@Darth_Vader, I am in total agreement with everything rarst said. In addition of WP can write to htaccess then any malicious code running in its context cn write as well, and you just don't want to be in that posisiton.

any suggestions?

This is something that should be handled at application level, or cache

as for 500. It means you have bugs in your code

err, maybe not 500 but invalid server requests

the rest are a grrrrr but every server has to be able to handle some amount of bots and dos

have to go look but I know for one it is 404

how do you know it is a bot?

I'm just looking for bad and large number its from a bad bot

the requests, hold Ill find one

My generic reply is that looking at the logs for such a thing is a waste of time. You can't prevent people from trying to access "bad" urls. Just a waste of time trying to handle it as there is always some bot that will try a new combination

url/blog/wp-login.php requested 4 times; url/wordpress/wp-login.php requested 3 times; url/wp-content/plugins/user-role-editor/css/ure-admin.css all from the same IP along with 40 other similiar requests within a minute.

4 times in what time frame?

40 requests within a min

all of them looking for plugins

and how often does it happen?

url/wp-content/plugins/form-lightbox/admin/css/style.css; url/wp-content/plugins/profile-builder/assets/css/rtl.css; url/wp-content/plugins/peepso-core/assets/css/style.css are a few others

about once a week I'd say. user agent is always undefined

well, accessing css files should not even register on your server CPU usage

I dont use any of those plugins

@MarkKaplun agreed but wouldnt you classify that as a bad bot?

not worth worrying about. Maybe someone intrested in finding out which plugins you use. There are several services that will do such a thing probably exactly in this way

also have one for wp-misc.php, what is wp-misc.php?

several php file requests

this is the internet.... hard to define what is "bad"

after so many I block the IP =/

@MarkKaplun everything bad, till validated, lol... hostile environment.

the internet is an hostile enviroment all the time

The hard thing is to put the line from which point you actually start to care. What passes from background noice to something worth handling

so these are some PHP files: CHANGELOG.php, wp-checking.php, configbak.php, modx.php, xmlrppc.php, wp-config-sample.php, wp-content/plugins/500.php, wp-content/plugins/wpfoot.php, mko.php, modules/modules/modules.php. Would these be something to worry about?

blocking the IP works only against the good guys. Bad guys control many computers and can alternate IPs easily

so like block IP after so many bad requests with X timeframe then remove from htaccess

for php file the answer is simple. You should block access to php on the wp-content and wp-includes directories

that is just a "good thing to do" regardless of the bot problem

that's with a htacces file in each of those folders.

or the main one, doesn't matter how

for login and xmlrpc it is best to move the end points, but this depends on your users

any good reads on this?

if you have many that are used to specific location it might be hard

the theme my login plugin should let you just put a login form in any page you want. Then you can block login.php at the htaccess level

this is a plugin I wrote - shop.marksw.com/downloads/rename-login-endpoint-plugin that should just move the end point. feel free to look at the code, there isn;t that much of it.

thanks, I will note that

and even something for an XMLRPC shop.marksw.com/downloads/…

once the end point is changed and you know that your users know about it, anyone accessing those endpoint is by definition is a "bad guy"

this covers almost everything which is obviously bad actors, but you are still left with the URLs that might be proper url in the site.

ah, animating SVGs with jQuery.. long night ahead, lol

@toscho you coming to WordCamp Kyiv?

Today I learn that there is such as thing as addpost_meta() or add_term_meta() -- I was using update..._meta() all along, even if the meta data didn't exist.

Insanity.

that stuff matters if you have multiple values with same key, pretty meh API

Sorry can you please what you mean there? I'm very curious about this.

Is it the $unique parameter

Or right.

yeah, you can create more that one value with same key

update allows you to overwrite specific value among many

That's right.

$foo = get_post_meta(..); if (!$foo) {...}

but update won't let you implicitly add unique (I think, it's a mess)

Update overwrites it, yes.

I was reading this article and add_term_meta() came up and I was totally confused as to what the add_ part even was.

Good to know. Will never use it.

well, unless you need multiple values with same key that should work

Rarst are you hosting WP Kyiv?

@ChristineCooper yeah, I am co-organizing (for the first and only time)

Nice. What's your actual duties when co-organizing? How was the turnout last year?

@Rarst probably not

I'm a banana

@ChristineCooper I am dealing with speakers, that's the first WordCamp, we had non-WordCamp conferences past three years. last one was something like 300 people

but.. where $this is.. like my static helper class

see docs developer.wordpress.org/reference/functions/add_filter/…

could'n more specific... "Static class method"

-_-'I get discouraged sometimes

I thought it was just applied to the self class

thanks Rarst.

nope, it works by name too :) generally you can attach anything that is valid callable, even newer closures (which core itself wouldn't touch with a pole)

its just because wih static.. it call like: banana::get_banana(); instead of $banana->get_banana(); or $this->get_banana()

Is it possible to set the "front page" to a query string?

say what?

@Rarst, are you good with regex?

Say you wanted to set the home page to domain.com/?s=keyword

@Jean-philippeEmond 12/100

^^ haha

@MichaelEcklund.. try?

@MichaelEcklund that would be search?.. or you meant some arbitrary arg?

yes

well, just filter the heck out of it. anything non WP-ish core should just ignore

like Rarst said.. Or.. try to create you a template home page.. and add your query at the top. and run a query to display what you would do.

ya I suppose there are better ways to accomplish my desire

Thanks guys

@MichaelEcklund, you are good in regex?

Not at all, lol.

arf. ok thanks!

That shit gives me a headache.

loll ok

@Jean-philippeEmond What's your REGEX question?

${integer} is a "back-reference" to a "capture group" or sub-pattern - that being a pattern inside of a set of parenthesis. $0 references the entire match, while every other integer references parenthesis-groups in the order they occur in the pattern

so if you want to capture "Errors" to use in your replacement, put the "Errors" pattern in parenthesis. Since it's the first sub-pattern, reference it with $1

ok. I'll try with that

I think you need to be using preg_replace_callback() as well, since your replacement is a function

yeah.

WIN!!!

array_shift to remove the the entire match.

Oh, I see where things got confusing - you don't need to put your (\s)* in parenthesis - just \s*

ok I just trim my "match".

In general I think '#<strong>\s*(Errors?)\s*<\/strong>#i' would be sufficient - but whatever works =]

gotcha

'#(<strong>)\s*(Error[s]?)\s*(<\/strong>)#i'

ho. even the [s] can be s?

no - I had my terminology mixed up earlier. That's actually what's called a "capture group". Used to match a custom selection or range of characters. i.e. [aeiou] would match any single vowel. The ?*+{4} etc... repetition thingies (can't remember their name) always operate on the last character, escape sequence, capture group, or sub-pattern. So if you're just matching one of those you don't need to further isolate it from the pattern

In that case s? means 0 or 1 s characters... [s]? is functionally the same thing, but not necessary

straight up =]

+1

For pagination_link() - I've always used 'base' => str_replace( 9999999999, '%#%', esc_url( get_pagenum_link( 9999999999 ) ) ) without ever really knowing why. Is this really necessary?

It's apparently not necessary but I'm not even sure what it would have been for.

after staring at it for far too long, I think the idea is that get_pagenum_link() will return a properly formatted pagination link for the current query. The large integer just ensures that the URL get_pagenum_link() returns contains a known value that can then be searched for. Replacing it with '%#%' sees that the page-number placeholder is inserted into the URL where it should be

I think it basically tries to automatically create proper pagination links whether or not pretty permalinks are enabled... Of course the Codex examples won't confirm or deny that O.o

Thanks guys. It seems like I shouldn't need to use it anymore then.

Or at least I don't need to in most cases as of currently.

^^

@toscho Ah yis, found a proper place for the [wizard] tag.

how dare you

lol seemed fitting