Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

0
votes
1answer
9 views

Changing Table Prefix for an Existing WordPresss Site

Hoping someone can assist with Wordpress table prefix for an already established site. What is the best approach in changing the existing table prefix within both DB and wp-config file to reflect new ...
1
vote
0answers
12 views

Underscore Based Theme File Permissions in Git

I'm using underscores to develop my theme. For some reason git is saying that my file permissions are being changed from 10644 to 10744. I can override this in git's settings this but is it safe for ...
0
votes
0answers
17 views

How to make READ ONLY on the FILE System?

Let's say the WP site is under attack. Then we want to prevent any FILE WRITINGS, including: Uploading of the New Files Any way of WRITING the new files into file system So that the System is very ...
0
votes
1answer
33 views

Suspicious lines of code

Our company website was handed to me and source code was created by previous person. I noticed that there are lots of . I am getting suspicious with these I have the urge to delete these 18 lines of ...
0
votes
0answers
8 views

What is wp-admin/strebam_filter_register.php file?

I ran Sucuri Security integrity check for one of my wordpress websites which had been compromised by malware. I found two suspicious files: wp-admin/strebam_filter_register.php and ...
0
votes
1answer
13 views

Password-protect feed and make it usable in major aggregators

A WordPress site I'm on uses WordPress's default cookie-based authentication. This means that the RSS feed of the page is password-protected and can only be read when the cookie is available. ...
0
votes
0answers
30 views

WordPress Malware - File replacement issue

I'm facing issue of files replacement, modified and newly added similar to this source https://blog.sucuri.net/2015/03/pseudo-darkleech-server-root-infection.html How to identify its backdoor? (I ...
0
votes
0answers
18 views

WordPress and user security

When we talk about Information Security, many things come into mind and people tend to use CMS to be clear on security as CMS people do the job for you, in terms on hashing passwords, encryption etc. ...
2
votes
1answer
42 views

Is it safe to enqueue a font style without putting http or https?

I have seen a few WordPress sites and tutorials enqueuing fonts like this. Does this work with http and https sites? Is it safe to do this? I see these exact URL's in the source code when testing ...
0
votes
0answers
7 views

Force reauthentication/login for specific page for currently logged in users

I have a page that searches user information. The site is a record keeping site. I want it so that when people click the "View Records" link that they mus re-authenticate before proceeding. I'm not ...
2
votes
2answers
91 views

Is security a problem in Wordpress?

I am going to start a big corporate website for his car shop which is supposed be more secured. Is Wordpress okay to start a secured and reliable website? As far as i heard, Wordpress hackers ...
0
votes
0answers
31 views

How to set up fail2ban with WordFence?

I found a blog post that talks about setting up Wordfence and fail2ban but it's quite useless as there is no mention of any technical activity. Only that it took the author a total of 5 hours. I ...
0
votes
2answers
22 views

Secure Multiple WordPress Installations on shared hosting

Most shared hosting packages store all files of a given user under something like /user/myuser/www/ or /var/html. Addon domains are usually located under /var/html/domain1.com/, ...
0
votes
0answers
8 views

XSS Scripting in Cache files

On one of my client's sites I was going through a few of the pages ann noticed a popup appear with a spam advert on it. Finding this highly unusual I inspected the page source and found a bunch of ...
11
votes
1answer
678 views

For what security reasons are svgs blocked in the media uploader?

I see that SVGs are blocked by default in the media uploader and you have to add it as a supported MIME type in functions.php. What security reasons are behind this?
2
votes
1answer
30 views

Whats the safest way to output custom JavaScript and Css code entered by the admin in the Theme Settings?

I'm creating a theme in which I've created options for the admin to enter custom Javascript and Css code in the "Theme Settings" page (created using Options API). Now I'm just not sure how to output ...
1
vote
0answers
20 views

What is the purpose of having a token in cookies?

WordPress utilizes cookies for better security, and I've been trying to understand how exactly this could make a WordPress website more secure, and I found this article . There's a pretty decent ...
-3
votes
1answer
56 views

How to make a WordPress site unhackable (except during during upgrade/plugin update)?

We've had numerous cases where client's WordPress based sites have been hacked due to various reasons, mostly related to a unsecured PHP file inside a theme allowing POST uploads and planting a ...
0
votes
1answer
36 views

RESTRICT EDIT of PHP files?

I wanted to restrict access to ALL Administrators to have access to EDIT any php file (Like Theme+plugin editor AND ETC..) I have developed a plugin, named System Edit Restriction. Currently, I use ...
0
votes
1answer
56 views

How many security plugins are too many? [closed]

I currently have three security plugins installed on WordPress, one of them I have a paid subscription to. Do you think this is overkill? I took a lot of steps to secure my WP site, and I'm worried ...
1
vote
0answers
74 views

How does the “authentication unique keys and salts” feature work?

I'm trying to find some information on how the authentication keys and salts work in WordPress, but unfortunately I wasn't able to find anything useful. All I got is that the keys should be random, ...
2
votes
1answer
25 views

Strange Search Queries in Apache Status

I am running a wordpress website with high traffic, my server load gets very high and while checking apache status i found flood of wordpress searches like this /?s=\"khabarnaak\"&id=39790 ...
4
votes
1answer
92 views

What security concerns should I have when setting FS_METHOD to “direct” in wp-config?

I have recently had an issue where I have been unable to install the WP Smush Pro plugin because I don't have the Manual Install or One-Click Installation options available. I came across this post ...
5
votes
1answer
97 views

What to use instead of wp_kses() in user output

I need some help here. While developing a theme, I want to make sure there are no security issues. So all dynamic data must be correctly escaped for the context where it is rendered. I know how to ...
0
votes
0answers
15 views

Get an email from a potential customer via Wordpress email function - And get a response for that email which isn't me!

I got an email via wp_mail function - that looks like a response to a customer asking foe a telephone number (using the email wordpress@exmaple.com). What are the odds that there might be hackers on ...
0
votes
0answers
54 views

Best way to handle unregistered users as a unique idenitifier

I have a voting system for specific type of posts (site), similar to reddit, and I want to allow unregistered users to vote. In order to keep the voting count as valid as possible, I am thinking ...
0
votes
3answers
124 views

Headers already sent error after upgrading wordpress to 4.2.2

in wordpress version 3.6 and 3.7 everything works great, but with version 4 and above I get: Cannot modify header information - headers already sent the problem line is: header('Location: '. ...
3
votes
1answer
74 views

Garbage in beginning of wp-config.php - was this WP installation compromised?

I hadn't realized that one of my WP sites wasn't being accessed in the last months, and consequently not being updated, and today I have found that my config.php has some garbage in the beginning of ...
0
votes
0answers
22 views

Output Encoding - Required or not for Security Reasons

I am using a very popular commercial theme and discovered, that they do no output encoding with esc_html/esc_attr/esc_url and so on on the "User Profil/Author" (when listing the authors on a ...
0
votes
1answer
298 views

Block access to wp-admin

I'm attempting to use a .htaccess file to block access to the wp-admin folder. I've read through the Brute Force Attacks doc (https://codex.wordpress.org/Brute_Force_Attacks) and I've added the block ...
0
votes
1answer
77 views

wp-content - permissions for files/folders created by apache

My wp-content folder has owner 'User' and group 'www-data'. The permissions are 775 for folders and 664 for files, so the server can write inside folder. But when the server creates folder and files ...
0
votes
1answer
53 views

WP upload/select image , isn't this a security issue?

If in image upload frame I select a zip http://prntscr.com/6ypjlv, it does not show it in list of files but it is up http://prntscr.com/6ypjvp shouldn't we only be able to upload image types if ...
0
votes
0answers
35 views

esc_url within iFrame

I'm building a WordPress theme. To improve security, I'm escaping any URLs, like so: <?php $background = wp_get_attachment_image_src(get_post_thumbnail_id($post->ID), '' ); ?> <div ...
0
votes
0answers
45 views

Hide username discovery

How do I stop my usernames being leaked? To explain I tested my WordPress site on http://wprecon.com, and found that my admin username (that I have changed) was able to be discovered. User ...
0
votes
2answers
61 views

Wordpress login security

I have put up a logging script on my wp-login page. I noticed that a particular ip address- 193.176.147.7 has been consistently visiting my login page for some days now. The vitis are always in quick ...
0
votes
2answers
71 views

Is it good security advice to install wordpress in subdirectory but link to root?

Is it good to install wordpress in a subdirectory (with a random name), but set "Homepage" address to domain root? (based on Giving WordPress Its Own Directory) Since the wp-content is in the ...
0
votes
1answer
150 views

Single sign-on: wp_authenticate_user vs wp_authenticate

I have a wordpress site (lets call it site1) and another site with oauth2 (site2). When a new user is created, a record is created in both site1 and site2 databases with the same email as username, ...
0
votes
1answer
44 views

The safest way to automate WordPress backups

I'm running over 20+ sites on a Linux shared cloud environment. At present, my hosting company performs daily, offsite backups. However, these are only kept for 30 days. This works great, but what ...
2
votes
1answer
48 views

How is password strength calculated?

A password, that contains: at least one capital letter, at least one small letter, at least one number and at least one non-alphanumeric character, is considered moderate to strong (sometimes even ...
0
votes
1answer
54 views

Completely remove the author url

I've already removed the login, registration, and password reset stuff. i also removed all links to the author url from single, archive, and index. now i want to remove the actual route so that bots ...
-1
votes
3answers
108 views

What techniques can a user employ to achieve a password rated “strong” in the WordPress password checker

I have strong passwords enforced for all my clients but I got some complaints recently as some users tried to change their password and gave up trying to achieve a strong rating. I was initially ...
1
vote
2answers
55 views

Disabling outbound connectivity on web servers [closed]

Is it a good idea to harden your web server by disabling outbound connectivity on them? I am using RHEL 7 for a WordPress Multisite installation. After disabling outbound connectivity, the dashboard ...
0
votes
2answers
94 views

How to change WordPress user ID?

Is this enough to change the user ID? I'm doing this for security purposes, where the administrator has user ID=1 and I want to keep all posts, pages and content. UPDATE wp_posts SET ...
0
votes
1answer
42 views

Updating From Mobile App - Exposing Site to Hacking

I have made a simple Mobile App to update a wordpress site. It starts with a login (to the app) and then with forms, sends data via POST method to a PHP file that then uses wp_insert_post, ...
0
votes
0answers
48 views

Post meta sanitization and escaping

I'm writing a plugin that adds a text meta box where user enters (supposedly) media URL, which then is displayed in posts with $featured_media = get_post_meta( $post_id, '_meta_key', true ); echo ...
0
votes
1answer
285 views

200 return code on 'POST /wp-admin/admin-ajax.php' while NOT logged in

I noticed the following log entry: 111.22.3.444 - - [13/Mar/2015:08:31:00 +0100] "POST /wp-admin/admin-ajax.php HTTP/1.1" 200 618 ...
1
vote
1answer
36 views

Failed login attempts

I'm using WordFence for site monitoring and overall security. I'm seeing some failed login attempts from a couple of different locations with username "admin" and "companyname". I'm not familiar with ...
0
votes
1answer
49 views

Finding where a snippet of code is coming from

I recently noticed that a site that I work on is making a call to an outside website on every page load. The following code is showing on every page: <script type="text/javascript" ...
0
votes
2answers
31 views

How can I force a specific password?

How can I force a specific password for a specific user & not let that user change their password? I have a client that thinks that even if I force strong passwords via this plugin: ...
-1
votes
1answer
23 views

Website that sells statistics

I'm building a website that will have statistics based on user activity on the website (online votes and views etc). People will have to pay to view those stats. I am utilising wodpress features ...