Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

0
votes
1answer
17 views

Remove tinyMCE from admin and replace with textarea

I have created a plugin wherein I have a custom post type. I am using post_content for some simple text. I do not need to offer any fancy editing or insertion of data for this field, so I looked for a ...
0
votes
0answers
17 views

Server misconfiguration- Protect WordPress core files correctly from being called directly?

With a fresh WordPress 4.3 installation I have the following problem: If I call URLs like http://www.example.com/wp-admin/menu.php the script is executed directly. Is this a security issue which ...
3
votes
2answers
68 views

Is /wp-login.php?redirect_to[] exploitable?

I have a wordpress site, against which I ran a penetration testing tool (debug mode was on at the time) It reported a (medium severity) issue in that errors were being displayed, and cited ...
1
vote
1answer
14 views

How to delete Passwrd Protected posts cookies when a user logged out from the site

I wanted to delete all the cookies set for password protected posts when user logged out from the site after going through those Password protected posts. Is there any function to do this?
0
votes
0answers
13 views

wordfence reports exploited files but nothing visible when I edit file on server

Wordfence is reporting exploit code on some of the empty idnex.php files asswell as wp-config.php but when I access these files via ssh I see no malicious code. Wordfence reports this malicious code ...
0
votes
0answers
10 views

Is wp_kses safe against XSS

Is this code safe against complex types of XSS attack? $v = wp_kses(esc_attr( $bad_input ), $allowed); where $allowed = array( 'a' => array( 'href' => array(), 'title' ...
0
votes
1answer
25 views

Can't reset WordPress password

I haven't logged onto my blog for years, and have, of course, forgotten the password. I click the 'Forgot' button and get a mail with a link, but that mail already says Sorry, that key does not ...
0
votes
1answer
37 views

How to check plugins for malicious code?

Our new hosting company ran a security check on our installation and I was very surprised to hear that a premium plugin we had purchased (Easy Media Gallery Pro) contained malicious code. (It may ...
0
votes
2answers
19 views

Is wp_login_form secure on a non secure page?

I am using the wp_login_form on a non-secure (http) website. The form is in a modal window, so that you can log in from any page on the website. Is using the wp_login_form() in this way safe? Thanks, ...
0
votes
1answer
16 views

Changing Table Prefix for an Existing WordPresss Site

Hoping someone can assist with Wordpress table prefix for an already established site. What is the best approach in changing the existing table prefix within both DB and wp-config file to reflect new ...
1
vote
0answers
16 views

Underscore Based Theme File Permissions in Git

I'm using underscores to develop my theme. For some reason git is saying that my file permissions are being changed from 10644 to 10744. I can override this in git's settings this but is it safe for ...
0
votes
0answers
17 views

How to make READ ONLY on the FILE System?

Let's say the WP site is under attack. Then we want to prevent any FILE WRITINGS, including: Uploading of the New Files Any way of WRITING the new files into file system So that the System is very ...
0
votes
1answer
34 views

Suspicious lines of code

Our company website was handed to me and source code was created by previous person. I noticed that there are lots of . I am getting suspicious with these I have the urge to delete these 18 lines of ...
0
votes
0answers
8 views

What is wp-admin/strebam_filter_register.php file?

I ran Sucuri Security integrity check for one of my wordpress websites which had been compromised by malware. I found two suspicious files: wp-admin/strebam_filter_register.php and ...
0
votes
1answer
17 views

Password-protect feed and make it usable in major aggregators

A WordPress site I'm on uses WordPress's default cookie-based authentication. This means that the RSS feed of the page is password-protected and can only be read when the cookie is available. ...
0
votes
0answers
59 views

WordPress Malware - File replacement issue

I'm facing issue of files replacement, modified and newly added similar to this source https://blog.sucuri.net/2015/03/pseudo-darkleech-server-root-infection.html How to identify its backdoor? (I ...
0
votes
0answers
20 views

WordPress and user security

When we talk about Information Security, many things come into mind and people tend to use CMS to be clear on security as CMS people do the job for you, in terms on hashing passwords, encryption etc. ...
2
votes
1answer
47 views

Is it safe to enqueue a font style without putting http or https?

I have seen a few WordPress sites and tutorials enqueuing fonts like this. Does this work with http and https sites? Is it safe to do this? I see these exact URL's in the source code when testing ...
0
votes
0answers
13 views

Force reauthentication/login for specific page for currently logged in users

I have a page that searches user information. The site is a record keeping site. I want it so that when people click the "View Records" link that they mus re-authenticate before proceeding. I'm not ...
2
votes
2answers
95 views

Is security a problem in Wordpress?

I am going to start a big corporate website for his car shop which is supposed be more secured. Is Wordpress okay to start a secured and reliable website? As far as i heard, Wordpress hackers ...
0
votes
0answers
40 views

How to set up fail2ban with WordFence?

I found a blog post that talks about setting up Wordfence and fail2ban but it's quite useless as there is no mention of any technical activity. Only that it took the author a total of 5 hours. I ...
0
votes
2answers
24 views

Secure Multiple WordPress Installations on shared hosting

Most shared hosting packages store all files of a given user under something like /user/myuser/www/ or /var/html. Addon domains are usually located under /var/html/domain1.com/, ...
0
votes
0answers
8 views

XSS Scripting in Cache files

On one of my client's sites I was going through a few of the pages ann noticed a popup appear with a spam advert on it. Finding this highly unusual I inspected the page source and found a bunch of ...
11
votes
1answer
682 views

For what security reasons are svgs blocked in the media uploader?

I see that SVGs are blocked by default in the media uploader and you have to add it as a supported MIME type in functions.php. What security reasons are behind this?
2
votes
1answer
40 views

Whats the safest way to output custom JavaScript and Css code entered by the admin in the Theme Settings?

I'm creating a theme in which I've created options for the admin to enter custom Javascript and Css code in the "Theme Settings" page (created using Options API). Now I'm just not sure how to output ...
1
vote
0answers
22 views

What is the purpose of having a token in cookies?

WordPress utilizes cookies for better security, and I've been trying to understand how exactly this could make a WordPress website more secure, and I found this article . There's a pretty decent ...
-3
votes
1answer
62 views

How to make a WordPress site unhackable (except during during upgrade/plugin update)?

We've had numerous cases where client's WordPress based sites have been hacked due to various reasons, mostly related to a unsecured PHP file inside a theme allowing POST uploads and planting a ...
0
votes
1answer
38 views

RESTRICT EDIT of PHP files?

I wanted to restrict access to ALL Administrators to have access to EDIT any php file (Like Theme+plugin editor AND ETC..) I have developed a plugin, named System Edit Restriction. Currently, I use ...
0
votes
1answer
62 views

How many security plugins are too many? [closed]

I currently have three security plugins installed on WordPress, one of them I have a paid subscription to. Do you think this is overkill? I took a lot of steps to secure my WP site, and I'm worried ...
1
vote
0answers
110 views

How does the “authentication unique keys and salts” feature work?

I'm trying to find some information on how the authentication keys and salts work in WordPress, but unfortunately I wasn't able to find anything useful. All I got is that the keys should be random, ...
2
votes
1answer
25 views

Strange Search Queries in Apache Status

I am running a wordpress website with high traffic, my server load gets very high and while checking apache status i found flood of wordpress searches like this /?s=\"khabarnaak\"&id=39790 ...
4
votes
1answer
140 views

What security concerns should I have when setting FS_METHOD to “direct” in wp-config?

I have recently had an issue where I have been unable to install the WP Smush Pro plugin because I don't have the Manual Install or One-Click Installation options available. I came across this post ...
5
votes
1answer
116 views

What to use instead of wp_kses() in user output

I need some help here. While developing a theme, I want to make sure there are no security issues. So all dynamic data must be correctly escaped for the context where it is rendered. I know how to ...
0
votes
0answers
16 views

Get an email from a potential customer via Wordpress email function - And get a response for that email which isn't me!

I got an email via wp_mail function - that looks like a response to a customer asking foe a telephone number (using the email wordpress@exmaple.com). What are the odds that there might be hackers on ...
0
votes
0answers
60 views

Best way to handle unregistered users as a unique idenitifier

I have a voting system for specific type of posts (site), similar to reddit, and I want to allow unregistered users to vote. In order to keep the voting count as valid as possible, I am thinking ...
0
votes
3answers
142 views

Headers already sent error after upgrading wordpress to 4.2.2

in wordpress version 3.6 and 3.7 everything works great, but with version 4 and above I get: Cannot modify header information - headers already sent the problem line is: header('Location: '. ...
3
votes
1answer
76 views

Garbage in beginning of wp-config.php - was this WP installation compromised?

I hadn't realized that one of my WP sites wasn't being accessed in the last months, and consequently not being updated, and today I have found that my config.php has some garbage in the beginning of ...
0
votes
0answers
22 views

Output Encoding - Required or not for Security Reasons

I am using a very popular commercial theme and discovered, that they do no output encoding with esc_html/esc_attr/esc_url and so on on the "User Profil/Author" (when listing the authors on a ...
0
votes
1answer
529 views

Block access to wp-admin

I'm attempting to use a .htaccess file to block access to the wp-admin folder. I've read through the Brute Force Attacks doc (https://codex.wordpress.org/Brute_Force_Attacks) and I've added the block ...
0
votes
1answer
105 views

wp-content - permissions for files/folders created by apache

My wp-content folder has owner 'User' and group 'www-data'. The permissions are 775 for folders and 664 for files, so the server can write inside folder. But when the server creates folder and files ...
0
votes
1answer
62 views

WP upload/select image , isn't this a security issue?

If in image upload frame I select a zip http://prntscr.com/6ypjlv, it does not show it in list of files but it is up http://prntscr.com/6ypjvp shouldn't we only be able to upload image types if ...
0
votes
0answers
35 views

esc_url within iFrame

I'm building a WordPress theme. To improve security, I'm escaping any URLs, like so: <?php $background = wp_get_attachment_image_src(get_post_thumbnail_id($post->ID), '' ); ?> <div ...
0
votes
0answers
53 views

Hide username discovery

How do I stop my usernames being leaked? To explain I tested my WordPress site on http://wprecon.com, and found that my admin username (that I have changed) was able to be discovered. User ...
0
votes
2answers
65 views

Wordpress login security

I have put up a logging script on my wp-login page. I noticed that a particular ip address- 193.176.147.7 has been consistently visiting my login page for some days now. The vitis are always in quick ...
0
votes
2answers
83 views

Is it good security advice to install wordpress in subdirectory but link to root?

Is it good to install wordpress in a subdirectory (with a random name), but set "Homepage" address to domain root? (based on Giving WordPress Its Own Directory) Since the wp-content is in the ...
0
votes
1answer
170 views

Single sign-on: wp_authenticate_user vs wp_authenticate

I have a wordpress site (lets call it site1) and another site with oauth2 (site2). When a new user is created, a record is created in both site1 and site2 databases with the same email as username, ...
0
votes
1answer
49 views

The safest way to automate WordPress backups

I'm running over 20+ sites on a Linux shared cloud environment. At present, my hosting company performs daily, offsite backups. However, these are only kept for 30 days. This works great, but what ...
2
votes
1answer
53 views

How is password strength calculated?

A password, that contains: at least one capital letter, at least one small letter, at least one number and at least one non-alphanumeric character, is considered moderate to strong (sometimes even ...
0
votes
1answer
58 views

Completely remove the author url

I've already removed the login, registration, and password reset stuff. i also removed all links to the author url from single, archive, and index. now i want to remove the actual route so that bots ...
-1
votes
3answers
110 views

What techniques can a user employ to achieve a password rated “strong” in the WordPress password checker

I have strong passwords enforced for all my clients but I got some complaints recently as some users tried to change their password and gave up trying to achieve a strong rating. I was initially ...