Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

-1
votes
0answers
19 views

wordpress security site [on hold]

please wordpress security site ideas I posted this earlier at Worpress.com and was advised to come here. I've just come across an organisation which won't commission a Worpress based site because ...
1
vote
0answers
19 views

How do I authenticate WP users from a chrome extension?

I'm new to WordPress, and I need help. I am writing a chrome extension and intend to use wordpress as the user database. I intend that because I'm using a subscription management WP plugin that keeps ...
0
votes
0answers
9 views

Send media uploads to different directories

I am making a website for my local primary school, and I have each class page as a separate page template. Rather than have all their uploads go into the general /uploads/ folder I'd like to direct ...
0
votes
0answers
25 views

How to remove mysterious whatsmyrank-dev plugin exploit [closed]

My site http://mike-eng.com has been having a 15 second delay for a while. I checked my error log. Here's the result: [thomas-nelson-jr]$ tail -n 10 error.log [Tue Apr 26 05:22:25 2016] [error] ...
0
votes
3answers
37 views

Limit Login Attempts BEFORE PHP is executed?

I manage multiple WordPress installs (all related/cross-linked) and I've been getting hit hard with brute force attempts for the past few weeks, enough to crash my servers on multiple occasions. I ...
1
vote
1answer
27 views

Verify if user is wordpress logged in from another app since wordpress 4.0

I try to implement in my Node.js app a way to verify if the user cookie is valid. I've found some post in internet who explain me very well the things, but as i try to implement it, with the ...
4
votes
0answers
82 views

Improve wordpress security by hiding non public resources

I'm new from wordpress and i want improve security of wordpress multisite by hiding non public resources, eg. wp-admin, wp-config etc. My setting seem to work, but i don't know if this setting can ...
2
votes
0answers
28 views

How to implement secure frontend image upload? [on hold]

I would like to implement an public image upload in my Wordpress Theme with ajax. What's the secure way to do this? I have read many about security problems when allow users to upload files to the ...
1
vote
1answer
34 views

<meta name=“generator” content=“WordPress 4.4.2” /> neccessary?

Hello fellow WordPressers Today, I realized that most WordPress sites have this small footprint saying: <meta name="generator" content="WordPress 4.4.2" /> where it indicates what "system" ...
0
votes
0answers
23 views

Sanitization Function in Wordpress (Example Twentyfifteen.1.4 Default WP Theme)

The ThemeForest Submission Requires some sanitization functions that should be incorporated in the theme - This page says this. The WordPress theme should make use of the following inbuilt ...
3
votes
1answer
35 views

Extra themes - ok or bad?

I know I am a newbie here, but I'm just wondering, if you keep extra themes in your Wordpress setup, will it add bloat to your site? Can these other themes provide a security risk even if they aren't ...
-1
votes
0answers
26 views

How can someone login-attempt my Wordpress site when wp-login.php is forbidden?

Title is pretty much all. I get a lot of login attempts on my WP site, security plugin often notifies me when blocks attacker's IP address and when I got tired, I've done in .htaccess something like: ...
0
votes
2answers
29 views

Using an Encryption class in a WordPress Plugin

I'm making a WordPress plugin that works with sensitive data. So I need to store/retrieve date with a trusty encryption method. I did some searches among many php encryption wrapper classes, and ...
0
votes
2answers
39 views

Correct and safe way to include php content in my page

I have a website where I use [insert_php] to insert php content to my page. What I do is simply use php's include inside insert_php to include my complex php script. I asked a question a while ago, ...
0
votes
2answers
46 views

Filter and validate user role in registration

I want to show a select box for user roles in the registration form. I am using this model: /* ROLES IN LIST REGISTRATION */ // 1. Add a new form element... add_action( 'register_form', ...
0
votes
2answers
50 views

Relative security of different releases of WordPress

Since each major-version of WordPress (like 4.0 or 4.4) gets its own series of security updates (currently 4.0.10 or 4.4.2), are the updated newer major-versions significantly more secure than updated ...
0
votes
0answers
19 views

Wordpress security - hiding WordPress directory [duplicate]

Note: edited my post to make it more "is it useful?" than "how to do it?" after toscho marked it as duplicate (the post tosho referenced is more or less what I had in mind for the "how to do it" ...
0
votes
0answers
22 views

About plugin security

I'm developping a couple of simple plugins for specific use, and want to do it right. I've read multiple pages about plugin security, including those. Now, considering that my plugins have for ...
0
votes
1answer
22 views

Is it safe to give wordpress directories ownership to www-data?

I am not server or security expert so please excuse if my question sounds odd. I am running wordpress site on ubuntu 14.04 with nginx server. I had a problem while installing new plugin, So I have ...
1
vote
0answers
13 views

Are there security risks in working directly in the themes folder that builds into a theme folder?

I'm wondering if there are any security risks in using the wp-content/themes/ folder as my project root and using wp-content/themes/my-theme as my build folder. Basically, in the themes folder I would ...
0
votes
1answer
17 views

Dangers to allowing Access-Control-Allow-Origin: * for Feeds only?

I want to use a function like this to allow access to the feeds from a variety of services but my knowledge of the security implications is limited. I think I'm being safe by limiting the access to ...
0
votes
0answers
13 views

Logout via Subdomain, non-wordpress page on a different server?

Similar to the question over at Get wp_logout_url function to work on external (non-Wordpress) page The problem I am facing is the fact the subdomain is on a different server so I am unable to ...
1
vote
1answer
58 views

Should I Worry About SQL Injection When Using wp_insert_post?

I have created a form to insert posts via front-end to users. I use wp_insert_post function. Should I worry about SQL injection or Does wp_insert_post function handle it?
1
vote
1answer
29 views

Frontend Password change

First off, I apologize if there is a duplicate of this roaming around somewhere...I have spent the better part of the past hour looking for the solution, with no luck, but maybe I just suck at picking ...
1
vote
1answer
152 views

Security issues with WP sites

I have just had to deal with a few of my WordPress websites being hacked. First time put an index.html file in the cpanel of each site and replenished my admin user. Once I felt I cleaned this up, ...
1
vote
3answers
193 views

Best way to eliminate xmlrpc.php?

What is a best way to eliminate xmlrpc.php file from WordPress when you don't need it?
0
votes
0answers
22 views

Upload file via settings page

Question: Is there a secure way to upload files via a plugin settings page? Context: Hello world! A feature of my plugin requires the user to upload one or more files. More precisely, JSON files ...
5
votes
3answers
138 views

Are the default salts secure?

When installing a fresh wordpress, one of the things one should do is, updating the salts in wp-config.php. The section looks like this define('AUTH_KEY', 'put your unique phrase here'); ...
0
votes
1answer
24 views

What is more secure checking capabilities of user or checking role of user in WordPress plugin development

Suppose I need to check the logged in user is subscriber not anyone else. So if I check the capability like "read". Then subscriber is OK but "read" capability is also associated to admin/publisher as ...
2
votes
1answer
50 views

Is revealing just the AUTH_KEY a security issue?

I am troubleshooting a Wordpress plugin issue. It is a plugin that generates a zip file of existing files on the server and returns a link to download the file. The plugin ...
0
votes
2answers
49 views

Wordpress restrict plugin file direct access

i am developing a wordpress plugin, but before that i have checked the code for the few plugin already developed. I have seen a common approach to restrict the direct where the plugin developer starts ...
0
votes
1answer
21 views

Make “default” wordpress pages & features unaccessible

I am trying to create specific password-protected mini-sites (single wordpress pages) for specific users or specific passwords to be precise. For example someone clicks the url domain.com/url1 and if ...
0
votes
0answers
15 views

Cross site domain cookies in Wordpress (v4.x)

I have a plugin that executes an external script (outside of Wordpress) that i'd like to make 'more secure'. I'd like to make this script only accessible/executable when logged in as the Wordpress ...
3
votes
2answers
59 views

Escaping built-in WP function return strings

Should one filter the output of builtin WP functions such as get_permalink() and well-known WP plugins such as ACF (Advanced Custom Fields) such as get_field()? For instance get_permalink() calls ...
2
votes
0answers
56 views

Does Wordpress contain “default” anti-SQL injection code that responds with a 404 error?

I've been through the “seven layers of the candy cane forest” on this one… :) Our plugin receives data via a POST request. On a particular site that has our plugin installed, we observed odd ...
0
votes
0answers
19 views

Vanilla Wordpress install, what can/should I put in disable_functions?

I would like to take steps to limit the damage a compromised Wordpress install can cause on the rest of my system. What system calls does Wordpress need? What can I put in the disable_functions ...
0
votes
1answer
24 views

How do I diagnose a plugin resource 404?

I'm doing some work for a new client (non-tech, their former tech person left). Their version of Wordpress is 4.3.2. The site gets some JavaScript errors on load. Using the Console I noticed two ...
2
votes
1answer
45 views

Do you need to escape hard coded plain text?

I started playing with the Underscores starter theme and noticed it uses esc_html_e() even on plain text: <a class="skip-link" href="#content"><?php esc_html_e( 'Skip to content', '_s' ); ...
1
vote
1answer
31 views

Using esc_url with a hard coded url

I've added following URL in my theme, but I have been informed that I must use esc_url(). I could not figure out, how can I use that function with following code? <a ...
0
votes
0answers
41 views

PHP Code Sniffer - WordPress VIP Coding Standards

I'm trying to fix up my code to meet the WordPress VIP Coding Standards. I'm getting a couple of issues that I'd like to see go away, but i'm not sure what the best strategy is. The first issue is ...
0
votes
2answers
57 views

Security: blocking direct access of php files

I found 2 ways to block direct access to php files (although it's not always necessary, see http://wordpress.stackexchange.com/a/63004/60539) The first one is: defined( 'ABSPATH' ) or die( 'No script ...
2
votes
2answers
45 views

Is the “lost password” feature truly a vulnerability?

Disabling Password Resets I've come across numerous security hardening articles relating to various measures for disabling password resets (i.e. lost password retrieval). ...
1
vote
1answer
19 views

Handling email piping attachments and detecting unsupported file types

I have a plugin that I am working on which uses Email Piping. When an email is processed I want all the attachments from the email to be added to the WordPress Media Library. Currently I am using ...
0
votes
1answer
17 views

Webservice credential storage [duplicate]

I am developing a plugin that calls a web-service with a security header. Can anyone recommend a best practice for storing those credentials on the WordPress site? Right now my best option seems to be ...
0
votes
1answer
21 views

Adding Security Keys?

I read the paragraph at the codex on Security Keys. It offers the example - define( 'AUTH_KEY', 't`DK%X:>xy|e-Z(BXb/f(Ur`8#~UzUQG-^_Cs_GHs5U-&Wb?pgn^p8(2@}IcnCa|' ); define( ...
1
vote
2answers
84 views

site get login attempts after htaccess ip restriction

I'm using a security plugin that keep sending me emails: "A lockdown event has occurred due to too many failed login attempts or invalid username: Username: Admin IP Address: 195.154.243.31 IP ...
1
vote
0answers
21 views

Hacked site is now Generating Users..What can we do? [closed]

Our site is hacked and auto-registering 1 new user/3min. What we did so far : 1- Added Captcha on all the registration pages 2- Changed the superAdmin pswd 3- upgraded WP to 4.4 4- upgraded all ...
0
votes
3answers
36 views

Directory to store secure file

I have a website hosted on ASP.NET server and using wordpress to build my site. I've extended its functionalities using PHP code. At which directory do I store secure files such as (passwords and ...
1
vote
1answer
33 views

How Restrict access to admin dashboard by specific static ip?

i'm trying to restrict access to admin dashboard (wp-admin.php) by specific static ip so tried to add .htaccess to the wp-admin and set <FilesMatch "admin\.php$"> Order deny,allow Deny from ...
7
votes
2answers
157 views

Where to securely store API keys and passwords in WordPress?

I'm looking to use a few APIs and many come with keys, secret keys and passwords required to work. Where in WordPress can you store that information? Assuming anyone can hack your DB is there anyway ...