User meta and public function security

Question

I am using stripe to setup a system of buying credits, which can be used on my wordpress site. I save credits using wordpress user meta, and I increment those credits after a successful transaction with stripe. I do this using the following function in my themes functions.php file

//increment a users pack credits
function increment_pack_credits( $user_id , $credit_amt ) {
    if ( !current_user_can( 'edit_user', $user_id ) ){
        return false;
    }else{
        //get the current credits amount
        $pack_credits = get_user_meta($user_id, 'pack_credits', true);
        //increment by the added credit amount
        $pack_credits = ($pack_credits + $credit_amt);
        update_usermeta( $user_id, 'pack_credits', $pack_credits );
    }
}

Two questions:

1) Is user meta a secure method to store purchased credits?

2) Is my function, located in functions.php, a secure method to increment credits? How easy (or not) would it be to tamper with credit amount?

Answer 1

functions.php is not more nor less secure than any other file in your WordPress installation, just like post meta is not more nor less secure than any other table in your WordPress database.

That means that they are secure until your site is hacked. So question become "is WordPress secure?" and I think that:

1. that question is probably off-topic for this site
2. even that question is not enough, in fact a site can be hacked for a reason not related to WordPress, but for hundreds different reasons: server misconfiguration, stolen credentials, ecc..

Now, WordPress core is quite secure if you follow some basic security rules, a not comprehensive list: strong passwords, non-default admin username, non-default table prefix, proper salt strings, proper directories permissions, wp-config.php in parent directory... search Google for other useful tips.

Off course you need to follow security rules also for your server general configuration, not only for WordPress.

However, few lines of bad code can open big security holes, so be sure you use plugins and themes from reliable sources and by reliable developers.

There are different resources on the web to test the security of a WordPress install, start from here.

Also consider the use of https for your backend, and in any frontend page where sensible data are manipulated.