¿Cómo funciona admin-ajax.php?

admin-ajax.phpformaparte de la API de WordPress AJAX ,y sí,maneja solicitudestanto delbackend como delfront.Trate denopreocuparseporel hecho de queestáen wp-admin.Creo quetambiénes un lugarextrañopara él,peronoes unproblema de seguridaden símismo.Cómo se relacionaesto con "enumerar los administradores",no lo sé.

admin-ajax.php is part of the WordPress AJAX API, and yes, it does handle requests from both backend and front. Try not to worry about the fact that it is in wp-admin. I think that is a strange place for it too, but it is not a security problem in itself. How this relates to "enumerate the admins", I don't know.

Para los usuariosno autenticados y queno son de confianza,querrá hacer dosexcepcionesespecíficas a su VPN/Firewall/Apache .htaccess,que son:

• example.com/wp-admin/admin-post.php
• example.com/wp-admin/admin-ajax.php

Estos son dospuntosfinales demagia automática quemuchos utilizantanto WPinterno como varios complementos.

Aquí hay unaexplicación de lo que hace admin-post.php:

• https://www.sitepoint.com/handling-post-request-the-wordpress-way/

admin-ajax.phpfunciona de unamaneramuy similar,y unaexplicación útiles aquí.

For unauthenticated and untrusted users, you'll want to make two specific exceptions to your VPN / Firewall / Apache .htaccess, which are:

• example.com/wp-admin/admin-post.php
• example.com/wp-admin/admin-ajax.php

These are two auto-magic endpoints used by a lot by both internal WP and also various plugins.

Here's some explanation of what admin-post.php does:

• https://www.sitepoint.com/handling-post-requests-the-wordpress-way/

admin-ajax.php works in a very similar way, and a helpful explanation is here.

Si desea limitarel acceso albackend de WP (porejemplo: wp-admin),simplemente use una regla .htaccessen wp-admin directorio.

Consulteeste artículopara obtener una descripcióngeneral: Proteger con contraseña un directorio usando .htaccess

Consultetambiénestetemapara su casoespecífico: Protección con contraseña/wp-admin/

If you want to limit access to the WP backend (ex: wp-admin), just use a .htaccess rule on the wp-admin directory.

Check out this article for a general overview: Password Protect a Directory Using .htaccess

Also check out this topic for your specific case: Password protecting /wp-admin/

Mi opiniónpersonales queestaes unaideaterrible. Hace aproximadamente dosmeses,nuestro director de desarrolloinsistióen que hiciéramosprecisamenteesto,en contra de los consejos delequipo de desarrollo. Es una verdaderapesadilla y un dolorincreíbleparanosotros,no solomata a ajaxen su conjunto,sino quetambiénnospresentamuchosproblemas de administración.

Tenemos 40empleados regulares y 4 desarrolladores queintentan usar la VPN a veces y simplementetartamudea,además de quetodos los usuarios ahora requieren dos conjuntos de contraseñas,unapara wp y otrapara vpn,yesanoes solo una contraseña compartida,esindividual unos,me refiero a de qué otramanera haría una auditoría de seguridad. Yaesbastante difícil recordar una contraseña segura,ymuchomenos dos.

Agregue alproblema quemuchagente no sabe cómo usar una VPN y,amenudo,eso solo causamásproblemas.

En últimainstancia,es unaideaterrible y,amenudo,espresentadapor lagerencia o superior queno conoceni entiende WordPress. Lo venbajo una luzterrible,que debido a quees de código abiertotambién debe ser unproblema de seguridad,lleno deexploitsfáciles de aprovechar,etc.,seestá volviendo viejo.

WordPresses seguro ymantener a wp-admin detrás de una VPNno soloes un alarmismo sino quepresenta unapesadillaparatodos losmiembros delequipo

¿Por qué lostipos de administraciónno confíanen WordPress? Parece que se olvidan de los sitiosprincipales que usan WordPress yno usan VPN,miremashable,porejemplo.

Para recapitular:

Ajaxnofuncionará detrás de una VPN.

Vpnes unaideaterriblepor las razonesmencionadas anteriormente

WordPresses seguro y lo seguirá siendo si lomantiene y los complementos actualizados.

Escuche a su desarrollador,lepagapor suexperiencia. Puedoprometerle quenada socava una relación detrabajo comono depositar su confianzaen unindividuo ytener que verificar sus conocimientos.

Si optapor vpn,asegúrese de comprar suficientes licencias de usuario.

My personal opinion is that this is a god awful idea. About two months ago our director of development insisted we do just this, much against the advice of the Dev team. It's a genuine nightmare and an incredible pain for us, not only does it kill ajax all together it presents so many administration issues for us.

We have 40 regular staff and 4 devs trying to use the vpn at times and it just stutters, along with that all users now require two sets of passwords one for wp and one for vpn and that's not just a shared password it's individual ones, I mean how else would you do a security audit. It's hard enough to remember one secure password, let alone two.

Add to the issue that a lot of people do not know how to use a vpn and often that just causes more issues.

Ultimately it's a terrible idea and it's often put forward by management or higher who do not know or understand WordPress. They see it in a terrible light, that because it's open source it must also be a security issue, filled with easily tapped exploits and so on.... its getting old.

WordPress is secure and sticking wp-admin behind a vpn is not only fear mongering it presents a nightmare for every member of the team

Why is it that management types have no trust when it comes to WordPress, they seem to forget major sites use WordPress and don't use vpns, look at mashable for example.

So to recap:

Ajax won't work behind a vpn.

Vpn is a terrible idea for reasons mentioned above

WordPress is secure and will remain so if you keep it and plugins up to date.

Listen to your Dev, you pay them for their expertise. I can promise you, that nothing undermines a working relationship like not putting your trust into an individual and having to check up on their knowledge.

If you do go with vpn, be sure to buy enough user licenses.