Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

0
votes
2answers
15 views

Is there a way to remove the option to modify the Permalink in post.php

I am trying to remove the option to edit the Permalink. I know how to hide it with CSS and I have. But a hacker could simply just go to Inspect Element and change display: none; to display: block; ...
-1
votes
0answers
7 views

Wordpress Complex User Registration Plugin [on hold]

I'm new in Wordpress and I am looking for a complex user registration & profile editing plugin, which: 1) have security features (captha, ciphered passwords...) 2) it is possible to create ...
-2
votes
1answer
16 views

W3 Total Cache Security issue [on hold]

I've installed and configured the W3 Total cache plugin. Then I tried to access my website from a Chrome browser window (logged in as administrator). All is fine. Then, in a Firefox browser window, ...
0
votes
0answers
10 views

I changed login page url with WP security, and now i can't acces it? [on hold]

I changed my login page url, with WP security. Now when I enter the secret url, I'll come just to the home page. How do I do my login page again, to localhost/wordpress/wp-admin/ How do iget the ...
1
vote
0answers
35 views

How to allow internal links using wp_kses filtration

I'm working on front end submission and of course I want to secure data by filtering before inserting to database. The form contains repeatable fields group data which I want filter by wp_kses ...
0
votes
0answers
17 views

Remove user credentials from GET or POST on login

This may be a totally noob question but... I noticed that, with the standard Wordpress install, it seems like one can obtain the user's login credentials just by viewing the GET and/or POST vars ...
1
vote
2answers
21 views

Would it be dangerous to send all the wp_options to javascript file?

I've noticed that wordpress allows me to send the wordpress options to javascript via wp_localize_script: wp_localize_script( $this->plugin_slug . '-plugin-script', 'wp_options', ...
2
votes
1answer
63 views

Security around save_post hook

There are a lot of examples using the save_post hook, that include adding and verifying a nonce, and checking the user has appropriate permissions before you continue. Is this necessary? When ...
-3
votes
0answers
25 views

Securing my website [closed]

I use the wordpress script in my website , and I want to make it secure , I have very sensitive data, I know people who use the wordpress script and were easily hacked,i want a list of the cheap ...
3
votes
1answer
52 views

Run WordPress frontend and backend in different domains

I want to run my WP frontend as www.example.com and my backend (i.e. wp-admin) as user1.example.org, is it possible? The reason is I want to host lot of sites in a single server which has only 1 IP ...
0
votes
0answers
21 views

How to escape custom css?

I'm creating a WordPress theme in which I've allowed users to add some custom css from the Theme Options. This css code then directly gets echoed out in the head section of the page, with the ...
3
votes
2answers
205 views

wp.getUsersBlogs XMLRPC Brute Force Attack/Vulnerability

After the holiday weekend, one of the larger sites I manage had a brute force attack on it. The attacker was attempting to use the wp.getUsersBlogs function and a list of popular usernames and ...
2
votes
1answer
55 views

WordPress salts set in config and database

I have come across the following code in a new clients existing website in wp-config.php define('AUTH_KEY', 'put your unique phrase here'); define('SECURE_AUTH_KEY', 'put your unique phrase ...
0
votes
1answer
34 views

Which WordPress scripts need to be executable for a fresh installation?

For security reasons I need to block access to scripts that will not be executed on a fresh WordPress installation. Example: /index.php --> needs to be executable /wp-includes/cache.php --> should ...
0
votes
0answers
26 views

Background Updates Not Happening

I have some sites which are not updating with the background updater. I installed the Background Update Tester plugin and everything looks fine. Currently they are at 3.9 but they are telling me that ...
2
votes
0answers
16 views

hSite has no css on mobile [closed]

Our WP site got hacked and we've been working with our hosting to clean all malware etc. However, now the site appears on desktop fine, but on mobile it looks as though all the css is stripped. ...
3
votes
1answer
93 views

Is it true $wpdb->get_results is faster than WP_Query in most cases?

On my homepage, I have a section where I have to display the last five featured posts, where a featured post is simply a post with a custom field is_featured set to 1. I achieved what I want with two ...
0
votes
0answers
19 views

Folder Permissions + Security Concerns

I messed up bad guys. I while working on another part of my website I accidentally nuked my WordPress folder permissions. I was able to find/fix some problems and I got my site up and running but some ...
2
votes
1answer
44 views

Enforcing password complexity

We need to enforce password complexity in a wordpress site, we used this article: http://www.webtipblog.com/force-password-complexity-requirements-wordpress/ We created the following in ...
3
votes
1answer
64 views

What are the security reasons to disallow Microsoft Word uploads?

When I try uploading a .doc or .docx file I get this message: Sorry, this file type is not permitted for security reasons What are the security risks involved in a multisite installation ...
0
votes
1answer
15 views

Validating values using Settings API?

I'm using the Settings API to create options for plugin. Do I need to validate the input values for the security (for example stripslashes etc)? (I could not find that part in most of the tutorials). ...
0
votes
1answer
65 views

using .htaccess only for wordpress security no plugins

Right now I am using bulletproof wordpress security for my websites, but when i am installing W3 Total Cache plugin it gives me some errors related to .htaccess file and bulletproof wordpress security ...
0
votes
0answers
15 views

How to get WP to run plugin code triggered by an external site hook?

I have written a plugin to sync data from a WP blog to an external website. Changes to made to the external site also sync back to the WP blog. Right now the external website executes a POST request ...
0
votes
0answers
42 views

WordPress it's cleaning a custom query_var to avoid sql injections?

I am using get_query_var function to get a custom query_var. This query_var will be used later in to query arguments to retrieve posts with: $the_query = new WP_Query( $args ); . My question is, ...
0
votes
0answers
56 views

How can I safely use $_SERVER['REQUEST_URI'] to avoid XSS?

I've seen a lot of warnings about using $_SERVER['REQUEST_URI'] because it can open things up to XSS, but I haven't been able to find anything confirming a safe way to use it. Some people have ...
0
votes
0answers
55 views

SWF in wordpress post

My question is somewhat a two part question. First I embedded a SWF file into my blog post using Easy Flash Embed plugin. It shows up on my desktop computer but when I view the post on my mobile ...
0
votes
1answer
41 views

Session Cookie security questions

I am a .NET developer but I also administer all of our corporate websites, which are all Wordpress. I inherited the sites from someone who is no longer at my company. My company recently spent a ...
0
votes
1answer
28 views

wordpress admin security

I scan my website using different tool but it shows no malicious script. But when i see in admin dashboard i see strange symbol square below body tag. i tried to check admin index file,root index ...
1
vote
0answers
18 views

Securing a multi-user permission structure

I'm currently working on a team that needs two distinct users from the same wpadmin group to be able to modify the wordpress files. Following the guide at Hardening WordPress (Codex), the following ...
0
votes
1answer
18 views

404 errors in log showing urls with 'GET', plus and numerical code

My wordpress logs show 404 errors to URLs having the following pattern: http://example.com/path/++GET+http:/example/+0,48595,73506+- Web searches do not return answers because of the plus and minus ...
0
votes
0answers
64 views

wp-config.php file and code injection

It looks like several my sites on BlueHost got code injection in the wp-config.php file. Injected code itself looks like Any clue where it comes from? BH malware scan doesn't recognize that code so ...
1
vote
0answers
40 views

Strategies for coping with hyperagressive spambots?

A couple of my sites are getting slammed by a hyperagressive distributed spambot. It's just pure link spam. It all comes from one user name, but from a variety of IPs. Akismet is catching the spam, ...
1
vote
1answer
32 views

Restrict custom post type from appearing with ?post_types=

When appending the querystring post_types = "name of your post type", it displays all the posts. I am using a plugin that has its own custom post type which is restricted (only users that have ...
0
votes
2answers
22 views

Regarding plugin security

Is there any guarantee that the plugins I find on the wordpress site are legitimate and don't have any malicious code in them? Or is it up to me to check them? If so, what would be the best way to do ...
3
votes
3answers
100 views

How to Block Access to Standard Login Flow and Comment Flow

I've set up custom flows on my Wordpress blog for login, signup, and commenting. I would like to password protect the standard login flow so only I can use it, and block access entirely to the ...
2
votes
0answers
175 views

How to get WordPress to save upload file beyond web root

I am using nginx on a multisite install. I am trying to get WordPress to save uploads to a folder beyond the webroot : /home/mydomain/file_secure as opposed to ...
2
votes
1answer
231 views

When to use esc_html and when to use sanitize_text_field?

It seems that they do almost same type of job. So... When should I use esc_html() instead of sanitize_text_field()?
1
vote
1answer
159 views

Is wp_nonce_field vulnerable if you know the action name?

Is wp_nonce_field vulnerable if you know the action name? I am actually adding a hidden field with name = the name of the action name in my form so that my plugin can identify it. I want to know if ...
0
votes
1answer
34 views

How can I create a private site that is inaccessible from the outside?

I need a safe place where I can store data about projects that I am working on. This data includes text and files (pictures, sound and video). I want to create a private "blog" for this purpouse that ...
0
votes
0answers
30 views

How to force two-step authentication with Jetpack?

I'm using Jetpack's SSO module for two-step authentication, but it's not what I thought. I can still simply login via the login form withing going into authentication. It's only calling for two-step ...
0
votes
1answer
101 views

Troll the hackers by redirecting them

My website is getting somewhat popular, and with the it's increasing popularity there's an increase in the hackers. Last night I visited my security logs and found that everyday approximately 10 ...
2
votes
1answer
98 views

Is $wpdb->prepare escaping to much? How to use it properly?

Im pretty much confused by $wpdb->prepare. I want to use it to sanitize user input but it turned out that it destroys the query. I cannot imagine that this is how it's intended to work but I can't ...
4
votes
2answers
204 views

Is WP vulnerable when updating plugins or themes?

Once, I had a problem that somehow someone managed to change files of my website without FTP or SSH credentials. Probably he got in through WP (probably it wasn't a 'he', but an 'it', a bot), we said ...
0
votes
2answers
32 views

How to give the same error message when the wrong password or wrong username is used?

For security reasons, my WordPress instance should give the same error message when an incorrect password or wrong username is used. How can it be done?
0
votes
0answers
8 views

xmlrpc.php act as threat to wordpress security? [duplicate]

please could any one suggest what are the necessary steps needs to make wordpress sites more secure. i know it is kind of general question but still if still any hacks which improves security of ...
0
votes
0answers
83 views

Can I make an ajax response cross-domain?

I am trying to make a single ajax response cross-domain. Is that possible? I tried something like this, but that did not work: function my_call_callback() { header("Access-Control-Allow-Origin: ...
0
votes
1answer
29 views

Secure my “add_settings_field” translation?

I am using "add_settings_field" and want to provide translation for it , but my problem is security. So is __('My Checbox:' , 'domain') secure enough for translation? If not what can I do about it? I ...
0
votes
0answers
52 views

Wordpress exploited theme is causing high io load on server

I used a Wordpress theme for a while that was causing high IO-load on my server. That was because there was some kind of exploits made/available for the theme: ...
0
votes
0answers
41 views

reCAPTCHA is not visible on comments loaded via ajax

I've a php template loaded on a popup and this template should contain on the bottom the possibility for a user -logged in or not- to write comments. for security reasons it was installed the plugin ...
0
votes
0answers
36 views

Changing WP location and wp-content folder name witouth loosing SEO

I'm trying to make my site the most efficient way as possible, and I find out thant changing lot of things in permalinks , security folders , etc, works pretty well. But what happen if the WP, is ...