How security works
Five things are already protecting the site and need nothing from you:
- Web application firewall. ModSecurity, filtering common attacks before WordPress sees them. On by default, set per domain — a site with aliases has one setting for each.
- Malware scanning, running on the servers themselves and watching every site's files continuously.
- Automatic HTTPS, issued and renewed for every domain.
- Automatic backups, weekly and kept 30 days, independent of anything on this screen.
- An isolated container — its own memory, vCPU and database, separate from every other customer.
The IP rule
One rule for the whole Pressy, either a block-list or an allow-list. You cannot block some addresses and allow others at once. The default — no addresses — means everyone can reach your site, and it is right for almost everyone.
Allow-list refuses everyone not on the list, including you when your
address changes. It is the only control in the product that can lock you out
of your own live site, which is why it asks you to type allow and offers to
add the address you are connecting from.
Where the rule lives
In public_html/.htaccess, as Require ip directives — a real file in your
webroot that you can also edit
over SSH or FTPS. If that file has been
hand-edited into something invalid, reading the rule fails outright and the
screen says so.
What this can’t do
This screen has no attack or login log — no threat counter, no blocked requests, no login history.
What to do: use a WordPress security plugin. Wordfence and Solid Security both log login attempts, scan files and email you about them.
There is no "restrict wp-admin by IP" switch.
What to do: use a security plugin for this. Do not add Require ip rules by
hand expecting them to cover wp-admin — they will not, and they conflict
with the site-wide rule this screen writes.
You cannot upload your own SSL certificate.
What to do: nothing, unless you are bringing a corporate certificate. If you are, write to us before you migrate.
Nothing here touches WordPress users, roles or passwords.
What to do: reset a WordPress password from the WordPress side, and delete administrator accounts you no longer need.
Didn’t solve it?
Write to us with your Pressy’s address and what you were doing when it went wrong. Answered by the people who built it.
Last updated