Wordfence

WordFence should be installed on all sites.

Documentation: Wordfence Help

Installation

Perform the following steps in the dev environment:

• Download the Wordfence plugin code (but don't activate the plugin yet)
• Commit the plugin files to version control
• Create a folder for log files

  mkdir src/wordpress/wp-content/wflogs

• Add line to .gitignore to ignore this folder

  /src/wordpress/wp-content/wflogs

• Add volume for log files to all three docker-compose.*.yml

  services:
    app:
      ...
      volumes:
          ...
          - wflogs:/var/www/html/wp-content/wflogs
          ...
  volumes:
    ...
    wflogs:
    ...

• Restart the docker container with docker compose up -d
• Set permissions for volume

  docker compose exec app chown civicrm:civicrm wp-content/wflogs

• Activate the plugin
• Get a license (use system@thirdsectordesign.org email)
• Configure the firewall (Wordfence > Firewall > Manage WAF)
  • click Optimize Firewall
  • this enables extended protection
  • this will alter .htaccess and create wordfence-waf.php
• Commit the changed files to version control - this should include

  src/wordpress/.htaccess
  src/wordpress/wordfence-waf.php
  .gitignore
  docker-compose.dev.yml
  docker-compose.prod.yml
  docker-compose.test.yml

Deployment

To deploy to test or prod follow the steps below - these can be copied and pasted into an issue.

- [ ] Merge and pull MR
- [ ] Run the following commands

  ```sh
  # Create log folder (if required)
  ls -al src/wordpress/wp-content
  mkdir src/wordpress/wp-content/wflogs

  # Restart container
  docker compose up -d

  # Set folder ownership
  docker compose exec app ls -al wp-content
  docker compose exec app chown civicrm:civicrm wp-content/wflogs

  # Activate plugin
  docker compose exec -u civicrm app wp plugin activate wordfence
  ```

  - [ ] Add license
  - [ ] Configure plugin
  - [ ] Put firewall into learning mode
  - [ ] Run a scan
  - [ ] Ask 3SD team to configure 2FA
  - [ ] Suggest client users configure 2FA

See below for details of how to configure this plugin

Configuration

Alter the settings below in Wordfence > All Options.

Global Options

• Wordfence license
  • copy license key from dev site (or create a new license key)
• General Wordfence Options
  • Where to email alerts: system@thirdsectordesign.org
  • How does Wordfence get IPs - check the detected IP is correct (may not be on dev site)
  • Automatically update - switch off
• Email Alert Preferences - ensure the following
  • Email me if Wordfence is deactivated: on
  • Email me if the Wordfence Web Application Firewall is turned off: on
  • Alert me with scan results of this severity level or greater: High
  • Alert when an IP address is blocked: on
  • Alert me when there's a large increase in attacks detected on my site: off
  • Maximum email alerts to send per hour = 1

Firewall

• Basic Firewall Options
  • Put firewall into learning mode
  • Automatically enable in one week - choose other date if this isn't convenient (i.e. if you are going on holiday)
• Brute Force Protection
  • Prevent the use of passwords leaked in data breaches = For all users with 'publish posts' capability (ensure that staff that can access CiviCRM have 'publish posts' capability)
  • Enforce strong passwords = Force all members to use strong passwords
  • Participate in the Real-Time Wordfence Security Network - disable by default

We should discuss with the client if they want to enable the last option. This has data protection implications as it sends IP addresses to Wordfence.

Login security

Change the following settings under Wordfence > Login Security > Settings

• enable for each role that administers CiviCRM and set as 'required'
• allow remembering device for 30 days = true
• configure 2FA for yourself and ask other 3SD staff to configure 2FA.
• tell staff that they will need to enable 2FA for their accounts

Scan

Run a scan on the site to check for any vulnerabilities.