0
votes
1answer
48 views

Specific way to allow Wordpress users to view their current password? And edit it?

I know the built in user manager doesn't allow a user to see what her current pass is, just recover / reset it via email or write in a new one in the admin but I am looking for a plugin or other ...
0
votes
1answer
57 views

User meta and public function security

I am using stripe to setup a system of buying credits, which can be used on my wordpress site. I save credits using wordpress user meta, and I increment those credits after a successful transaction ...
0
votes
0answers
14 views

Security: How to disallow viewing/browsing by author? [duplicate]

I've already inserted htaccess code to disallow searching for users by numeric id. However, one can still manually input a user name to view/browse by author, e.g. http://mywpsite.com/author/peter/ ...
0
votes
0answers
63 views

Encrypt Email Addresses at Rest

Some enterprise clients require that all email addresses be encrypted at rest (i.e., the actual values stored in the database must be encrypted). I've put together something that seems to do the ...
2
votes
4answers
162 views

Will WordPress username displayed somewhere in the site?

I am considering enforcing all my users to use email as their login name. But I am afraid that the username is being used somewhere that is publicly accessible, e.g. author pages, such as that it will ...
0
votes
2answers
38 views

Separate Out Real Users

If I look at /wp-admin/users.php I see all the users, but some have given a bogus email and never used their password. Is there some way to see who has used their password at least once? If not, ...
1
vote
1answer
118 views

How can I secure a WordPress blog using OpenID from a single provider?

We're about to launch an internal blog for the company I work at. Much of the blog will be available to the public, but certain posts will be for employees only. Our intranet/extranet has an OpenID ...
6
votes
1answer
77 views

Is it safe to store a user setting you don't want the user to ever modify as a user option?

I have added some custom user options to the profile page on my site, and most are all OK for the user to modify themselves. These options live in their own section. The users have read access and ...
1
vote
1answer
327 views

How to expire all wordpress user passwords instantly?

So I own an article directory website and recently a lot of bots have signed up and started posting spam. (I approve posts prior to publication) I've added a captcha to the user registration page now ...
3
votes
2answers
2k views

How do I create a WP user outside of Wordpress and auto login?

I've built a directory of members on a non-WP site (using php and mysql). Each member can log in and update their details using a username and password. I want to be able to get this to automatically ...
0
votes
2answers
658 views

What do spammers gain by signing up as a user?

The majority of new user signups I receive on my Wordpress blog look dodgy, with @someblog.com, @somearticle.com, or @gmail.com addresses. What do they gain by signing up as a new user?
3
votes
2answers
461 views

Setting WP Admin passwords to expire

I'm aware it's not a feature of Wordpress, but I was wondering if there was a way or a plug-in (haven't found one from searching) that allows me to force a user to change their password after a ...
3
votes
2answers
77 views

Any reason to be concerned by a wave of “zombie” blog signups?

I maintain a blog for a friend of mine. It's basically an aggregater of videos from other embeddable video sites, and provides a way for users to comment on those videos. Not really high-value ...
13
votes
2answers
6k views

Getting a List of Currently Available Roles on a WordPress Site?

When writing WordPress plugins there is often a need to set up options for which roles on the site have access to certain functionality or content. To do this a plugin dev needs to fetch the list of ...