Section
Using Postfix with specialized, transactional email services like SendGrid or Mandrill is excellent for not only for optimizing email deliverability, but they usually also offer some nice features.
If you’re using a strong password, brute-forcing is a very inefficient way of breaking into your WordPress account, and if it is really strong, dictionary attacks won’t help much either. However, there are are other, easier, ways for a mischievous person to get their hands on your login credentials e.g. with phishing, keyloggers or a MITM attack. By using a two-factor solution, you will increase your login security by an order of magnitude.
SSH timeout due to inactivity is annoying. Here’s how to keep your SSH sessions alive and prevent the SSH timeout:
To be honest, I don’t exactly know too much about Big-IP, but I’ve come across someone who use it. They terminate HTTPS in Big-IP and WordPress runs on plain HTTP on port 80 on the backend nodes. By default, this makes WordPress confused, so you can’t login to the WordPress dashboard.
Experimental support for HTTP/2 became available in Nginx version 1.9.5 (mainline). It is really easy to enable, and I’ll show you how.
[Using HTTPS](https://www.bjornjohansen.com/securing-nginx-ssl) helps preventing someone from snooping your username/password or hijacking your sessions. [Using HSTS](https://www.bjornjohansen.com/optimizing-https-nginx) makes sure the connection stays on HTTPS, even if a MITM tries to redirect you to the plain HTTP version of a web site. But it is easier than you might think for a MITM to use a rogue certificate, making you believe everything is fine. HTTP Public Key Pinning (HPKP) helps the browser check that everything actually is fine.
Here are my slides from WordCamp Belgrade 2015: [HTTP/2 is here – Unlearn your optimization skills](https://www.bjornjohansen.com/wcbg15-slides/) If you’re having issues with the HTML version, you may [download a PDF here](https://www.bjornjohansen.com/content/uploads/2015/04/HTTP2.pdf).
As I’m writing this, the calendar shows April 14 2015. According to the [PHP 7.0 timeline](https://wiki.php.net/rfc/php7timeline), it has a projected release date of November 2015. But if you want to try it out (to check out the speed), you can already do so.
HHVM can really speed up your PHP-based web site. Most reports are somewhere in the range of 2–4x faster. Unfortunately, HHVM isn’t very stable and will suddenly die, just of the blue, from time to another. Fortunately, if you’re running Nginx it’s really easy to set up PHP-FPM as a fallback.
Fail2ban works by filtering a log file with a regular expression triggering a `ban` action if the condition is met. After a preset time, it will trigger an `unban` action. Without much effort, we can have WordPress log all authentication events and have fail2ban react on them.