Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

0
votes
1answer
19 views

What is a PHP firewall plugin? [on hold]

I would like to know what do PHP firewall do and do they protect all wordpress sites even sites that are not written in PHP.
0
votes
0answers
12 views

Is it good practice to use WordPress nonce values to restrict page access?

I'm working with a colleague on a WordPress plugin. Part of the plugin functionality is showing dynamic lists with links which allow you to open a new page. Depending on the user's role, they may or ...
0
votes
1answer
14 views

Site is continuously accessing by several IPs

I have high traffic wordpress blog, but for last two days i am constantly getting the error "Error establishing a database connection". I have called to my hosting customer care and they are saying ...
0
votes
1answer
10 views

FORCE_SSL_ADMIN not working

Any ideas why define('FORCE_SSL_ADMIN', true); wouldn't work? I'm not getting any errors at all, but a http request to example.com/wp-admin isn't redirecting to https
0
votes
0answers
20 views

What is the best way to upload a temporary & sensitive file and then delete it when done

What is the best way to upload a temporary & sensitive file and then delete it when done. I'm writing a plugin (eventually for multisite) that allows users with a certain role to upload a .csv ...
0
votes
0answers
29 views

Why WordPress not logout after I have close my browser?

The default login cookie has expiry time as "session", so suppose when I close my browser, I need to login again when I visit wp-admin. But I've found that serveral time I've closed my browser (kill ...
0
votes
1answer
34 views

How do I properly update the Wordpress database password?

A site that I manage was recently compromised and I am going through the steps to harden and re-secure the site. I would like to change the MySql database password and want to make sure I do not take ...
0
votes
1answer
43 views

Found WordPress Site's Index.php File Changed / Spammed / Hacked - Where to Begin Inspection Procedure? [closed]

I saw that one of the sites I've been working on have it's index.php file changed with some weird code. Which is not a deliberate action of mine, then it means that someone has access to my hosting ...
0
votes
1answer
20 views

Why isn't the login page rate limited by default?

Brute force attacks seem to the be most common vulnerability on WP installs and rate limiting ought to be relatively easy to bake into WP itself as part of the official, default software (without the ...
0
votes
0answers
8 views

Does adding nonce in save_post hook for every metabox really improve security? [duplicate]

I see a lot of example [1] that introduce the checking of nonce in the save_post callback of a metabox. e.g. function smashing_save_post_class_meta( $post_id, $post ) { /* Verify the nonce before ...
0
votes
1answer
16 views

How to display post meta data in secure manner

I have have a custom post meta field where I can add a embedding code (a video for example, an iframe). Now I want to retrieve the code from the post meta and display it securely. I can display it ...
1
vote
1answer
80 views

Evaluations of two wordpress security plans against php code injection attack

Senario: I've posted one wordpress php code injection senario on SO before, ...
1
vote
1answer
26 views

Moving away from MD5: Where to declare the custom global $wp_hasher?

I want to move away from using MD5 for hashing passwords in the database. The plan is to declare a custom global $wp_hasher as hinted at in the docs for wp hash password(): Unless the global ...
0
votes
1answer
17 views

Custom RPC end-point security best pratice?

I trying to figure out how a custom entry point can be secured without loading the entire WP-stack. The built-in AJAX entry point is pretty slow and actually unusable on sites with lots of plugins. So ...
0
votes
0answers
10 views

How would I have to change rewrite rules to use a custom ms-files.php

I've previously wondered about securing file access by non-logged in users who know the full URL in multisite. When ms-files was still used modifications to this file allowed a basic form of WP-run ...
0
votes
2answers
57 views

How to create a private login page for admin.?

Can I create a login page, which could be entered all registered visitors, but were not allowed entrance to the administrator, even if he has entered the correct username and password? For admin I ...
0
votes
1answer
28 views

How can I save a password securely as a settings field

I have a plugin that requires the user to enter a password (to access an external site) into a form field on the plugin settings page. Right now this is just saved as plain text, but I need to make it ...
0
votes
1answer
31 views

wp_create_nonce function doesn't work inside a plugin?

I am writing a WordPress plugin which is creating a form in one of its functions. It looks like this (very simplyfied): class MyPlugin { public function createForm() { $nonce = ...
1
vote
1answer
41 views

Is it safe to allow non-admin users access to media uploader

Hi fellow Wordpress users :) I wanted to ask is it safe to allow non-admin users access to WordPress media uploader. Can they inject a virus while uploading media? How is WP system fighting against ...
0
votes
1answer
48 views

Should I use wp_nonce_field on my contact form?

I have created a self submitting contact form template and it works nicely, however when I was browsing the web in search for tutorials (for creating contact forms) I have noticed that some people ...
0
votes
1answer
104 views

How to secure or disable the RSS feeds?

I'm trying to set up WordPress as a CMS. As such, I want to disable the feeds since it's mostly a secured site. I've gone through all the Settings pages but found no setting to tweak or disable the ...
0
votes
0answers
30 views

Any way to disable /wp-login.php redirecting to the site folder?

We have our WP installs in folders on the server. We created folders called wp-admin and login to thwart hackers. However, incredulously, when you type in /wp-login.php it REDIRECTS to our ...
2
votes
5answers
346 views

Upgrading Wordpress 4.0 asks for FTP password

I was able to upgrade Wordpress 4.0 on my local machine, and I also just updated some plugins on the production machine, but when I try to update Wordpress 4.0 on the production machine, it is asking ...
0
votes
0answers
23 views

Storing Facebook page token in the options table

I developed on few wordpress sites, the ability to publish a post or page to facebook with custom values. I am on the process of turning my code into a plugin but I want to make it the good way. I ...
4
votes
1answer
252 views

Securing wp-admin folder - Purpose? Importance?

I am trying to understand how to secure a WordPress site. One security task I do not understand is...How important is it to protect the "wp-admin folder"? For example, I would consider limit login ...
0
votes
1answer
70 views

is_email() VS sanitize_email()

If I'm allowing a user to enter an email address to be saved into the database, should I use is_email() or sanitize_email()? Ex. update_user_meta( $user_id, $social_site, sanitize_email( ...
0
votes
0answers
19 views

How can I obscure the fact my site uses WordPress? [duplicate]

Is there anything I can do to prevent somebody from knowing my site is using WordPress by looking at the source code of the front page and trying to access the login page? I am referring to people who ...
3
votes
1answer
246 views

Security error WP 4.0 + WP phpBB Bridge [closed]

so today I updated to 4.0 (glad I had backup). Everything was working fine until I tried to publish a post. There I got Are you sure you want to do this. Also had Cheatin' Uh under ...
0
votes
0answers
112 views

Change Login URL Without Plugin

I want to change the login url of my Wordpress install away from /wp-admin.php I am aiming to do so and am looking at changing the .htaccess file to add in: RewriteRule ^login$ ...
10
votes
3answers
2k views

What could a hacker do with my wp-config.php

I am trying to secure my wordpress blog. I read some posts on the web that I should change my table_prefix and hide my wp-config.php. However, I do not get it? What could an attacker do with my ...
0
votes
1answer
27 views

Should I change the default file and folder permissions?

After reading the Hardening WordPress article I realise a good permission scheme is essential to the security of my WordPress installation. The article suggests a possible permissions scheme but my ...
1
vote
0answers
49 views

How do I get around “Sorry, this file type is not permitted for security reasons”?

I was wondering how I could allow .tiff files to be uploaded in my wordpress site. I get the message "Sorry this file type is not permitted for security reasons". This question has been asked in ...
7
votes
2answers
394 views

Why are passwords exportable as plain text in WordPress?

On my WordPress 3.9.2 installation can I extract the users plain text passwords by going to Users, select all users, and choosing Bulk Actions Export. When I look in the mySQL database with ...
5
votes
6answers
199 views

Share same domain for wp-admin but for different website

I have site like http://www.foo.com http://www.bar.com And I've a wildcard SSL cert *.example.com, instead of buying two SSL certs for the above two domains, can I re-use my existing wildcard SSL ...
0
votes
3answers
32 views

How can I restrict access to specific parts of a page, not just the page itself?

I looked at WP's site and didn't see a role I could use. I can create my own, but how do I limit the content on the page itself? Some private and some public information can be on the same page. I ...
0
votes
2answers
81 views

Is it necessary to use esc_url with template tags such as get_permalink?

I have been reading that sanitizing data output is important in theme / plugin development for wordpress. Is it necessary to use functions such as esc_url with template tags like get_permalink, or ...
4
votes
1answer
105 views

Why do I get accidental comments without (the required) email address?

Somebody translated one of my tutorials here (with my permission). All fine but I got comments that seem unintended on two of my tutorials that the translation links to. Now the weird thing is that ...
0
votes
2answers
28 views

Is there a way to remove the option to modify the Slug in post.php

I am trying to remove the option to edit the Permalink. I know how to hide it with CSS and I have. But a hacker could simply just go to Inspect Element and change display: none; to display: block; ...
1
vote
0answers
49 views

How to allow internal links using wp_kses filtration

I'm working on front end submission and of course I want to secure data by filtering before inserting to database. The form contains repeatable fields group data which I want filter by wp_kses ...
0
votes
0answers
31 views

Remove user credentials from GET or POST on login

This may be a totally noob question but... I noticed that, with the standard Wordpress install, it seems like one can obtain the user's login credentials just by viewing the GET and/or POST vars ...
1
vote
2answers
25 views

Would it be dangerous to send all the wp_options to javascript file?

I've noticed that wordpress allows me to send the wordpress options to javascript via wp_localize_script: wp_localize_script( $this->plugin_slug . '-plugin-script', 'wp_options', ...
2
votes
1answer
99 views

Security around save_post hook

There are a lot of examples using the save_post hook, that include adding and verifying a nonce, and checking the user has appropriate permissions before you continue. Is this necessary? When ...
4
votes
1answer
116 views

Run WordPress frontend and backend in different domains

I want to run my WP frontend as www.example.com and my backend (i.e. wp-admin) as user1.example.org, is it possible? The reason is I want to host lot of sites in a single server which has only 1 IP ...
0
votes
0answers
57 views

How to escape custom css?

I'm creating a WordPress theme in which I've allowed users to add some custom css from the Theme Options. This css code then directly gets echoed out in the head section of the page, with the ...
4
votes
2answers
1k views

wp.getUsersBlogs XMLRPC Brute Force Attack/Vulnerability

After the holiday weekend, one of the larger sites I manage had a brute force attack on it. The attacker was attempting to use the wp.getUsersBlogs function and a list of popular usernames and ...
2
votes
1answer
96 views

WordPress salts set in config and database

I have come across the following code in a new clients existing website in wp-config.php define('AUTH_KEY', 'put your unique phrase here'); define('SECURE_AUTH_KEY', 'put your unique phrase ...
0
votes
1answer
89 views

Which WordPress scripts need to be executable for a fresh installation?

For security reasons I need to block access to scripts that will not be executed on a fresh WordPress installation. Example: /index.php --> needs to be executable /wp-includes/cache.php --> should ...
0
votes
0answers
37 views

Background Updates Not Happening

I have some sites which are not updating with the background updater. I installed the Background Update Tester plugin and everything looks fine. Currently they are at 3.9 but they are telling me that ...
2
votes
0answers
18 views

hSite has no css on mobile [closed]

Our WP site got hacked and we've been working with our hosting to clean all malware etc. However, now the site appears on desktop fine, but on mobile it looks as though all the css is stripped. ...
3
votes
1answer
497 views

Is it true $wpdb->get_results is faster than WP_Query in most cases?

On my homepage, I have a section where I have to display the last five featured posts, where a featured post is simply a post with a custom field is_featured set to 1. I achieved what I want with two ...