account.

In your Blackfire account, your site profile will be presented in a detailed interactive view where you can really drill into any specific metric you need to pinpoint trouble areas on your site.

All your saved profiles can be accessed and viewed from the My Profiles page in your Blackfire account.

There are way too many additional settings and options at Blackfire to get into here, but you’ll find they have useful and extensive documentation here that you can explore to familiarize yourself with how things work there.

Remember to disable Blackfire Profiling once you’re finished debugging things on your site.

This option enables you to suspend access to a WPMU DEV hosted site for any reason you deem necessary. For example, you can temporarily suspend a client’s site if they don’t pay you for services you’ve provided.

Click On/Off in the Suspend Site row to enable/disable the feature. Note that you can suspend or unsuspend a site from the Site Options menu as well.

When suspending or unsuspending a site, you’ll be prompted to confirm the action.

Once enabled, a Suspended tag would appear next to the site in your My Sites list, and at the top of all screens when navigating that site’s features in your Hub.

Note that this tag is visible to you, as well as your team members and the client attached to the site (if any) when they’re logged into the Hub.

Any users trying to access the site would see a This site has been suspended message, and a 503 Service Unavailable error would be returned for all browser requests.

You can customize the error screen to better suit your business and brand by creating and customizing a suspended.html file in the site root. See Customizing Error Pages for details.

Additional Notes

• This option is only accessible by you as the Hub owner. Team members and clients do not see this feature.
• Suspending a site does not affect billing for that site. You would still be billed for hosting costs even if the site is suspended.
• Once a site has been suspended, the staging site (if one exists) would also be suspended, even if the staging site is created after the feature is enabled.
• Restoring a backup on a suspended site will work just fine, but the site will still be suspended.
• Uptime or any 3rd-party monitoring tool will see the site as being down.
• Email accounts or forwarding addresses for a suspended site will continue to work.
• Backups, including hourly backups if that is enabled, will also continue to function normally for a suspended site.
• Suspending a site does not affect access to any Hub features. So if you do suspend a client site, you might want to also consider assigning that client a different Client Role with more restricted access to Hub features. For example, the default View All & Access Billing role, or a custom role with no access to SFTP/SSH, Backups & Files/Database managers, would help prevent a non-paying client from grabbing the files and a database dump to move their site away from you.

Use this option if you ever need to revert your live site to a fresh WordPress installation. This process will also pre-install SmartCrawl Pro, Forminator Pro, Hummingbird Pro, Smush Pro, and Defender Pro plugins for you.

Note that the Reset option does not affect your staging site if you have one set up; there is a separate option for that under the Staging tab.

Click Reset and, if you are absolutely certain you wish to continue, type RESET at the confirmation step. Then click Confirm and Reset to confirm the action.

This reset will delete all files (including non-WordPress files) in the Production directory of your live site before the fresh re-install of WordPress. However, a backup of your live site will be created before the reset, in case you change your mind afterwards and want to restore the site to how it was.

Once you click the Continue button, you’ll be prompted to create a new WordPress administrator account for the fresh install. You can use the same email, username and password as you had for your admin user before, or create a brand-new admin user.

Click the Continue button and you’ll then see a screen indicating the reset is underway. Depending on the size of the site, it can take several minutes for this to complete.

When the reset process is complete, visit your site and you’ll see a brand-new default install of WordPress there for you to build on.

Resetting Multisite

The process for resetting a multisite is exactly the same as for a single site except for one important detail: when you reset a live multisite, it defaults back to a fresh single site install.

This means that if you intend to then push your existing staging multisite to live, you’ll need to first convert the new single site to a multisite. Then you can push your staging multisite to the new fresh live multisite. If you don’t do that, the system won’t be able to update the domain name where it needs to, and you’ll get a database connection error.

Restoring the Site

If you made a mistake or changed your mind after resetting WordPress on your live site, you can restore the automatic backup that was made before the site was reset. You’ll see that backup labeled before wp reset production under the Backups tab of your site.