0
votes
1answer
9 views

wp_create_nonce function doesn't work inside a plugin?

I am writing a WordPress plugin which is creating a form in one of its functions. It looks like this (very simplyfied): class MyPlugin { public function createForm() { $nonce = ...
2
votes
5answers
140 views

Upgrading Wordpress 4.0 asks for FTP password

I was able to upgrade Wordpress 4.0 on my local machine, and I also just updated some plugins on the production machine, but when I try to update Wordpress 4.0 on the production machine, it is asking ...
2
votes
1answer
169 views

Security error WP 4.0 + WP phpBB Bridge [closed]

so today I updated to 4.0 (glad I had backup). Everything was working fine until I tried to publish a post. There I got Are you sure you want to do this. Also had Cheatin' Uh under ...
10
votes
3answers
1k views

What could a hacker do with my wp-config.php

I am trying to secure my wordpress blog. I read some posts on the web that I should change my table_prefix and hide my wp-config.php. However, I do not get it? What could an attacker do with my ...
0
votes
1answer
16 views

Validating values using Settings API?

I'm using the Settings API to create options for plugin. Do I need to validate the input values for the security (for example stripslashes etc)? (I could not find that part in most of the tutorials). ...
0
votes
1answer
92 views

using .htaccess only for wordpress security no plugins

Right now I am using bulletproof wordpress security for my websites, but when i am installing W3 Total Cache plugin it gives me some errors related to .htaccess file and bulletproof wordpress security ...
0
votes
0answers
98 views

SWF in wordpress post

My question is somewhat a two part question. First I embedded a SWF file into my blog post using Easy Flash Embed plugin. It shows up on my desktop computer but when I view the post on my mobile ...
0
votes
2answers
24 views

Regarding plugin security

Is there any guarantee that the plugins I find on the wordpress site are legitimate and don't have any malicious code in them? Or is it up to me to check them? If so, what would be the best way to do ...
0
votes
1answer
68 views

Specific way to allow Wordpress users to view their current password? And edit it?

I know the built in user manager doesn't allow a user to see what her current pass is, just recover / reset it via email or write in a new one in the admin but I am looking for a plugin or other ...
0
votes
0answers
65 views

Inserting HTML elements into table with TinyMCE, security

I am working on a wordpress plugin where the administrator can fill out a form that adds products to a table. For most inputs I am using sanitize_text_field(), and then inserting the data. But for ...
0
votes
0answers
38 views

How can I establish the credibility of a theme/plugin author?

As prompted by the question "Are WordPress Plugins Necessary?", through what practices can administrators of self-hosted WordPress installations establish the credibility of a theme/plugin author ...
14
votes
6answers
428 views

Are Wordpress Plugins essential?

I'm new to WordPress. I recently read an article about how hackers can exploit vulnerabilities in plugins. Various sources such as Google Pagespeed has also disssuaded me from using plugins or at ...
4
votes
3answers
204 views

Disabled plugins are the security holes - rumor or reality?

I've read many WordPress Security blog articles, where the Security Experts're recommending some special matters to take care when somebody is concern about his/her WordPress site's security. Among ...
0
votes
0answers
18 views

What is the Best Way to Secure a Commercial Wordpress Plugin? [duplicate]

A friend has built a very powerful Wordpress plugin that was build mainly for his own use - and now he is considering opening it up to the public by selling it, but... But he's concerned that it will ...
0
votes
1answer
96 views

Unwanted Links and Spam Wordpress Pages and Posts

In webmaster tools I have a number of crawling errors of the Google spider. for example http://mydomain.com/my-page/de/roulette.html They say they cannot crawl to this page.. but what kind of page ...
0
votes
1answer
112 views

How do I determine if the user who registered is not spam?

I've recently set up a forum on my site with the bbpress-plugin. Now a user has registered on the site but the email-adress looks suspicious to me. How can I determine if the user is real? Is there a ...
12
votes
2answers
618 views

I found this in a plugin. What does it do? is it dangerous?

I found this in a plugin. What does it do? is it dangerous? add_action('admin_enqueue_scripts', 'pw_load_scripts'); if (!function_exists('wp__head'){ function wp__head() { ...
0
votes
1answer
57 views

Security and Must Use Plugins

From the codex article on Must Use Plugins: Can be enabled simply by uploading file to the mu-plugins directory, without having to log-in This feels like a potential security problem to me. ...
0
votes
0answers
28 views

Malware installation during plugin update?

I update my wordpress blog daily (current version: WordPress 3.5.2). Today I installed an update of "Search everything". After that, my webspace was infected by malware. Interestingly, my blog is ...
3
votes
1answer
177 views

WordPress Capabilities: edit_user vs edit_users

The official documentation only mentions edit_users, but in the source I found many places are using edit_user, what is the difference? Are there any conventions for singular and plural capabilities? ...
1
vote
1answer
61 views

Security checking in meta_box save is reluctant?

For example, in this tutorial, the code suggested when saving meta box data is /* Verify the nonce before proceeding. */ if ( !isset( $_POST['smashing_post_class_nonce'] ) || !wp_verify_nonce( ...
2
votes
4answers
178 views

Will WordPress username displayed somewhere in the site?

I am considering enforcing all my users to use email as their login name. But I am afraid that the username is being used somewhere that is publicly accessible, e.g. author pages, such as that it will ...
0
votes
5answers
310 views

Prevent Brute Force Attack

I already used Limit Login Attempts wordpress plugin. Are there other ways to prevent brute force attacks? I'm worried because I saw a lot of locked out.
2
votes
1answer
2k views

Why Better WP security plugin returns 418 I'm a Teapot “error”?

I am working on the Wordpress website and all of a sudden after deploying it on the server, I started seeing a problem where some of the pages on my website return 418 I'm a Teapot as Response status ...
0
votes
1answer
190 views

If I use an alternative login (e.g. CAS or other SSO) plugin, is my site protected from the recent brute force login attempts?

I've been hearing about the recent increase in brute-force WordPress login attempts due to a massive botnet attack. Everything I've read so far indicates that the attack works by just trying different ...
2
votes
1answer
178 views

Protecting against malicious code in Wordpress plugin updates

One of the most popular Wordpress plugins listed on the Wordpress plugins database got malicious code injected into it recently (April 2013): ...
3
votes
1answer
125 views

Why allow overriding crucial pluggable functions wp_verify_nonce and wp_create_nonce?

Among the functions in /wp-includes/pluggable.php are the functions wp_verify_nonce and wp_create_nonce. Both functions are very important in the protection against CSRF-attacks. However, it is easy ...
0
votes
2answers
913 views

Too many login attempts

Since a week or two I keep receiving the following automatic email message sent from my WordPress website, and I'd like to know if it indicates any security hole and if there's anything I can do to ...
0
votes
1answer
50 views

Is this plugin safe to run?

This is an extract of code from a wordpress plugin. Is it safe to run despite the variables not being filtered? Also does the wpdb class filter to prevent any injection? list($email_id, $user_id, ...
0
votes
1answer
625 views

Basic password protection without using users and roles

I'm using WooCommerce, and want to be able to password protect products (or preferably whole categories if possible), but without using the Users & Roles functionality build into WP(because I need ...
0
votes
2answers
188 views

File permissions for wp-minify plugin

I am worried on installing Wp-Minify plugin. But it needs 777 permission for the cache directory located inside wp-uploads directory. Isn't it a security issue?
-1
votes
2answers
1k views

How to improve WordPress security by hiding non public facing files?

e.g. curl -I http://ma.tt/blog/wp-config.php 200 OK The wp-config.php is not public facing file, since it currently just return blank page, so why not return 404 instead. (so will not be cached by ...
2
votes
2answers
78 views

How to limit WordPress pages during updates?

I will be doing upgrades to the design and content of my Wordpress site. During this time I only want the homepage to be available. Is there a good way to lock this down (through a plug-in, etc.). ...
0
votes
1answer
86 views

Is there any pre-existing plugin to track and block IPs with suspicious activity on my site?

The image below shows a recent (failed) attempt to crack my Wordpress install. It's easy for me to look at that and see what they were doing, but is there a plugin that exists that monitors this data ...
3
votes
1answer
2k views

How to make media upload private? [duplicate]

Possible Duplicate: How to Protect Uploads, if User is not Logged In? I know how to mark a Page or Post as visible only to members, using the Member Access plugin. This way, the public ...
0
votes
2answers
1k views

Is Timthumb still broken? What security measures should be taken?

A client has requested we use a theme, and that theme has a Timthumb dependency. I know that there has been some serious vulnerabilities in the past, but what is the current state of that plugin? ...
2
votes
3answers
107 views

Why users disable the WordPress update?

Users install plugins which disable update reminders. Plugins: disable WordPress Core Updates disable WordPress Plugin Updates disable WordPress Theme Updates Look at the counter of plugins ...
1
vote
1answer
341 views

How to expire all wordpress user passwords instantly?

So I own an article directory website and recently a lot of bots have signed up and started posting spam. (I approve posts prior to publication) I've added a captcha to the user registration page now ...
0
votes
1answer
1k views

Problem with permissions in wp-content/plugins

I have a WP installation on my local machine and trying to get my hands dirty with plugins. I wish to clone a project from github which has this plugin code. However, i dont have the permissions ...
10
votes
2answers
251 views

How Can I Securely Implement a Password-less Login Feature?

Just posted a new plugin: No More Passwords I currently have it tagged beta because logging into a platform is a sensitive issue and I don't want to release something that may have security holes. So ...
0
votes
2answers
198 views

How to prevent plugins from sniffing/stealing other plugins' options?

Many plugins require configuration with sensitive data such as API keys, passwords, etc. When implementing these plugins, this sensitive data is stored using functions such as update_option() and ...
2
votes
4answers
118 views

How to properly secure my Wordpress installation?

I'm currently on my own server (fredericpilon.com) with my own website. Wordpress being kind of a big shot of CMS, it may be targeted by hacks. Any tips and tricks on how to properly secure my ...
1
vote
2answers
471 views

How can I make uploaded images in the editor load with HTTPS?

I have the admin section of my site using HTTPS. This works pretty well except that the images inside the TinyMCE editor (the post and page rich text editor) load with http instead of https and so I ...
2
votes
1answer
87 views

Where should my plugin POST to?

I'm creating a simple plugin to set a page as a homepage from the list pages (to appear next to edit, preview, trash actions etc), I was just wondering what that the most appropriate/secure place to ...
4
votes
2answers
217 views

What does a security risk in a plugin look like?

My server was hacked this weekend. By the Russians! Of the 50+ domains on my server, every single one had a hacked .htaccess file which was redirecting search results and a few other things to a ...
0
votes
1answer
439 views

Is the Block Bad Queries Plugin Still Relevant?

The Block Bad Queries Plugin hasn't been updated recently. Is WordPress still subject to these types of malicious attacks or has it been hardened sufficiently to make the plugin obsolete? Is there an ...
1
vote
1answer
62 views

Does WordPress validate inputs to all functions? (such as get_user_meta and insert_user_meta)

Does WordPress validate inputs made to all built-in functions that access the database to protect against SQL injection vulnerabilities or do we have to validate before passing them?
18
votes
13answers
2k views

What Are Security Best Practices for WordPress Plugins and Themes? [closed]

As suggested in this question, I am adding this topic as a new question, for community discussion/voting regarding best-practices for Plugin/Theme security. Here is the starting checklist, based on ...
13
votes
3answers
418 views

What are the common security flaws I need to look for? [closed]

As a wannabe WP plugin developper, what are the main security flaws/holes I should look for? I'm about to create a new plugin with a configuration panel (ie input fields and stuff). What should I be ...
0
votes
3answers
392 views

WP Insert Post If user refreshes override new post

WP Insert Post is a very simple and easy to use function. Currently I have it set up on event triggered by whether a user is logged in during a booking to ratify their booking in its own page. My ...