Frontity and WordPress Security

[Kent]

Hi,

I have some questions regarding the different redirect methods to hide the WordPress installment.

Should we use both the Frontity REST API - Head Tags Plugin and the Simple Website Redirect Plugin??

REST API - Head Tags

Simple Website Redirect

And what about the Frontity PHP plugin, is that laid on the ice for now?

What about security when hosing Frontity and WordPress with Pantheon’s Decoupled Service?
Which plugins will be necessary with Pantheon’s Decoupled Service when this goes live: Decoupled CMS - Going Headless | Pantheon

Should any of these be used?

Pantheon-maintained WordPress Plugins | WordPress Configurations Guide

Perhaps @stevepersch can tell us more about how security can be set up with Pantheon when running their Decoupled Service with Frontity??

Will the WordPress installment and login page be open publicly with Pantheon, or will we need to first log in to Pantheon’s dashboard to enter the WordPress back-end?

What about the Embedded Mode feature… Don’t you need that with Pantheon?

Automatic Platform Optimization Cloudflare

Hi, How does this affect a Frontity installation if this is done to the WordPress installation?

This can also be of interest regarding the security of your WordPress installation, but if this is necessary on Pantheon I do not know… Should we run Wordfence with Pantheon?

Should You Hide Your WordPress Login Page?

No, it’s not necessary… Look at the explanation here:

Ask Wordfence Ep 3: Should you hide your WordPress login page?

It’s better to protect your login like this:

Login Security Options - Wordfence

[juanma]

Hi @Kent

Regarding Wordpress security, in this thread our Lead Developer (and Co-founder of Frontity) shares his point of view:

Would using frontity improve the security of my WordPress site?

This is my personal opinion about security regarding SSG and Frontity. WordPress Server Security SSG when you can shut down WordPress This is the most secure architecture because WordPress stops running and therefore it can’t be hacked. Security: Perfect. Drawbacks of this approach: You can’t use dynamic content in WordPress like comments, forms, or WooCommerce. Each time you need to edit/publish new content, you need to start your WordPress server locally or on-demand. This is easy if th…

---

@Kent

And what about the Frontity PHP plugin, is that laid on the ice for now?

Regarding this, maybe @SantosGuillamot can give you more information on the status of this Frontity PHP plugin.

---

Regarding the rest of your questions I think @luisherranz can help you better than me.
@luisherranz any thoughts on these questions?

[SantosGuillamot]

@Kent

And what about the Frontity PHP plugin, is that laid on the ice for now?

Right now we only have the proof of concept of the Embedded mode, which is the first step to build the PHP plugin. We were discussing different possibilities in this Feature Discussion, but I will open a new one to talk exclusively about the Frontity PHP plugin in the coming days.

Regarding estimations, it’s hard to say. It’s one of our top priorities right now, but our initial idea is to address other features like AMP, Server Extensibility or Frontity hooks first.

Anyway, for things like the redirects you mentioned, plugins like the one you shared should be enough right now.

@Kent

What about security when hosing Frontity and WordPress with Pantheon’s Decoupled Service?

Not 100% sure about this, but I assume it should be similar to a common WordPress site and you can install the Security plugins you prefer. This is a Pantheon guide about WordPress security in case it helps.

@Kent

Will the WordPress installment and login page be open publicly with Pantheon, or will we need to first log in to Pantheon’s dashboard to enter the WordPress back-end?

Your WordPress should be used as any WordPress installation. This means that you can login in mysite.com/wp-admin as you usually do.

[Kent]

Thanks for the nice replies guys