Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

0
votes
1answer
19 views

Can some vulnerabilities in plugins be exploited even when the plugin is inactive?

I just received a notification from the developers of the Wordfence security plugin of several vulnerabilities that exist in other popular Wordpress plugins. One example in this case is a mailchimp ...
1
vote
1answer
41 views

Restricting user login by IP address

I have a website that is login required in order for users to view the website. I have set up one user for all internal members to use to view the website, however i want to limit just that user to ...
0
votes
1answer
21 views

How are readers authenticated for leaving comments?

I'm thinking of creating a WordPress blog, not on WordPress.com but just using WordPress on a hosted website. I would like to allow comments on the blog, but was wondering in what way are commentators ...
2
votes
0answers
20 views

WordPress URL/Folder ReWrite using Htaccess

I am trying to mask certain folder in a WordPress installation using the Htaccess file. I am aware that there are plugins available to do exactly what I want but, I do not want to add even more ...
1
vote
1answer
237 views

Should we use plugins that aren't available from the official WordPress site?

I'm not sure if my question is appropriate here, apologies in advance but I am confused and need some helpful thoughts! We were using this plugin for our site , which has recently been removed from ...
0
votes
0answers
20 views

Disable or Modify Access-Control-Allow-Origin from Response Headers

I would like to know is that possible to modify or remove Access-Control-Allow-Origin from Response Headers Due to security reason, I need to change Access-Control-Allow-Origin from * to domain I ...
5
votes
1answer
427 views

Is WordPress vulnerable to the httpoxy?

Is WordPress vulnerable to the httpoxy exploit? See https://httpoxy.org/ Thanks.
0
votes
1answer
19 views

Using wp_localize_script in template file - is it secure?

I have the following code inside one of my template files (NOT functions.php) $datatoBePassed = array( 'pageTitle' => get_the_title() ); wp_localize_script( 'main-js', '...
0
votes
1answer
39 views

Is it safe to use admin-ajax.php in the frontend?

I am using Filter Custom Fields & Taxonomies Light. I found out it is using admin-ajax.php in the frontend for the AJAX search even not logged in. See: https://plugins.svn.wordpress.org/filter-...
0
votes
1answer
17 views

My site thinks it's secure when it is fact not

My site is loading enqueued content over HTTPS while it is not a secure site. I have a couple PHP sites behind a load balancer with a proxy ssl certificate on one other domain. This site does not ...
-1
votes
1answer
48 views

What is nulled themes

In wordpress there is a concept (Nulled Themes) I google it and found some people say it is hacked and others say it is not. I try it with (iThemes Security) and everything works without errors. The ...
0
votes
1answer
36 views

What is the best practice for restricting a section to logged in users?

As a newbie, I've had a hard time finding a good starting point. I believe my case is fairly common and maybe this question has been answered comprehensively elsewhere. I am creating a simple site ...
0
votes
0answers
9 views

Is it possible to only have the admin interface bind to the local loopback?

I was wondering if it's possible to bind only the admin interface (and not the page) to the local loop back address? For purposes of keeping the wrong people off the administrator interface with SSH.
0
votes
0answers
19 views

Mitigating Bruteforce attempts server wide

We host several WordPress sites on a VPS and see brute force attempts across each site. WordFence is in operation on each. Where we can manage the DNS the site sits behind Cloudflare. Can't help ...
0
votes
1answer
24 views

Checking for origin of a xmlrpc request

I have webapp A (running wordpress) talking to webapp B (running on Java, no wordpress or php). B issues xmlrpc requests to A over https. In order to secure the xmlrpc endpoint on A I'd like to ...
0
votes
1answer
8 views

Require confirmation of current user's email before updating database and before send_email_change_email

I like the core ability for users to update their default "Email" field. For example username1 can edit their own profile and change their "Email" field from email1@example.com to email2@example.com ...
1
vote
1answer
24 views

ajax nonce verification failing

I have a voting system where a list of posts are printed out using an archive template. Each post's voting button has html data attributes containing the vote-id and the vote-nonce. When the voting ...
1
vote
0answers
20 views

Correct way check nonce (security) using old Options API

I am developing plugin for Wordpress. Firstly I started using Settings API it looks good, but it is little bit complex and it doesn't provide the way to handle options manually. I have quite ...
5
votes
4answers
229 views

Does My Child-Theme Functions.php Need if{die} Security In It? [duplicate]

I'm new to PHP, but I've noticed just about every PHP file has a security snippet, "Die if not accessed in the correct manner" script at the beginning; my question, does a child-theme functions.php ...
0
votes
1answer
19 views

Where is the php file, that does the checks for login information?

I would like to add some additional checks into my wordpress website's username and password authentication function for specific usernames, but I cannot find the correct php file... /* I would like ...
1
vote
2answers
45 views

Is default functions like update_post_meta safe to use user inputs?

Is default functions like update_post_meta() safe to use user inputs? e.g. update_post_meta(76, 'my_key', $_GET['value']) Or should I use $_GET['value'] = sanitize_text_field($_GET['value']); ...
0
votes
1answer
19 views

Error on Wordpress Login

I am editing my wordpress site before and nothing is wrong until I change my ISP then this error came out when I try to login on my site: Not Acceptable! An appropriate representation of the ...
1
vote
1answer
30 views

WordPress Front end Form - Enable to Submit PHP Codes

I just create a front end form to submit posts for public persons. It works fine. I need to allow to submit PHP codes (because it is PHP tutorial site) via that form. I need to make sure it not ...
2
votes
1answer
37 views

Staging Site: Made Public - Security Questions

Previously, our staging site has been locked down to local access only. We hired a third party developer to assist with resolving a theme via our 'local staging server' remotely. In order to grant ...
3
votes
1answer
62 views

Is sanitize_text_field() is enough to save to DB?

So here is the situation. We allow users to enter input data, i.e. user_first_name and user_additional_comments. Then we use sanitize_text_field() , which is named as save. But after this filter: ...
0
votes
2answers
50 views

How to connect my wordpress plugin to a remote database securely?

First of all I do not have a lot of experience with wordpress plugins, but I am developing a plugin which has to connect and send data to a remote database ( which it is already doing ). But at this ...
1
vote
2answers
47 views

How to safely allow user upload on CPTs?

I have a form with a WP Media to allow user uploads for a custom post type on the front end. Every time I try to upload as a user I can the message You don't have permission to attach files to this ...
0
votes
1answer
46 views

Load all files from folder in theme – Security concerns?

I'm using this code below in a config file to automatically require other PHP files in the same directory and in subdirectories. This helps my work flow become more efficient. I'm concerned that I ...
1
vote
0answers
74 views

How do I authenticate WP users from a chrome extension?

I'm new to WordPress, and I need help. I am writing a chrome extension and intend to use wordpress as the user database. I intend that because I'm using a subscription management WP plugin that keeps ...
0
votes
3answers
52 views

Limit Login Attempts BEFORE PHP is executed?

I manage multiple WordPress installs (all related/cross-linked) and I've been getting hit hard with brute force attempts for the past few weeks, enough to crash my servers on multiple occasions. I ...
1
vote
1answer
46 views

Verify if user is wordpress logged in from another app since wordpress 4.0

I try to implement in my Node.js app a way to verify if the user cookie is valid. I've found some post in internet who explain me very well the things, but as i try to implement it, with the WordPress-...
9
votes
2answers
194 views

Improve wordpress security by hiding non public resources

I'm new from wordpress and i want improve security of wordpress multisite by hiding non public resources, eg. wp-admin, wp-config etc. My setting seem to work, but i don't know if this setting can ...
2
votes
0answers
37 views

How to implement secure frontend image upload? [closed]

I would like to implement an public image upload in my Wordpress Theme with ajax. What's the secure way to do this? I have read many about security problems when allow users to upload files to the ...
1
vote
1answer
48 views

<meta name=“generator” content=“WordPress 4.4.2” /> neccessary?

Hello fellow WordPressers Today, I realized that most WordPress sites have this small footprint saying: <meta name="generator" content="WordPress 4.4.2" /> where it indicates what "system" ...
0
votes
0answers
32 views

Sanitization Function in Wordpress (Example Twentyfifteen.1.4 Default WP Theme)

The ThemeForest Submission Requires some sanitization functions that should be incorporated in the theme - This page says this. The WordPress theme should make use of the following inbuilt ...
3
votes
1answer
37 views

Extra themes - ok or bad?

I know I am a newbie here, but I'm just wondering, if you keep extra themes in your Wordpress setup, will it add bloat to your site? Can these other themes provide a security risk even if they aren't ...
0
votes
2answers
33 views

Using an Encryption class in a WordPress Plugin

I'm making a WordPress plugin that works with sensitive data. So I need to store/retrieve date with a trusty encryption method. I did some searches among many php encryption wrapper classes, and ...
0
votes
2answers
51 views

Correct and safe way to include php content in my page

I have a website where I use [insert_php] to insert php content to my page. What I do is simply use php's include inside insert_php to include my complex php script. I asked a question a while ago, ...
0
votes
2answers
60 views

Filter and validate user role in registration

I want to show a select box for user roles in the registration form. I am using this model: /* ROLES IN LIST REGISTRATION */ // 1. Add a new form element... add_action( 'register_form', '...
0
votes
2answers
62 views

Relative security of different releases of WordPress

Since each major-version of WordPress (like 4.0 or 4.4) gets its own series of security updates (currently 4.0.10 or 4.4.2), are the updated newer major-versions significantly more secure than updated ...
0
votes
0answers
19 views

Wordpress security - hiding WordPress directory [duplicate]

Note: edited my post to make it more "is it useful?" than "how to do it?" after toscho marked it as duplicate (the post tosho referenced is more or less what I had in mind for the "how to do it" part)....
0
votes
0answers
24 views

About plugin security

I'm developping a couple of simple plugins for specific use, and want to do it right. I've read multiple pages about plugin security, including those. Now, considering that my plugins have for ...
0
votes
1answer
32 views

Is it safe to give wordpress directories ownership to www-data?

I am not server or security expert so please excuse if my question sounds odd. I am running wordpress site on ubuntu 14.04 with nginx server. I had a problem while installing new plugin, So I have ...
1
vote
0answers
16 views

Are there security risks in working directly in the themes folder that builds into a theme folder?

I'm wondering if there are any security risks in using the wp-content/themes/ folder as my project root and using wp-content/themes/my-theme as my build folder. Basically, in the themes folder I would ...
0
votes
1answer
22 views

Dangers to allowing Access-Control-Allow-Origin: * for Feeds only?

I want to use a function like this to allow access to the feeds from a variety of services but my knowledge of the security implications is limited. I think I'm being safe by limiting the access to ...
0
votes
0answers
17 views

Logout via Subdomain, non-wordpress page on a different server?

Similar to the question over at Get wp_logout_url function to work on external (non-Wordpress) page The problem I am facing is the fact the subdomain is on a different server so I am unable to ...
1
vote
1answer
75 views

Should I Worry About SQL Injection When Using wp_insert_post?

I have created a form to insert posts via front-end to users. I use wp_insert_post function. Should I worry about SQL injection or Does wp_insert_post function handle it?
1
vote
1answer
40 views

Frontend Password change

First off, I apologize if there is a duplicate of this roaming around somewhere...I have spent the better part of the past hour looking for the solution, with no luck, but maybe I just suck at picking ...
1
vote
1answer
264 views

Security issues with WP sites

I have just had to deal with a few of my WordPress websites being hacked. First time put an index.html file in the cpanel of each site and replenished my admin user. Once I felt I cleaned this up, it'...
1
vote
3answers
1k views

Best way to eliminate xmlrpc.php?

What is a best way to eliminate xmlrpc.php file from WordPress when you don't need it?