Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

0
votes
0answers
5 views

Error on Wordpress Login

I am editing my wordpress site before and nothing is wrong until I change my ISP then this error came out when I try to login on my site: Not Acceptable! An appropriate representation of the ...
1
vote
1answer
25 views

WordPress Front end Form - Enable to Submit PHP Codes

I just create a front end form to submit posts for public persons. It works fine. I need to allow to submit PHP codes (because it is PHP tutorial site) via that form. I need to make sure it not ...
-2
votes
0answers
18 views

Is there way to check website is WordPress or not? [duplicate]

Is there way to check website is build by WordPress or not? URL : http://mashable.com/ - Return True URL : https://google.com - Return False
-1
votes
0answers
17 views

Changing php version breaks login

I'm using wp_login_form within a custom widget on a website I am working on and it works great when I'm using php5.3. When I use anything newer, the login form stops working. My question is, does ...
2
votes
1answer
30 views

Staging Site: Made Public - Security Questions

Previously, our staging site has been locked down to local access only. We hired a third party developer to assist with resolving a theme via our 'local staging server' remotely. In order to grant ...
3
votes
1answer
40 views

Is sanitize_text_field() is enough to save to DB?

So here is the situation. We allow users to enter input data, i.e. user_first_name and user_additional_comments. Then we use sanitize_text_field() , which is named as save. But after this filter: ...
0
votes
2answers
41 views

How to connect my wordpress plugin to a remote database securely?

First of all I do not have a lot of experience with wordpress plugins, but I am developing a plugin which has to connect and send data to a remote database ( which it is already doing ). But at this ...
1
vote
2answers
43 views

How to safely allow user upload on CPTs?

I have a form with a WP Media to allow user uploads for a custom post type on the front end. Every time I try to upload as a user I can the message You don't have permission to attach files to this ...
0
votes
1answer
35 views

Load all files from folder in theme – Security concerns?

I'm using this code below in a config file to automatically require other PHP files in the same directory and in subdirectories. This helps my work flow become more efficient. I'm concerned that I ...
1
vote
0answers
37 views

How do I authenticate WP users from a chrome extension?

I'm new to WordPress, and I need help. I am writing a chrome extension and intend to use wordpress as the user database. I intend that because I'm using a subscription management WP plugin that keeps ...
0
votes
3answers
41 views

Limit Login Attempts BEFORE PHP is executed?

I manage multiple WordPress installs (all related/cross-linked) and I've been getting hit hard with brute force attempts for the past few weeks, enough to crash my servers on multiple occasions. I ...
1
vote
1answer
32 views

Verify if user is wordpress logged in from another app since wordpress 4.0

I try to implement in my Node.js app a way to verify if the user cookie is valid. I've found some post in internet who explain me very well the things, but as i try to implement it, with the ...
7
votes
1answer
163 views

Improve wordpress security by hiding non public resources

I'm new from wordpress and i want improve security of wordpress multisite by hiding non public resources, eg. wp-admin, wp-config etc. My setting seem to work, but i don't know if this setting can ...
2
votes
0answers
30 views

How to implement secure frontend image upload? [closed]

I would like to implement an public image upload in my Wordpress Theme with ajax. What's the secure way to do this? I have read many about security problems when allow users to upload files to the ...
1
vote
1answer
43 views

<meta name=“generator” content=“WordPress 4.4.2” /> neccessary?

Hello fellow WordPressers Today, I realized that most WordPress sites have this small footprint saying: <meta name="generator" content="WordPress 4.4.2" /> where it indicates what "system" ...
0
votes
0answers
25 views

Sanitization Function in Wordpress (Example Twentyfifteen.1.4 Default WP Theme)

The ThemeForest Submission Requires some sanitization functions that should be incorporated in the theme - This page says this. The WordPress theme should make use of the following inbuilt ...
3
votes
1answer
36 views

Extra themes - ok or bad?

I know I am a newbie here, but I'm just wondering, if you keep extra themes in your Wordpress setup, will it add bloat to your site? Can these other themes provide a security risk even if they aren't ...
0
votes
2answers
31 views

Using an Encryption class in a WordPress Plugin

I'm making a WordPress plugin that works with sensitive data. So I need to store/retrieve date with a trusty encryption method. I did some searches among many php encryption wrapper classes, and ...
0
votes
2answers
42 views

Correct and safe way to include php content in my page

I have a website where I use [insert_php] to insert php content to my page. What I do is simply use php's include inside insert_php to include my complex php script. I asked a question a while ago, ...
0
votes
2answers
54 views

Filter and validate user role in registration

I want to show a select box for user roles in the registration form. I am using this model: /* ROLES IN LIST REGISTRATION */ // 1. Add a new form element... add_action( 'register_form', ...
0
votes
2answers
53 views

Relative security of different releases of WordPress

Since each major-version of WordPress (like 4.0 or 4.4) gets its own series of security updates (currently 4.0.10 or 4.4.2), are the updated newer major-versions significantly more secure than updated ...
0
votes
0answers
19 views

Wordpress security - hiding WordPress directory [duplicate]

Note: edited my post to make it more "is it useful?" than "how to do it?" after toscho marked it as duplicate (the post tosho referenced is more or less what I had in mind for the "how to do it" ...
0
votes
0answers
23 views

About plugin security

I'm developping a couple of simple plugins for specific use, and want to do it right. I've read multiple pages about plugin security, including those. Now, considering that my plugins have for ...
0
votes
1answer
26 views

Is it safe to give wordpress directories ownership to www-data?

I am not server or security expert so please excuse if my question sounds odd. I am running wordpress site on ubuntu 14.04 with nginx server. I had a problem while installing new plugin, So I have ...
1
vote
0answers
15 views

Are there security risks in working directly in the themes folder that builds into a theme folder?

I'm wondering if there are any security risks in using the wp-content/themes/ folder as my project root and using wp-content/themes/my-theme as my build folder. Basically, in the themes folder I would ...
0
votes
1answer
17 views

Dangers to allowing Access-Control-Allow-Origin: * for Feeds only?

I want to use a function like this to allow access to the feeds from a variety of services but my knowledge of the security implications is limited. I think I'm being safe by limiting the access to ...
0
votes
0answers
15 views

Logout via Subdomain, non-wordpress page on a different server?

Similar to the question over at Get wp_logout_url function to work on external (non-Wordpress) page The problem I am facing is the fact the subdomain is on a different server so I am unable to ...
1
vote
1answer
63 views

Should I Worry About SQL Injection When Using wp_insert_post?

I have created a form to insert posts via front-end to users. I use wp_insert_post function. Should I worry about SQL injection or Does wp_insert_post function handle it?
1
vote
1answer
32 views

Frontend Password change

First off, I apologize if there is a duplicate of this roaming around somewhere...I have spent the better part of the past hour looking for the solution, with no luck, but maybe I just suck at picking ...
1
vote
1answer
211 views

Security issues with WP sites

I have just had to deal with a few of my WordPress websites being hacked. First time put an index.html file in the cpanel of each site and replenished my admin user. Once I felt I cleaned this up, ...
1
vote
3answers
343 views

Best way to eliminate xmlrpc.php?

What is a best way to eliminate xmlrpc.php file from WordPress when you don't need it?
0
votes
0answers
26 views

Upload file via settings page

Question: Is there a secure way to upload files via a plugin settings page? Context: Hello world! A feature of my plugin requires the user to upload one or more files. More precisely, JSON files ...
5
votes
3answers
145 views

Are the default salts secure?

When installing a fresh wordpress, one of the things one should do is, updating the salts in wp-config.php. The section looks like this define('AUTH_KEY', 'put your unique phrase here'); ...
0
votes
1answer
24 views

What is more secure checking capabilities of user or checking role of user in WordPress plugin development

Suppose I need to check the logged in user is subscriber not anyone else. So if I check the capability like "read". Then subscriber is OK but "read" capability is also associated to admin/publisher as ...
2
votes
1answer
50 views

Is revealing just the AUTH_KEY a security issue?

I am troubleshooting a Wordpress plugin issue. It is a plugin that generates a zip file of existing files on the server and returns a link to download the file. The plugin ...
0
votes
2answers
54 views

Wordpress restrict plugin file direct access

i am developing a wordpress plugin, but before that i have checked the code for the few plugin already developed. I have seen a common approach to restrict the direct where the plugin developer starts ...
0
votes
1answer
21 views

Make “default” wordpress pages & features unaccessible

I am trying to create specific password-protected mini-sites (single wordpress pages) for specific users or specific passwords to be precise. For example someone clicks the url domain.com/url1 and if ...
0
votes
0answers
15 views

Cross site domain cookies in Wordpress (v4.x)

I have a plugin that executes an external script (outside of Wordpress) that i'd like to make 'more secure'. I'd like to make this script only accessible/executable when logged in as the Wordpress ...
4
votes
2answers
63 views

Escaping built-in WP function return strings

Should one filter the output of builtin WP functions such as get_permalink() and well-known WP plugins such as ACF (Advanced Custom Fields) such as get_field()? For instance get_permalink() calls ...
2
votes
0answers
60 views

Does Wordpress contain “default” anti-SQL injection code that responds with a 404 error?

I've been through the “seven layers of the candy cane forest” on this one… :) Our plugin receives data via a POST request. On a particular site that has our plugin installed, we observed odd ...
0
votes
0answers
24 views

Vanilla Wordpress install, what can/should I put in disable_functions?

I would like to take steps to limit the damage a compromised Wordpress install can cause on the rest of my system. What system calls does Wordpress need? What can I put in the disable_functions ...
0
votes
1answer
26 views

How do I diagnose a plugin resource 404?

I'm doing some work for a new client (non-tech, their former tech person left). Their version of Wordpress is 4.3.2. The site gets some JavaScript errors on load. Using the Console I noticed two ...
2
votes
1answer
57 views

Do you need to escape hard coded plain text?

I started playing with the Underscores starter theme and noticed it uses esc_html_e() even on plain text: <a class="skip-link" href="#content"><?php esc_html_e( 'Skip to content', '_s' ); ...
1
vote
1answer
37 views

Using esc_url with a hard coded url

I've added following URL in my theme, but I have been informed that I must use esc_url(). I could not figure out, how can I use that function with following code? <a ...
0
votes
0answers
43 views

PHP Code Sniffer - WordPress VIP Coding Standards

I'm trying to fix up my code to meet the WordPress VIP Coding Standards. I'm getting a couple of issues that I'd like to see go away, but i'm not sure what the best strategy is. The first issue is ...
0
votes
2answers
72 views

Security: blocking direct access of php files

I found 2 ways to block direct access to php files (although it's not always necessary, see http://wordpress.stackexchange.com/a/63004/60539) The first one is: defined( 'ABSPATH' ) or die( 'No script ...
2
votes
2answers
46 views

Is the “lost password” feature truly a vulnerability?

Disabling Password Resets I've come across numerous security hardening articles relating to various measures for disabling password resets (i.e. lost password retrieval). ...
1
vote
1answer
24 views

Handling email piping attachments and detecting unsupported file types

I have a plugin that I am working on which uses Email Piping. When an email is processed I want all the attachments from the email to be added to the WordPress Media Library. Currently I am using ...
0
votes
1answer
19 views

Webservice credential storage [duplicate]

I am developing a plugin that calls a web-service with a security header. Can anyone recommend a best practice for storing those credentials on the WordPress site? Right now my best option seems to be ...
0
votes
1answer
21 views

Adding Security Keys?

I read the paragraph at the codex on Security Keys. It offers the example - define( 'AUTH_KEY', 't`DK%X:>xy|e-Z(BXb/f(Ur`8#~UzUQG-^_Cs_GHs5U-&Wb?pgn^p8(2@}IcnCa|' ); define( ...