Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

0
votes
0answers
4 views

What security concerns should I have when setting FS_METHOD to “direct” in wp-config?

I have recently had an issue where I have been unable to install the WP Smush Pro plugin because I don't have the Manual Install or One-Click Installation options available. I came across this post ...
3
votes
1answer
33 views

What to use instead of wp_kses() in user output

I need some help here. While developing a theme, I want to make sure there are no security issues. So all dynamic data must be correctly escaped for the context where it is rendered. I know how to ...
0
votes
0answers
12 views

Get an email from a potential customer via Wordpress email function - And get a response for that email which isn't me!

I got an email via wp_mail function - that looks like a response to a customer asking foe a telephone number (using the email wordpress@exmaple.com). What are the odds that there might be hackers on ...
0
votes
0answers
26 views

Best way to handle unregistered users as a unique idenitifier

I have a voting system for specific type of posts (site), similar to reddit, and I want to allow unregistered users to vote. In order to keep the voting count as valid as possible, I am thinking ...
0
votes
2answers
42 views

problem “headers already sent” after upgrading wordpress to 4.2.2

in wordpress version 3.6 and 3.7 everything works great, but with version 4 and above I get: Cannot modify header information - headers already sent the problem line is: header('Location: '. ...
2
votes
1answer
63 views

Garbage in beginning of wp-config.php - was this WP installation compromised?

I hadn't realized that one of my WP sites wasn't being accessed in the last months, and consequently not being updated, and today I have found that my config.php has some garbage in the beginning of ...
0
votes
0answers
17 views

Output Encoding - Required or not for Security Reasons

I am using a very popular commercial theme and discovered, that they do no output encoding with esc_html/esc_attr/esc_url and so on on the "User Profil/Author" (when listing the authors on a ...
0
votes
1answer
40 views

Block access to wp-admin

I'm attempting to use a .htaccess file to block access to the wp-admin folder. I've read through the Brute Force Attacks doc (https://codex.wordpress.org/Brute_Force_Attacks) and I've added the block ...
0
votes
1answer
34 views

wp-content - permissions for files/folders created by apache

My wp-content folder has owner 'User' and group 'www-data'. The permissions are 775 for folders and 664 for files, so the server can write inside folder. But when the server creates folder and files ...
-1
votes
0answers
30 views

Tracking a hack [duplicate]

The only reason I kept this in the WordPress site is because of the variable of Wordpress Plugins and Wordpress security, plus I feel like I'll get a more down to earth answer here. If someone thinks ...
0
votes
1answer
25 views

WP upload/select image , isn't this a security issue?

If in image upload frame I select a zip http://prntscr.com/6ypjlv, it does not show it in list of files but it is up http://prntscr.com/6ypjvp shouldn't we only be able to upload image types if ...
0
votes
0answers
23 views

esc_url within iFrame

I'm building a WordPress theme. To improve security, I'm escaping any URLs, like so: <?php $background = wp_get_attachment_image_src(get_post_thumbnail_id($post->ID), '' ); ?> <div ...
0
votes
0answers
25 views

Hide username discovery

How do I stop my usernames being leaked? To explain I tested my WordPress site on http://wprecon.com, and found that my admin username (that I have changed) was able to be discovered. User ...
0
votes
2answers
40 views

Wordpress login security

I have put up a logging script on my wp-login page. I noticed that a particular ip address- 193.176.147.7 has been consistently visiting my login page for some days now. The vitis are always in quick ...
0
votes
2answers
39 views

Is it good security advice to install wordpress in subdirectory but link to root?

Is it good to install wordpress in a subdirectory (with a random name), but set "Homepage" address to domain root? (based on Giving WordPress Its Own Directory) Since the wp-content is in the ...
0
votes
1answer
63 views

Single sign-on: wp_authenticate_user vs wp_authenticate

I have a wordpress site (lets call it site1) and another site with oauth2 (site2). When a new user is created, a record is created in both site1 and site2 databases with the same email as username, ...
0
votes
1answer
34 views

The safest way to automate WordPress backups

I'm running over 20+ sites on a Linux shared cloud environment. At present, my hosting company performs daily, offsite backups. However, these are only kept for 30 days. This works great, but what ...
1
vote
1answer
34 views

How is password strength calculated?

A password, that contains: at least one capital letter, at least one small letter, at least one number and at least one non-alphanumeric character, is considered moderate to strong (sometimes even ...
0
votes
1answer
33 views

Completely remove the author url

I've already removed the login, registration, and password reset stuff. i also removed all links to the author url from single, archive, and index. now i want to remove the actual route so that bots ...
-1
votes
3answers
95 views

What techniques can a user employ to achieve a password rated “strong” in the WordPress password checker

I have strong passwords enforced for all my clients but I got some complaints recently as some users tried to change their password and gave up trying to achieve a strong rating. I was initially ...
1
vote
2answers
49 views

Disabling outbound connectivity on web servers [closed]

Is it a good idea to harden your web server by disabling outbound connectivity on them? I am using RHEL 7 for a WordPress Multisite installation. After disabling outbound connectivity, the dashboard ...
0
votes
2answers
51 views

How to change WordPress user ID?

Is this enough to change the user ID? I'm doing this for security purposes, where the administrator has user ID=1 and I want to keep all posts, pages and content. UPDATE wp_posts SET ...
0
votes
1answer
34 views

Updating From Mobile App - Exposing Site to Hacking

I have made a simple Mobile App to update a wordpress site. It starts with a login (to the app) and then with forms, sends data via POST method to a PHP file that then uses wp_insert_post, ...
0
votes
0answers
40 views

Post meta sanitization and escaping

I'm writing a plugin that adds a text meta box where user enters (supposedly) media URL, which then is displayed in posts with $featured_media = get_post_meta( $post_id, '_meta_key', true ); echo ...
0
votes
1answer
118 views

200 return code on 'POST /wp-admin/admin-ajax.php' while NOT logged in

I noticed the following log entry: 111.22.3.444 - - [13/Mar/2015:08:31:00 +0100] "POST /wp-admin/admin-ajax.php HTTP/1.1" 200 618 ...
1
vote
1answer
22 views

Failed login attempts

I'm using WordFence for site monitoring and overall security. I'm seeing some failed login attempts from a couple of different locations with username "admin" and "companyname". I'm not familiar with ...
0
votes
1answer
36 views

Finding where a snippet of code is coming from

I recently noticed that a site that I work on is making a call to an outside website on every page load. The following code is showing on every page: <script type="text/javascript" ...
0
votes
2answers
30 views

How can I force a specific password?

How can I force a specific password for a specific user & not let that user change their password? I have a client that thinks that even if I force strong passwords via this plugin: ...
-1
votes
1answer
20 views

Website that sells statistics

I'm building a website that will have statistics based on user activity on the website (online votes and views etc). People will have to pay to view those stats. I am utilising wodpress features ...
1
vote
1answer
21 views

Using Contact Forms to Send Private Information [closed]

I am working on a site for a Doctors Office who wants to use a contact form to send information about their patients to other offices....I was going to use contact form 7 but I'm wondering if there is ...
4
votes
0answers
42 views

Should I check for ABSPATH in Themes? [duplicate]

I recently browsed WooCommerce source, and it appears that they're doing this: <?php /** * The template for displaying product content within loops. * * Override this template by copying it to ...
0
votes
0answers
64 views

Collecting Sensitive Data in Wordpress?

I am in need of creating an online application form that collected a users SSN number and am therefore concerned with security. Is this possible to do on WP with existing plugins? My research thus ...
0
votes
1answer
24 views

What highest security brake with wordpress and static files?

I want to build my sites with Wordpress files that can't be modified and dirs where new files can't be added. Static content with permission without possibilities to execute, that will served by ...
0
votes
1answer
43 views

How can i see/log all requests coming from a registration form (not from the UI)?

I am talking about the REGISTER form PROBLEM: I have some requests that are coming from somewhere else - not from the user interface. I know this, because these requests don't have all the mandatory ...
0
votes
0answers
12 views

Why are maintenance releases now auto-update? [duplicate]

When the recent 4.1.1 was released, I thought it must be an important security update, as it's going out to all sites automatically. Reading through the changelog, I found it actually doesn't mention ...
0
votes
2answers
153 views

How to sanitize select box values in post meta?

I have added a select box in the Post meta. Here is the code, and it works fine. My question is, do I need to sanitize the values before updating the post meta? If yes, how it should be done? This is ...
0
votes
1answer
60 views

Stop Plugin Enumeration [closed]

Is there any way to stop plugin enumeration? I have tried Acunetix WP Security plugin, It seems to work but Yoast SEO plugin is still enumerating. Any plugins or code modifications are appreciated. ...
1
vote
1answer
28 views

Registration Plugin - Recaptcha integration

Good Day Everyone, I'm currently writing a new plugin for Registration, I intend to actually share that Registration Plugin, but I would like to integrate reCaptcha into it. From what I understood ...
1
vote
0answers
56 views

What securtity plugin should I use [closed]

I have more WordPress sites, and some of them has been hacked a several times. After that they send spam messages, what is very annoying :S I decided I will use some security plugin and I wanted to ...
0
votes
0answers
50 views

Getting the current page post_id in function hooked to wp_ajax?

I have created a kind of a social network where when a user registration happens, I create a post (custom post type follower) for each user and assign its post_id to the user ( ...
0
votes
1answer
28 views

Write mysql credentials in plugin

I've to create a custom plugin to print data from a database different from the wordpress one. I'm using wpdb. Is it fine, from a security point, to write database credantials in the plugin files in ...
0
votes
0answers
27 views

Security Plugin Blocks Access to theme folder?

I'm using some jquery to do an ajax request within my theme and it's spitting out a file 404 error even though the file exists. I"m guessing it has something to do with the security plugin. here's ...
0
votes
1answer
71 views

Wordpress Brute Force Prevention

I am using WordFence security plugin for keeping track of login attempts and I regularly check the logs from it. I realize that there are going to be a lot of login attempts with the username 'admin'. ...
1
vote
1answer
84 views

Hack-Proof OR Security in Wordpress — is it real?

For many years I've been using WordPress as a platform for websites, it is convenient to me as a developer and for customers. But recent months, several sites of my clients were hacked and I'm ...
0
votes
0answers
9 views

Security of using uploaded file across two admin submits

I'm writing a plugin that merges two files, based on user input about which file to draw each section from. This means that I have to get the user upload and display it before I can get the user input ...
1
vote
1answer
30 views

Is it important to sanitize inputs in a shortcode that will be used in site that only I will post to?

Is there any security risk in not sanitizing shortcodes in a wordpress site if I am the only one who has access to the admin panel?
0
votes
0answers
24 views

Is it good practice to use WordPress nonce values to restrict page access?

I'm working with a colleague on a WordPress plugin. Part of the plugin functionality is showing dynamic lists with links which allow you to open a new page. Depending on the user's role, they may or ...
0
votes
1answer
18 views

Site is continuously accessing by several IPs

I have high traffic wordpress blog, but for last two days i am constantly getting the error "Error establishing a database connection". I have called to my hosting customer care and they are saying ...
0
votes
1answer
206 views

FORCE_SSL_ADMIN not working

Any ideas why define('FORCE_SSL_ADMIN', true); wouldn't work? I'm not getting any errors at all, but a http request to example.com/wp-admin isn't redirecting to https
0
votes
0answers
32 views

What is the best way to upload a temporary & sensitive file and then delete it when done

What is the best way to upload a temporary & sensitive file and then delete it when done. I'm writing a plugin (eventually for multisite) that allows users with a certain role to upload a .csv ...