HTTP Digest Authentication wordpress plugin resources analysis

Download This Plugin
Download Elegant Themes
Name	HTTP Digest Authentication
Version	1.2.1
Author	Jesin
Rating	74
Last updated	2015-03-02 07:14:00
Downloads	1346
Download Plugins Speed Test plugin for Wordpress

Home page

Delta: 0%

Post page

Delta: 0%

HTTP Digest Authentication plugin has no negative impact on PageSpeed score.

Home page PageSpeed score has been degraded by 0%, while Post page PageSpeed score has been degraded by 0%

HTTP Digest Authentication plugin added 187 bytes of resources to the Home page and 187 bytes of resources to the sample Post page.

HTTP Digest Authentication plugin added 0 new host(s) to the Home page and 0 new host(s) to the sample Post page.

Great! HTTP Digest Authentication plugin ads no tables to your Wordpress blog database.

Resources Added (Post page)

Description

This plugin adds an additional layer of protection for the wp-login.php page using HTTP Digest Authentication with the PHP header() function.
So it doesn't require configuring web server files like .htaccess or .htdigest and works on all web hosting environments.

Important: If you already have a plugin which does HTTP Authentication please deactivate it before activating this plugin. Similarly if you have configured your web server to do HTTP authentication on the wp-login.php file please remove it before using this plugin.

If you are using FastCGI PHP this plugin may keep prompting for the credentials even if you enter the right pair, in this case use the following in your .htaccess file

<IfModule mod_setenvif.c>
SetEnvIfNoCase ^Authorization$ "(.+)" PHP_AUTH_DIGEST=$1
</IfModule>

Advantages of HTTP Digest Authentication

Digest Authentication is very much safer than HTTP Basic Authentication whose credentials can be easily decoded with a base64 decoder.
From Wikipedia on HTTP Basic Authentication:

The BA (Basic Authentication) mechanism provides no confidentiality protection for the transmitted credentials. They are merely encoded with BASE64 in transit, but not encrypted or hashed in any way.

Digest Authentication on the other hand uses MD5 on the credentials making it "one way"
Uses server and client nonces to prevent replay attacks

Features of the HTTP Digest Auth plugin

Works using PHP header() function and doesn't require modification of service config files (like .htaccess, nginx.conf etc)
Supports HTTP credentials for each WordPress user
Clears the HTTP Digest credentials when the user logs out of WordPress (more on this in the FAQ)
Verifies if both the HTTP and WordPress credentials are of the same user (this is the default behavior and can be changed)
Works on all major Web Servers (Tested on Apache, Nginx and Lighttpd)

Plugin Behavior

When this plugin is activated for the first time all WordPress users will have the following Digest credentials
Username: <WordPress username>
Password: password
This can be changed from Users > Your Profile.
After activating this plugin for the first time you'll be prompted for HTTP credentials when you logout
Similarly if you change your HTTP username or password you'll be prompted for this when you logout