And you should think a similar way for your WordPress website.

• Active security monitoring
• Malware scanning
• File scanning
• Blacklist monitoring
• Post-hack actions
• Security hardening
• Brute force attack protection
• Firewalls
• Notifications whenever a security threat is identified
• and much more

Your Foremost Priority Must Be Secure Hosting:

Below are certain security features that HostingXP provides on every WordPress managed hosting plan:

• HostingXP identifies DDoS attacks, checks for uptime, and automatically prohibits IPs that have over 6 failed login attempts within a minute.
• Only encrypted SSH and SFTP connections (no FTP) are maintained while directly accessing your WordPress websites.
• Hardware firewalls, together with added active and passive security measures, are implemented to avoid access to your data.
• The open_basedir restrictions also prevent the execution of PHP inside standard directories, which are susceptible to malicious scripts.
• HostingXP utilizes Linux containers (LXC) and the Google Cloud Platform (GCP) that offers absolute isolation not just for each account but also for each specific WordPress site. This is a more secure approach than the one provided by some other competitors. GCP too implements data encryption at rest.
• HostingXP only executes the PHP versions like 7.2, 7.3, and 7.4. The unsupported PHP versions are risky because they no longer include security updates and are susceptible to unpatched security risks.
• Nothing is entirely hack-proof, and so HostingXP offers free hack fixes for every client.

Best WordPress Security Plugins in 2019:

1. Sucuri Security – Auditing, Malware Scanner and Security Hardening
2. iThemes Security
3. Wordfence Security
4. WP fail2ban
5. All In One WP Security & Firewall
6. Jetpack
7. SecuPress
8. BulletProof Security
9. VaultPress
10. Google Authenticator – Two Factor Authentication
11. Security Ninja
12. Defender
13. Astra Web Security
14. Shield Security
15. Hide my WP
16. WebARX

1. Sucuri Security – Auditing, Malware Scanner, and Security Hardening:

Check on WordPress.Org

• It provides numerous variations of SSL certificates. No need to pay for them, but it’s present in the packages.
• The customer service is accessible through email and chat.
• You get immediate notifications whenever something is incorrect with your website.
• Advanced DDoS protection is offered in some plans.
• When you don’t wish to pay any money, you can still get to use helpful tools for malware scanning, file integrity monitoring, blacklist monitoring, and security hardening.

2. iThemes Security:

Check on WordPress.Org

Features That Make iThemes Security a Great Choice:

• This plugin provides file change detection that is vital because most web admins do not perceive when a file is being messed.
• Include an additional protection layer into your login with the use of the Google reCAPTCHA integration.
• The plugin makes a comparison of your WordPress core files with the existing version of WordPress. This lets you know if anything malicious is included in such files.
• Update your WordPress salts and keys to supplement an additional layer of difficulty to your authentication keys.
• It allows setting an “Away Mode” that helps when you are not creating continuous updates to your site and is willing to lock your WordPress dashboard from every user fully.
• Other features like brute force protection, 404 detections, and powerful password enforcement.

3. Wordfence Security:

Check on WordPress.Org

Features That Make WordFence Security a Great Choice:

• Its free version is efficient enough for smaller websites.
• Developers can save a lot of money whenever they sign up for several site keys.
• It comes with a complete firewall suite along with the tools for manual blocking, country blocking, real-time threat defense, brute force protection, and a web application firewall.
• The scan section of the plugin combats malware, spam, and real-time threats. It also scans each of your files for malware instead of just WordPress files.
• The plugin supervises live traffic after observing logins and logouts, Google crawl activity, bots, and human visitors.
• You get access to some exceptional tools, such as the option to sign in through your cell phone quickly. Also, there is support for password auditing.
• The comment spam filter discards the requirement to install a separate plugin.
• It supervises your plugins and helps you know whether they are discarded from the WordPress plugin repository or not. It also lets you know if they are no longer updated and have been deserted.

4. WP fail2ban:

Check on WordPress.Org

Features That Make WP fail2ban a Great Choice:

• Select between hard or soft blocks.
• Incorporate with CloudFlare and proxy servers.
• Log comments to avoid spam or malicious comments.
• The plugin too records information about pingbacks, spam, and used inventory.
• The option to make a shortcode immediately blocks users before even possessing a chance to get to the login procedure.

5. All In One WP Security & Firewall:

Check on WordPress.Org

Features That Make All In One WP Security & Firewall a Great Choice:

• This security plugin contains a blacklist tool wherein you can fix several criteria to block a user.
• It allows backup of .htaccess and .wp-config files. Also, a tool is available to restore them if something goes wrong.
• The plugin depicts a graph to state how influential your website is. The graph assigns points to some definite regions of your website. It is one of the most delicate features for the regular user to envisage the process happening with the security of a website.
• The plugin is free without any upscales.

6. Jetpack:

Check on WordPress.org

Features That Make Jetpack a Great Choice:

• Its free plan offers enough security for a small website. Later, you can upgrade to the premium plans at affordable prices and receive full support.
• The premium plans make the plugin similar to a suite, with advantages like security scanning, spam protection, and backups.
• Plugin updates are fully organized through Jetpack.
• You also receive downtime monitoring.
• Jetpack plugin discards the requirement to use other plugins. For example, it comes with social media features, email marketing, site customization, and site optimization.

7. SecuPress:

Check on WordPress.Org

Features That Make SecuPress a Great Choice:

• The UI in this plugin is perhaps one of the finest. The same makes it simple to use, especially for beginners.
• Its premium version comes with a myriad of features. You can check 35 security points within 5 minutes, obtain a report, and then set up your WordPress site.
• It comes with the capability to alter your WordPress login URL so that bots could not find it.
• Assists you identify themes and plugins that are risky or that have been interfered with to incorporate malicious code.

8. BulletProof Security:

Check on WordPress.Org

It is better first to try the free plugin because it provides the below tools:

• Database backups and restoring
• Login security and monitoring
• Anti-spam and anti-hacking tools
• MScan Malware Scanner
• A security log
• Maintenance mode
• Hidden plugin folders
• A full setup wizard

Features That Make BulletProof Security a Great Choice:

• The plugin boasts a few of the most exceptional advanced security tools in the market. These tools have features like BPS Pro ARQ Intrusion Detection and Prevention System (ARQ IDPS) encrypting solutions. Additionally, they support cURL scans, scheduled crons, folder locking, and more.
• Its free version is loaded with good features for the standard website.
• The database backups are available in its free version.
• You can conceal distinct plugin folders.
• Its maintenance mode is not found in other security plugins.

9. VaultPress:

Check on WordPress.Org

Features That Make VaultPress a Great Choice:

• The pricing is more affordable than the majority of the other premium WordPress security plugins.
• Its dashboard boasts a clean interface, and it is easy to understand for every user.
• Through a calendar, it allows you to create real-time or manual backups.
• The stats tab shows the information on the most famous visiting periods on your website. Besides, it shows what threats have taken place during such times.
• You can approach the experts from the VaultPress team to assist you with tasks such as site backups and restoration.

10. Google Authenticator – Two Factor Authentication:

Check on WordPress.Org

Features That Make Google Authenticator a Great Choice:

• It almost discards the susceptibility, i.e., your login area.
• You get the freedom to select which two-factor authentication system is the simplest for you.
• You can choose which user types have to pass through the authentication procedure.
• The plugin possesses a shortcode for use with the custom login pages.

11. Security Ninja:

Features That Make Security Ninja a Great Choice:

• The security tester module that is present in its free version accomplishes 50+ security tests on your site.
• For non-tech-savvy individuals, the auto fixer module can solve any issues identified.
• Scan WordPress core to guarantee the integrity of the core files after weighing them against a secure and recent copy from wordpress.org.
• Scan plugins as well as themes to find out malicious code and malware.
• Present a large list of recognized bad IPs and then block them automatically.
• Record all events that are going on your WordPress site. They range from users logging in to settings being modified.
• Allows scheduling the regular scans.

12. Defender:

Check on WordPress.Org

Features That Make Defender a Great Choice:

• WordPress core file scanning and repair
• Google 2-Step Verification
• IP Blacklist manager and logging
• Login Screen Masking
• Timed Lockout brute force attack safeguard for login protection
• IP lockout notifications and reports
• 404 limiter for blocking vulnerability scans
• Unlimited file scans

13. Astra Web Security:

Check on WordPress.Org

Features That Make Astra Web Security a Great Choice:

• Astra security solution is set up in the form of a WordPress plugin. No need to modify DNS settings.
• They provide instant malware cleanup, a reliable firewall that prevents attacks like XSS, SQLi, Bad Bots, Code Injection, SEO spam, Brute force, and other over 100 cyber attacks.
• Comprehensive security audit containing the business error logic for a WordPress website.
• User-friendly dashboard records all attacks and presents you with an alternative to whitelist IP range or a URL, block country, constant blacklist, reputation supervising, hourly admin login notifications, etc.
• It presents a bug bounty management or free community security platform in which you provide hackers a secure method to state any susceptibility that they detect on your website. Astra’s engineers authenticate each reported issue.

14. Shield Security:

Check on WordPress.Org

Features That Make Shield Security a Great Choice:

• Only a security plugin that limits access to its own settings to some users.
• More competent protection is implemented with features that function efficiently in the background. They don’t bug you with notifications.
• The only security plugin that provides 3 kinds of two-factor authentication free of cost. Also, it offers the option to choose which users may use it.
• Pro upgrades for all users for $12/site – voluminous pricing without the voluminous purchase.
• Pro provides 6 times efficient scans to identify problems in all portions of your sites.

15. Hide My WP:

Features That Make Hide My WP a Great Choice:

• Conceals the name of the plugins, theme, modifies permalinks, conceals wp-admin, login URL, and much more.
• Restricts direct access to PHP files, clears out WP class names, and disqualifies directory listing.
• Informs about any possible bad behavior with complete details of an attacker like IP address, username, date, etc.
• It contains a “trust network2 which automatically restricts traffic from the bad source IP addresses.
• The pre-made settings are easy to use with the one-click operation.
• Compatible with multi-site, premium themes Nginx, Apache, IIS, and other security plugins.

16. WebARX:

Check on Patchstack

Features That Make WebARX a Great Choice:

• Advanced Website Firewall fully customizable from the WebARX portal).
• Virtual patching automatically obtains rules to reinforce plugin and theme susceptibilities.
• WordPress installation coagulation: recaptcha, 2FA, automatically include security headers, restrict brute-force attacks, add cookies, modify wp-admin, etc.
• Uptime monitoring: Obtains slack and email alerts whenever a website goes down.
• Custom PDF security reports (personalize them using your logo to deliver to clients).
• Unified security for unlimited websites.

Which WordPress Security Plugin is Best for You?

• For the best value – SecuPress, Sucuri Security, iThemes Security, Jetpack, or Shield Security.
• For a free WordPress security plugin – Sucuri Security (free version) All In One WP Security & Firewall, or Wordfence Security.
• For a security plugin for beginners – Defender, All In One WP Security & Firewall, or Security Ninja.
• When you need a more innovative brute force protection plugin – Astra or WP fail2ban.
• For obtaining two-factor authentication – Google Authenticator – Two Factor Authentication.
• For elegant interface – SecuPress or VaultPress.

Also Read: Best Practices and Steps to reduce HTTP requests in WordPress Posts

Also Read: Checklist and Best Practices to Setup W3 Total Cache Plugin for WordPress

The usefulness of AWS for WordPress:

• Enhanced user experience
• Flexible and scalable
• Complete Ownership
• Cost-effective platform
• Ease of migrating WordPress site
• Boost in website performance

Method-1: Configure WordPress on AWS free Tier:

Step-1: Signing Up for an AWS free tier account:

Step-2: Setup of Amazon EC2 Instance:

1. Login to your AWS account and launch the AWS Management Console
2. In this console, find the EC2 under ‘Compute’ and then double-click on it to launch the EC2 dashboard. Now, click on ‘Launch Instance’ to set up and configure your EC2 instance.

Step-3: Installation of WordPress on your EC2 Instance

1. From the left menu, click on ‘AWS Marketplace.’
2. Now search for ‘WordPress’ and then for ‘WordPress powered by BitNami’
3. Press the blue ‘Select’ button

Step-4: Validate the pricing:

Follow the following steps:

1. Navigate down and choose ‘Continue.’
2. In the ‘Type’ column, click on ‘t2.micro.’
3. Now click ‘Next: Configure Instance Details. Please wait for a few seconds to load it.
4. In the subsequent screens, click on ‘Next: Add Storage’ and finally click on ‘Next: Tag Instance.’

Step-5: Setting name, for instance, and reviewing it:

1. Click on ‘Review and Launch’ to proceed further.
2. Confirm the instance last time before moving on. Now click on ‘Launch.’ By doing this, it will launch your Amazon EC2 instance that operates on WordPress.

Step-6: Configuration of Key-Pair for SSH:

1. Choose ‘Proceed without a key pair’ and tick a mark on the box to validate that you know you require this key for accessing your EC2 instance.
2. Now click on ‘Launch Instances’ to launch your instance. Wait a few minutes to begin the instance.

Step-7: Test your WordPress Instance:

1. From the bottom right part, click on ‘View Instances.’
2. Now select the WordPress instance. (Make sure the ‘Instance State’ shows as running. But if the ‘Instance State’ shows up as launching, AWS is yet busy creating your WordPress instance.

Step-8: Test your site:

1. Search for the ‘Public IP’ for your instance at the bottom of the page.
2. Now copy that IP in a new tab inside your web browser. (When you do this, you must notice the well-known ‘Hello World’ WordPress home screen.)

1. Open your EC2 dashboard and choose your WordPress instance.
2. Click on the ‘Actions’ button.
3. From the drop-down menu, choose Instance Setting > Get System Log.
4. Browse through the ‘System Log’ popup to find out the password for your WordPress admin.
5. (You can easily find the password enclosed by hash marks.)
6. Copy the password to some external file or note it down.
7. Open your WordPress website.
8. Now add /admin to the URL’s end.
9. Click on enter, and it will show up login page of your WordPress site.

Method-2: Using AWS through managed WordPress hosting:

More on WordPress:

• How To Use The WordPress HTTP API
• How to Setup Cloudflare Cache for WordPress

• WpBeginner
• SitePoint

Overview:

Pros:

• Cutting-edge features and flexibility are amazing—5/5 for performance.
• Found compatible with Cloudflare, Varnish, and more.

Cons:

• Lots of settings may confuse beginners, but the same make the plugin extremely flexible.

Installation & Setup process:

1. First of all, login to WordPress Dashboard example.com/wp-admin/
2. Now follow the below path: Plugins > Add new > Search for W3 Total Cache
3. Now install and Activate
4. Go to Settings > General
5. Click on Hide button to discard following header message.
6. Preview mode: Don’t touch
7. Enable Page Cache > Choose Page Cache Method > Disk Basic
8. Minify: Don’t touch.
9. OpCode Cache: Don’t touch
10. Database Cache: Disk
11. Object Cache: Don’t touch
12. Browser Cache: Enable
13. CDN: Choose Generic Mirror (Addition of cdn.exmaple.com in the forthcoming steps)
14. Reverse Proxy: This should be enabled if you use Varnish. (Additionally, make sure to enter application path wordpress-xyz-abc.cloudwaysapps.com:8080 in case you are a Cloudways user. Your App path is mentioned at Applications > Domain management.)
15. In the Miscellaneous tab, you need to uncheck Enable Google Page Speed dashboard widget.
16. Save Settings and Purge Caches. At this step, the general Settings completes.
17. Now open the Page Cache menu of the W3 Total Cache plugin.
18. Check “Cache front page.”
19. Check “Cache feeds: site, categories, tags, comments.”
20. Check “Cache SSL (https) requests”
21. Don’t change “Cache URIs with query string variables.”
22. Don’t change “Cache 404 (not found) pages.”
23. Check “Don’t cache pages for logged in users”
24. Check “Don’t cache pages for following user roles.” Tip: You might choose user role – Administrator, Editor, and Author” for those you don’t wish to clutter with cache
25. Aliases: Let it stay blank.
26. Cache Preload: Keep it unchecked.
27. Purge Policy: Should check Front Page, Post Page, Blog Feed
28. Finally, save settings so that you never need to visit the Page Cache option of W3TC again.
29. Please navigate to the Browser Cache menu and configure it correctly. (Typically, browser cache is regulated by an HTTP header names “cache-control” that guides the browser the proper way to manage e particular file. It decides whether to cache or not.)
30. Firstly, you will notice the General Settings that specifies global browser cache policy. You might override depending on the file type. The same is the exceptional and flexible feature of this plugin. This feature is not found in any other well-known cache plugin.
31. It is important to understand what these menus mean. First one is Last Modified, I advise enable it, assists Googlebot to do not forcefully crawl non-modified static resources.
32. Set Expires header which is commonly utilized by proxy, to save file, web page in the cache memory for a specific time period. Make sure to keep it disable.
33. Now you have to set the cache-control header which is utilized by browser. Now you have to keep it disable. Since keeping globally is not a decent idea.
34. In this step, you have to set the entity tag (ETag) and keep that option enable. It assist browser to validate cached file either to be used or not.
35. Now you need to set the W3 Total Cache header. In order to keep the thing white level you have to disable this feature. Either the header is disabled or enabled; it does not matter.
36. Enable HTTP (gzip) compression: You may enable this feature.
37. Avoid objects getting cached after settings change. Make sure not to enable it. Otherwise, it may add to your bandwidth consumption by avoiding appropriate browser cache. Particularly, this feature must be used only when you encounter some issue in which you are unable to override browser cache for the static files.
38. Discard query strings from static resources: Please don’t enable this. When you enable this feature, it will just enhance grade by discarding query strings like ver=?2.3 outside the static files. Doing this will not enhance actual load time.
39. Don’t set cookies for static files: Enable.
40. Do not process 404 errors for static objects with WordPress: Famous feature from W3TC plugin that decreases server load for the 404. You may observe that how a single 404 error occasionally leads to a long time for loading. The particular option decrease the impact by serving simple 404 page instead of attractive for static files like jpg, txt, etc. It would be best if you did not worry as this is not for standard pages. It is recommended to enable this feature.
41. The rewrite URL structure of objects: Let it stay uncheck.
42. Apply HTTP Strict Transport Security policy: It is a great setting for caching “force HTTPS request”. If you are novice to WordPress, make sure not to enable this; it may lead to problems when you occasionally miss SSL. The browser will prevent the loading process in HTTPS or HTTP, except you keep valid certificate.
43. Now, navigate down and find CSS & JS. The particular setting is applicable only for CSS and JS. Look at the screenshot below.
44. For HTML, the Browser cache settings must have slight modification. It is clear that our HTML (a document in browser language) is basically a dynamic version of content. It is always better to not cache anything for HTML. Also, the same is not a recommended approach. In case you keep expire 3600seconds then it means that again W3TC will continue refreshing pages. It is better to prevent browser caching for HTML.
45. For Media elements, the settings must be identical to JS and CSS. Go through the below screenshot.
46. Now one important setting is CDN If you have enabled the “Generic Mirror” or CDN option in the most recent General Settings page in previous steps, you now have to configure it. (Warning: Please don’t alter any of these options otherwise you may face problem.)
47. Navigate down a bit at the CDN page, and you will observe “General” settings. Go through the below screenshot.
48. General: Don’t check Add canonical header: Google doesn’t support it.
49. Configuration: Navigate down, and mention your CDN path
50. Advanced: Navigate down and enable the Set cookie domain.
51. Now CDN configuration is complete, so click on Save Settings and Purge Caches.
52. Open the Extensions menu of W3TC. Make sure to disable everything apart from Yoast SEO. As a result, it will direct the correct CDN path for images within the Yoast XML Sitemap.

To Conclude:

Also Read: How to Setup Cloudflare Cache for WordPress

The Fundamentals Of HTTP:

• An initial line
• Zero or multiple header lines
• A blank line
• A body content (optional)

The Initial Line:

GET /blog/ HTTP/1.1

HTTP/1.0 200 OK

Headers:

Body:

Additional Information:

About Restful APIs:

• GET /post/1/ will be useful to access the post through the ID of 1.
• DELETE /post/1/ will be useful to delete that post.

Use of the WordPress HTTP API:

• wp_remote_get()
• wp_remote_post()
• wp_remote_head()
• wp_remote_request()

• wp_remote_retrieve_body()
• wp_remote_retrieve_header()
• wp_remote_retrieve_headers()
• wp_remote_retrieve_response_code()
• wp_remote_retrieve_response_message()

Our First HTTP Request:

$response = wp_remote_head( 'https://HostingXP.com/blog/' );

var_dump( $response )

array (size=5)

  'headers' => 

    array (size=13)

      'server' => string 'nginx' (length=5)

      'date' => string 'Wed, 22 Jul 2015 14:22:07 GMT' (length=29)

      'content-type' => string 'text/html; charset=UTF-8' (length=24)

      'connection' => string 'close' (length=5)

      'vary' => string 'Accept-Encoding' (length=15)

      'x-pingback' => string 'https://HostingXP.com/xmlrpc.php' (length=29)

      'x-powered-by' => string 'HHVM/3.8.0' (length=10)

      'link' => string '; rel="https://github.com/WP-API/WP-API"' (length=68)

      'x-frame-options' => string 'DENY' (length=4)

      'x-content-type-options' => string 'nosniff' (length=7)

      'strict-transport-security' => string 'max-age=31536000' (length=16)

      'x-HostingXP-cache' => string 'HIT' (length=3)

      'content-encoding' => string 'gzip' (length=4)

  'body' => string '' (length=0)

  'response' => 

    array (size=2)

      'code' => int 200

      'message' => string 'OK' (length=2)

  'cookies' => 

    array (size=0)

      empty

  'filename' => null

Understanding APIs:

Step-1: Encoding Consumer Key And Secret:

define( 'TWITTER_CONSUMER_KEY', '12disnir382jeqwdasd23wdasi' );

define( 'TWITTER_CONSUMER_SECRET', '23wdajskduhtrq2c32cuq9r8uhuf' )

• URL encode the consumer key as well as the consumer secret
• Concatenate them using a colon
• Base64 encode the entire string

$key = urlencode( TWITTER_CONSUMER_KEY );

$secret = urlencode( TWITTER_CONSUMER_SECRET );

$concatenated = $key . ':' . $secret;

$encoded = base64_encode( $concatenated );

Step-2: Receiving a Bearer Token:

• The request should be an HTTP POST request.
• The request should contain an Authorization header along with the value of Basic.
• The request should contain a Content-Type header along with the value of application/x-www-form-urlencoded;charset=UTF-8.
• The request’s body should be grant_type=client_credentials.

$args = array(

    'headers' => array(

        'Authorization' => 'Basic ' . $encoded,

        'Content-Type' => 'application/x-www-form-urlencoded;charset=UTF-8'

    ),

    'body' => 'grant_type=client_credentials'

);

$response = wp_remote_post( 'https://api.twitter.com/oauth2/token', $args );

array (size=5)

  'headers' => 

    array (size=23)

      'cache-control' => string 'no-cache, no-store, must-revalidate, pre-check=0, post-check=0' (length=62)

      'content-disposition' => string 'attachment; filename=json.json' (length=30)

      'content-encoding' => string 'deflate' (length=7)

      'content-length' => string '142' (length=3)

      'content-type' => string 'application/json;charset=utf-8' (length=30)

      'date' => string 'Wed, 22 Jul 2015 14:47:37 GMT' (length=29)

      'expires' => string 'Tue, 31 Mar 1981 05:00:00 GMT' (length=29)

      'last-modified' => string 'Wed, 22 Jul 2015 14:47:37 GMT' (length=29)

      'ml' => string 'A' (length=1)

      'pragma' => string 'no-cache' (length=8)

      'server' => string 'tsa_b' (length=5)

      'set-cookie' => string 'guest_id=v1%3A14375720938219946; Domain=.twitter.com; Path=/; Expires=Fri, 21-Jul-2017 14:47:37 UTC' (length=100)

      'status' => string '200 OK' (length=6)

      'strict-transport-security' => string 'max-age=631138519' (length=17)

      'x-connection-hash' => string 'd8b10926f99dwef93rd7edbe5a71a97a' (length=32)

      'x-content-type-options' => string 'nosniff' (length=7)

      'x-frame-options' => string 'SAMEORIGIN' (length=10)

      'x-response-time' => string '34' (length=2)

      'x-transaction' => string 'ef0ebwefweece62ef' (length=16)

      'x-tsa-request-body-time' => string '0' (length=1)

      'x-twitter-response-tags' => string 'BouncerCompliant' (length=16)

      'x-ua-compatible' => string 'IE=edge,chrome=1' (length=16)

      'x-xss-protection' => string '1; mode=block' (length=13)

  'body' => string '{"token_type":"bearer","access_token":"AAAAAAAAAAAAAAAAAAAAAFoafQAAAAAAqg%2BxmuH83hjsod6crH5bKTUX9Arc%3D5dWpp0XCTDjyiXxMC7LDLg8JbzPdGlCsJi2R1qjY1FMksTAFyG"}' (length=155)

  'response' => 

    array (size=2)

      'code' => int 200

      'message' => string 'OK' (length=2)

  'cookies' => 

    array (size=1)

      0 => 

        object(WP_Http_Cookie)[303]

          public 'name' => string 'guest_id' (length=8)

          public 'value' => string 'v1:143757645770219946' (length=21)

          public 'expires' => int 1500648457

          public 'path' => string '/' (length=1)

          public 'domain' => string '.twitter.com' (length=12)

  'filename' => null

$body = wp_remote_retrieve_body( $response );

$body = json_decode( $body, true );

$access_token = $body['access_token'];

Step-3: Using Bearer Token:

$url = 'https://api.twitter.com/1.1/statuses/user_timeline.json?screen_name=danielpataki&count=3';

$args = array(

    'headers' => array(

        'Authorization' => 'Bearer ' . $access_token,

    ),

);

$response = wp_remote_get( $url, $args );

$tweets = json_decode( wp_remote_retrieve_body($response), true

Conclusion:

More Reading:

• Best Practices and Steps to reduce HTTP requests in WordPress Posts
• How to Reduce or Stop excessive DOM size in WordPress?

• Accelerate WordPress 22 worldwide without modifying your current hosting (for nearly all cases)
• Easily enhancing TTFB
• Dealing with traffic spike on viral content or event blog without expanding hosting resources
• Speeding up the loading process of HTML similar to static content
• Growing website availability

Accelerating WordPress on a limited budget can be difficult.

• I will share the whole method for deploying the Cache Everything page rule through WordPress. Also, I will share its advantages and disadvantages, potential issue, and everything necessary you may want to know.

What is Cloudflare 9 Cache Everything Page Rule?

• Mostly, when Cloudflare setup is done, it only caches the static files such as JavaScripts, Stylesheet, Images, etc. However, it does not work on vanilla HTML.
• Due to the above reason, the static content loads rapidly; however, HTML always puts up with. Several users denounced that after they use Cloudflare, their TTFB got a boost. Look at an example here:

• Your website TTFB 52, relies on your location of Performance testing. It also depends upon the location of your website server, cache status, server load, DNS, etc.
• For instance, if your website servers are positioned in the USA and test the performance from the exact location, the TTFB would execute faster than other regions. It is one of the most significant reasons why I always suggest picking server location according to your target audience nation”.

The solution is as follows:

Prerequisite understanding to setup FSD with Cloudflare:

• DNS – You should be familiar with the meaning of grey and orange record at Cloudflare on the DNS page 15
• Cloudflare – You should be comfortable with its settings
• W3TC 63 – It is an excellent help for FSD.
• Cloudflare HTTP Header response – For this, you should know Cache-Control 12 header, status code, CDN HIT and MISS response, etc.

How to properly enable Cloudflare HTML caching?

• Pro: Simpler for blogs that update frequently.
• When combined along with a CDN, it offers excellent performance. It is recommended to try BunnyCDN. But if you do not use CDN, there will be an adverse impact on the static resource performance. This is because of the low cache HIT ratio and the full purge caused by W3TC Cloudflare extensions.

1. Setup W3TC plugin precisely as illustrated in this guide. Make sure not to modify anything within the Browser settings portion.
2. Follow the path: Extensions > Enable Cloudflare
3. You must use Cloudflare API key 3
4. Carry out all such necessary settings

1. Retain the Respect Existing Headers; do not override it. It is significant to follow the W3TC Browser cache settings.
2. Now, set up the Cloudflare Page rule.

Tip: For skipping Page cache for some URLs, set Cache Level: Standard.

1. You might not wish to cache WordPress.com toolbar. So, it is better to conceal it for unidentified visitors.

add_action('after_setup_theme', 'remove_admin_bar');


function remove_admin_bar() {


if (!current_user_can('administrator') && !is_admin()) {


 show_admin_bar(false);


}


}

1. The newest version of WordPress can better deal with the commenting. Hence, you can skip this step.

// First comment redirection


function redirect_first_time_commenters( $url, $comment ) {


// get count of user comment


$comment_count = get_comments( array
( 'author_email' => $comment->comment_author_email, 'count' => true ) );


// if this is the user first comment, redirect to the "Thank You" Page


if ( 1 == $comment_count ) {


$url = 'https://hostingxp.com/thank-you-for-commenting/';


}


return $url;


}


add_filter( 'comment_post_redirect', 'redirect_first_time_commenters', 10, 2 );

1. Remove Admin Traffic from the Google Analytics console.
2. Now configure the ‘BunnyCDN’ for improving the static content HIT cache ratio and maintain a good balance for the performance.
3. Conceal frontend Login/Sign up stuff. (You can avoid this method in the present case/)

FAQs:

• Not at all recommended for WP Rocket, WP Fastest Cache, WP Super Cache, and many, mostly may lead to cf-cache-status: MISS because of preventive Cache-Control header for that particular document. This is why I do not recommend anything other than W3TC to fulfill this need.

• Discussed previously How to Fix W3 Total Cache Fatal Error that comes while Purge 14

• The Chrome Developer tool proves to the best tool for this. You can use its Networking tab to supervise HTTP response.

• In the majority of the cases, it is enough. For WooCommerce or some other cookie support, the need may arise to use its Business plan with a price of $200/month. If you need the most affordable option, go for ‘Sucuri 3’ WAF which simply offers identical features.

Summing-up:

• Excluding cache on the exact time
• Managing Cache-Control header to serve the web page efficiently
• Balancing better HIT ratio

• When you exclude Cloudflare HTML cache, there will be exclusion of Cloudflare whole cache (CSS, HTML, JS, images) similar to using the “Purge everything” button. Is this good? No.
• Hence, I advised making use of the ‘BunnyCDN’ for maintaining a distinct hostname when you want to cache static content of WordPress.

The alternative approach is:

• Maintain the Cloudflare configuration as well as rest function code as it is.
• Prevent the use of ‘BunnyCDN.’
• Make sure to configure Browser cache for all the static resources across long-term (for example 1 year)
• Refrain from entirely using W3TC
• Set Cache-Control plugin according to the one shown in the following screenshot. Every configuration is just for the Document web page working on HTML. The same is essential for setting up purge rules depending on the TTL. Read the below section to understand more:

How does it function?

• Your cache is expected to terminate at a specific time.
• It is always allowed to purge whether you are doing it manually or automatically. Why does it? Begin from 600 seconds TTL. Now gradually increase once you become an experienced one.
• Now, what for the static content? Cache-Control, you need to know that it is variable according to HTTP requests. Hence, we can add an extra Browser Cache header, especially for the resources such as /wp-content/ as well as /wp-includes/ through a Page rule of Cloudflare. Alternatively, it is not required if you have already done with .htaccess and have used the respect existing header.

For page rule:

1. Make a rule where browser cache TTL: The time duration you can keep is 14 days or later. Generally, longer is better because it is the static content.
2. Make one more rule for Cache Level: Standard (Ensure to stay away from caching everything now.) It is used here since /wp-* will cover only static resources; it does not work on HTML.