Tagged Questions

0
votes
1answer
48 views

If I use an alternative login (e.g. CAS or other SSO) plugin, is my site protected from the recent brute force login attempts?

I've been hearing about the recent increase in brute-force WordPress login attempts due to a massive botnet attack. Everything I've read so far indicates that the attack works by just trying different ...
2
votes
1answer
47 views

Protecting against malicious code in Wordpress plugin updates

One of the most popular Wordpress plugins listed on the Wordpress plugins database got malicious code injected into it recently (April 2013): ...
3
votes
1answer
49 views

Why allow overriding crucial pluggable functions wp_verify_nonce and wp_create_nonce?

Among the functions in /wp-includes/pluggable.php are the functions wp_verify_nonce and wp_create_nonce. Both functions are very important in the protection against CSRF-attacks. However, it is easy ...
0
votes
2answers
136 views

Too many login attempts

Since a week or two I keep receiving the following automatic email message sent from my WordPress website, and I'd like to know if it indicates any security hole and if there's anything I can do to ...
0
votes
1answer
45 views

Is this plugin safe to run?

This is an extract of code from a wordpress plugin. Is it safe to run despite the variables not being filtered? Also does the wpdb class filter to prevent any injection? list($email_id, $user_id, ...
0
votes
2answers
75 views

File permissions for wp-minify plugin

I am worried on installing Wp-Minify plugin. But it needs 777 permission for the cache directory located inside wp-uploads directory. Isn't it a security issue?
-1
votes
1answer
28 views

How To Secure Word Press? [closed]

I am working in web hosting company so my job is to fix clients problem, one of the biggest problem we are facing right now is that our only word press customer site got hacked 'not one all of them', ...
-1
votes
2answers
337 views

How to improve WordPress security by hiding non public facing files?

e.g. curl -I http://ma.tt/blog/wp-config.php 200 OK The wp-config.php is not public facing file, since it currently just return blank page, so why not return 404 instead. (so will not be cached by ...
2
votes
2answers
71 views

How to limit WordPress pages during updates?

I will be doing upgrades to the design and content of my Wordpress site. During this time I only want the homepage to be available. Is there a good way to lock this down (through a plug-in, etc.). ...
0
votes
1answer
46 views

Is there any pre-existing plugin to track and block IPs with suspicious activity on my site?

The image below shows a recent (failed) attempt to crack my Wordpress install. It's easy for me to look at that and see what they were doing, but is there a plugin that exists that monitors this data ...
3
votes
1answer
634 views

How to make media upload private? [duplicate]

Possible Duplicate: How to Protect Uploads, if User is not Logged In? I know how to mark a Page or Post as visible only to members, using the Member Access plugin. This way, the public ...
0
votes
2answers
609 views

Is Timthumb still broken? What security measures should be taken?

A client has requested we use a theme, and that theme has a Timthumb dependency. I know that there has been some serious vulnerabilities in the past, but what is the current state of that plugin? ...
1
vote
3answers
89 views

Why users disable the WordPress update?

Users install plugins which disable update reminders. Plugins: disable WordPress Core Updates disable WordPress Plugin Updates disable WordPress Theme Updates Look at the counter of plugins ...
1
vote
1answer
215 views

How to expire all wordpress user passwords instantly?

So I own an article directory website and recently a lot of bots have signed up and started posting spam. (I approve posts prior to publication) I've added a captcha to the user registration page now ...
0
votes
1answer
667 views

Problem with permissions in wp-content/plugins

I have a WP installation on my local machine and trying to get my hands dirty with plugins. I wish to clone a project from github which has this plugin code. However, i dont have the permissions ...
9
votes
2answers
158 views

How Can I Securely Implement a Password-less Login Feature?

Just posted a new plugin: No More Passwords I currently have it tagged beta because logging into a platform is a sensitive issue and I don't want to release something that may have security holes. So ...
0
votes
2answers
133 views

How to prevent plugins from sniffing/stealing other plugins' options?

Many plugins require configuration with sensitive data such as API keys, passwords, etc. When implementing these plugins, this sensitive data is stored using functions such as update_option() and ...
0
votes
2answers
96 views

WordPress Didn't like the site move? [closed]

I have a site that has been dropped on my lap and it currently has some WordPress issues. The site can longer auto update, and complains about paths when I try to update a plugin: Unable to locate ...
1
vote
4answers
101 views

How to properly secure my Wordpress installation?

I'm currently on my own server (fredericpilon.com) with my own website. Wordpress being kind of a big shot of CMS, it may be targeted by hacks. Any tips and tricks on how to properly secure my ...
1
vote
1answer
210 views

How can I make uploaded images in the editor load with HTTPS?

I have the admin section of my site using HTTPS. This works pretty well except that the images inside the TinyMCE editor (the post and page rich text editor) load with http instead of https and so I ...
1
vote
1answer
60 views

Where should my plugin POST to?

I'm creating a simple plugin to set a page as a homepage from the list pages (to appear next to edit, preview, trash actions etc), I was just wondering what that the most appropriate/secure place to ...
4
votes
2answers
197 views

What does a security risk in a plugin look like?

My server was hacked this weekend. By the Russians! Of the 50+ domains on my server, every single one had a hacked .htaccess file which was redirecting search results and a few other things to a ...
0
votes
1answer
322 views

Is the Block Bad Queries Plugin Still Relevant?

The Block Bad Queries Plugin hasn't been updated recently. Is WordPress still subject to these types of malicious attacks or has it been hardened sufficiently to make the plugin obsolete? Is there an ...
1
vote
1answer
54 views

Does WordPress validate inputs to all functions? (such as get_user_meta and insert_user_meta)

Does WordPress validate inputs made to all built-in functions that access the database to protect against SQL injection vulnerabilities or do we have to validate before passing them?
14
votes
13answers
1k views

What Are Security Best Practices for WordPress Plugins and Themes? [closed]

As suggested in this question, I am adding this topic as a new question, for community discussion/voting regarding best-practices for Plugin/Theme security. Here is the starting checklist, based on ...
11
votes
3answers
309 views

What are the common security flaws I need to look for? [closed]

As a wannabe WP plugin developper, what are the main security flaws/holes I should look for? I'm about to create a new plugin with a configuration panel (ie input fields and stuff). What should I be ...
0
votes
3answers
356 views

WP Insert Post If user refreshes override new post

WP Insert Post is a very simple and easy to use function. Currently I have it set up on event triggered by whether a user is logged in during a booking to ratify their booking in its own page. My ...
1
vote
2answers
113 views

Upgraded to latest version - 3.0.3 and Now I get a “sufficient permissions to access this page” error

The issue appeared immediately after upgrade. The only part of the application impacted is the sub-menu items under settings where it relates to a plug-in. The core application settings work, just ...
0
votes
1answer
288 views

404 errors when updating options in admin dashboard

Whenever I try to update my Permalink settings or use the Theme Editor to modify some file, I am redirected to a 404 page. This also happens when I update the All-In-One SEO Pack plugin's settings. ...
1
vote
2answers
119 views

Weird problems after recovery from security breach

The shared server that I used for hosting my WordPress website was hacked recently, and many of the index.php files, plugin files and uploads were deleted, with my MySQL databases untouched. But after ...
5
votes
4answers
1k views

Security and .htaccess

About a month ago I started a WordPress blog on a hosted server related to a hobby. So, I am new to this at present. Since I'm concerned about security, one thing I did was to install the plugin WP ...
3
votes
3answers
532 views

Secure WordPress paid plug-in

I want to create a WordPress plug-in but also want to ensure that the plugin can only be used after it has been activated with a serial key that should be unique for each domain. What is the best way ...