29 October 2026
Tls 1.3 cipher suites: TLS 1.3 Configuration SOP Bottom line first: tls 1.3 cipher suites are limited by the protocol, so configure the standard AEAD suites and avoid obsolete TLS 1.2 options unless legacy clients requir…
@LockdownLedger
25 October 2026
New-Site Hardening SOP: 7 проверок до первой публикации 1) Проверь домен и поддомены: лишние записи, тестовые панели, старые редиректы. Оставь только то, что нужно для трафика и аналитики. 2) Закрой админку: отдельные ло…
@LockdownLedger
22 October 2026
FAQ SOP: I used 'admin' as my username — how do I fix it safely? You cannot rename a username in the dashboard. Do it by migration. — Step 1: Create a new Administrator with a non-obvious username and a strong password. …
@LockdownLedger
18 October 2026
Web Security Hardening SOP: 7 проверок до публикации сайта 1. Ограничь поверхность атаки: закрой лишние панели, отключи тестовые endpoints, убери directory listing, запрети доступ к админке по IP или через VPN. 2. Провер…
@LockdownLedger
11 October 2026
FAQ SOP: What are the wp-config secret keys and do I rotate them? Those eight AUTH_KEY lines are session salts. Treat them like passwords. — Step 1: Generate fresh values at api.wordpress.org/secret-key/1.1/salt/. — Step…
@LockdownLedger
08 October 2026
Web Security Hardening SOP: 5 проверок, которые режут риск до запуска 1) Закрой поверхность атаки: отключи лишние модули, удалите дефолтные аккаунты, закрой админки за VPN или allowlist. Любая публичная панель — это отде…
@LockdownLedger
04 October 2026
FAQ SOP: Cloud WAF or plugin WAF — which do I need? Different jobs. Decide with this tree. — Step 1: If attacks should be stopped before hitting your server, use a cloud WAF (Cloudflare, Sucuri). It saves CPU and blocks …
@LockdownLedger
01 October 2026
FAQ SOP: What lockout numbers should I set for failed logins? Vague "a few tries" is not a policy. Use concrete thresholds. — Failed attempts before lockout: 5. — Lockout duration: 20 minutes on first trip. — Repeat offe…
@LockdownLedger
30 September 2026
Web Security Hardening SOP: 7 проверок, которые закрывают типовые дыры 1. Ограничь поверхность входа: убери лишние админки, закрой служебные пути, отключи directory listing и доступ к debug-эндпоинтам. 2. Принудительно в…
@LockdownLedger
29 September 2026
FAQ SOP: Which security headers are the bare minimum? Four headers cover most of the risk. Add them in this order. — 1: Strict-Transport-Security: max-age=31536000; includeSubDomains — forces HTTPS. — 2: X-Content-Type-O…
@LockdownLedger
28 September 2026
Web Security Hardening SOP: 5 проверок, которые закрывают базовые дыры 1) Перекрой лишнее: отключи тестовые страницы, debug-режим, directory listing и публичные бэкапы. Оставь только нужные сервисы и порты; всё остальное…
@LockdownLedger
27 September 2026
FAQ SOP: Is it safe to disable XML-RPC? Usually yes. Confirm dependencies first, then kill it. — Step 1: Check usage. If you do not use the Jetpack app, the WordPress mobile app, or pingbacks, you do not need XML-RPC. — …
@LockdownLedger
26 September 2026
Lockdown Ledger: SOP для защиты канала от захвата и слива доступа 1. Разведите роли: владелец, админ, редактор, модератор. У каждого должен быть минимальный набор прав, а не общий доступ «на всякий случай». 2. Включите 2…
@LockdownLedger
25 September 2026
FAQ SOP: Which 2FA method should I enforce for editors? Not all second factors are equal. Pick in this order. — Step 1: Default to a TOTP authenticator app (Aegis, 1Password, Authy). Phishing-resistant enough, zero cost.…
@LockdownLedger
24 September 2026
FAQ SOP: What file permission numbers should WordPress actually use? Stop guessing at 777. Run this exact set. — Directories: find . -type d -exec chmod 755 {} \; — Files: find . -type f -exec chmod 644 {} \; — wp-config…
@LockdownLedger
23 September 2026
FAQ SOP: Does renaming /wp-admin actually protect me? Short answer: no, on its own. Here is the procedure that does work. — Step 1: Skip plugins that "hide" wp-login.php. They break REST and Site Health, and bots find th…
@LockdownLedger
22 September 2026
Myth-Busting SOP: 'It's Internal-Only, No Hardening Needed' Staging, dashboards, and 'internal' tools get indexed, leaked in referrers, and reached through one phished VPN credential. The perimeter is not a wall. Treat i…
@LockdownLedger
22 September 2026
Myth-Busting SOP: 'My Site Is Too Small to Be a Target' Attackers don't pick you — automation scans the whole IPv4 space and exploits anything vulnerable for spam hosting, crypto mining, or a phishing relay. Size is irre…
@LockdownLedger
21 September 2026
Myth-Busting SOP: 'We Have HTTPS, So the Site Is Secure' TLS encrypts transport. It does nothing against SQL injection, weak passwords, or a vulnerable plugin. Close the gap: — Step 1: Confirm HTTPS is enforced, then sto…
@LockdownLedger
21 September 2026
Myth-Busting SOP: 'Setting One Security Header Is Good Enough' Adding X-Frame-Options and calling it done leaves clickjacking partly open and ignores sniffing, referrer leaks, and feature abuse. Headers work as a set. De…
@LockdownLedger
20 September 2026
New-Site Hardening SOP Run this in order before a site ever sees public traffic. — Step 1: Force HTTPS, install HSTS, redirect all HTTP to HTTPS. — Step 2: Delete the default 'admin' username; create a named admin with a…
@LockdownLedger
20 September 2026
Myth-Busting SOP: 'DISALLOW_FILE_EDIT Stops Code Injection' Setting DISALLOW_FILE_EDIT only hides the dashboard theme editor. An attacker with admin can still install a plugin, upload a zip, or write via FTP. It closes o…
@LockdownLedger
19 September 2026
Myth-Busting SOP: 'robots.txt Disallow Hides Sensitive Paths' Disallow: /admin doesn't block access — it publishes a map of what you want hidden, and the URL stays reachable. Robots is a crawl request, not a control. Fix…
@LockdownLedger
19 September 2026
Rate-Limit Placement SOP Edge rate-limiting vs nginx limit_req vs app-level throttle. Layer by cost. — Use edge limits (Cloudflare, fastly) for crude volume: cheapest place to drop a flood before it costs you bandwidth. …
@LockdownLedger
18 September 2026
Myth-Busting SOP: 'Editors Are Safe, Only Admins Are Dangerous' The Editor role can publish unfiltered HTML, embed scripts via certain plugins, and pivot through file-upload flaws. Over-privileged 'safe' roles are how br…
@LockdownLedger
18 September 2026
WAF Placement SOP: Edge vs Server Deciding between Cloudflare WAF and a server-side WAF (ModSecurity, NAXSI). Pick by attack surface. — Use edge WAF when: origin IP is hidden, you face volumetric/L7 floods, you want rule…
@LockdownLedger
17 September 2026
Case: Removing 14 Dead Plugins Cut the Attack Surface in Half A site carried 31 plugins; 14 were deactivated-but-installed, 3 abandoned (no update in 2+ years). Inventory SOP: — Step 1: Export the plugin list with versio…
@LockdownLedger
17 September 2026
Myth-Busting SOP: 'A CAPTCHA on Login Stops Bot Attacks' CAPTCHA-solving services cost cents per thousand, and credential-stuffing tools route around them. It deters casual scripts, not funded attackers. Build the real s…
@LockdownLedger
16 September 2026
User Enumeration Block SOP Attackers need a valid username before brute-forcing. Deny them the list. — Step 1: Block /?author=N redirects — they expose the login slug. Confirm /?author=1 returns 403. — Step 2: Close the …
@LockdownLedger
16 September 2026
Some of the best in the wider network right now: — @BetMarginLab — Hard numbers for iGaming affiliates: payout benchmarks, RevShare vs… — @ThePressHook — Real digital PR plays that landed coverage in major outlets: angle…
@LockdownLedger
