HTTP Digest Authentication
This plugin adds an additional layer of protection for the wp-login.php page using HTTP Digest Authentication with the PHP header() function. So it doesn’t require configuring web server files like .htaccess or .htdigest and works on all web hosting environments. Important: If you already have a plugin which does HTTP Authentication please deactivate it before activating this plugin. Similarly if you have configured your web server to do HTTP authentication on the wp-login.php file please remove it before using this plugin. If you are using FastCGI PHP this plugin may keep prompting for the credentials even if you enter the right pair, in this case use the following in your .htaccess file SetEnvIfNoCase ^Authorization$ "(.+)" PHP_AUTH_DIGEST=$1 Advantages of HTTP Digest Authentication Digest Authentication is very much safer than HTTP Basic Authentication whose credentials can be easily decoded with a base64 decoder. From Wikipedia on HTTP Basic Authentication: The BA (Basic Authentication) mechanism provides no confidentiality protection for the transmitted credentials. They are merely encoded with BASE64 in transit, but not encrypted or hashed in any way. Digest Authentication on the other hand uses MD5 on the credentials making it “one way” Uses server and client nonces to prevent replay attacks Features of the HTTP Digest Auth plugin Works using PHP header() function and doesn’t require modification of service config files (like .htaccess, nginx.conf etc) Supports HTTP credentials for each WordPress user Clears the HTTP Digest credentials when the user logs out of WordPress (more on this in the FAQ) Verifies if both the HTTP and WordPress credentials are of the same user (this is the default behavior and can be changed) Works on all major Web Servers (Tested on Apache, Nginx and Lighttpd) Plugin Behavior When this plugin is activated for the first time all WordPress users will have the following Digest credentials Username: Password: password This can be changed from Users > Your Profile. After activating this plugin for the first time you’ll be prompted for HTTP credentials when you logout Similarly if you change your HTTP username or password you’ll be prompted for this when you logout Available languages English Serbo-Croatian by Borisa Djuraskovic The HTTP Digest Authentication Plugin official homepage.
WP Cron HTTP Auth
This plugin enables WP Cron on sites using HTTP Authentication. How to use: Visit the plugin settings, enter your HTTP Auth credentials, save changes, done. Everything happens silently and automatically in the background. 👉 Supports defined constants via wp-config.php 👉 Super lightweight, fast, and effective 👉 Plugin uses only 30KB of code Privacy This plugin does not collect or store any user data. It does not set any cookies, and it does not connect to any third-party locations. Thus, this plugin does not affect user privacy in any way. WP Cron HTTP Auth is developed and maintained by Jeff Starr, 15-year WordPress developer and book author. Support development I develop and maintain this free plugin with love for the WordPress community. To show support, you can make a donation or purchase one of my books: The Tao of WordPress Digging into WordPress .htaccess made easy WordPress Themes In Depth Wizard’s SQL Recipes for WordPress And/or purchase one of my premium WordPress plugins: BBQ Pro – Blazing fast WordPress firewall Blackhole Pro – Automatically block bad bots Banhammer Pro – Monitor traffic and ban the bad guys GA Google Analytics Pro – Connect WordPress to Google Analytics Head Meta Pro – Ultimate Meta Tags for WordPress REST Pro Tools – Awesome tools for managing the WP REST API Simple Ajax Chat Pro – Unlimited chat rooms USP Pro – Unlimited front-end forms Links, tweets and likes also appreciated. Thank you! 🙂
