Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

0
votes
1answer
18 views

Make “default” wordpress pages & features unaccessible

I am trying to create specific password-protected mini-sites (single wordpress pages) for specific users or specific passwords to be precise. For example someone clicks the url domain.com/url1 and if ...
-4
votes
0answers
17 views

Best security plugins

I'd like to know what's the best WP plugin for security, by blocking brute-force attack, XSS, SQL Injection and other kind of attacks.. Is there one or several good plugins?
0
votes
0answers
12 views

Cross site domain cookies in Wordpress (v4.x)

I have a plugin that executes an external script (outside of Wordpress) that i'd like to make 'more secure'. I'd like to make this script only accessible/executable when logged in as the Wordpress ...
3
votes
2answers
39 views

Escaping built-in WP function return strings

Should one filter the output of builtin WP functions such as get_permalink() and well-known WP plugins such as ACF (Advanced Custom Fields) such as get_field()? For instance get_permalink() calls ...
22
votes
3answers
10k views

Getting a List of Currently Available Roles on a WordPress Site?

When writing WordPress plugins there is often a need to set up options for which roles on the site have access to certain functionality or content. To do this a plugin dev needs to fetch the list of ...
0
votes
0answers
23 views

Does Wordpress contain “default” anti-SQL injection code that responds with a 404 error?

I've been through the “seven layers of the candy cane forest” on this one… :) Our plugin receives data via a POST request. On a particular site that has our plugin installed, we observed odd ...
0
votes
0answers
11 views

Vanilla Wordpress install, what can/should I put in disable_functions?

I would like to take steps to limit the damage a compromised Wordpress install can cause on the rest of my system. What system calls does Wordpress need? What can I put in the disable_functions ...
0
votes
1answer
18 views

How do I diagnose a plugin resource 404?

I'm doing some work for a new client (non-tech, their former tech person left). Their version of Wordpress is 4.3.2. The site gets some JavaScript errors on load. Using the Console I noticed two ...
17
votes
6answers
11k views

Can I Prevent Enumeration of Usernames?

Can I prevent enumeration of usernames on my wordpress site? I can see users at the moment using the WPScan tool.
2
votes
1answer
28 views

Do you need to escape hard coded plain text?

I started playing with the Underscores starter theme and noticed it uses esc_html_e() even on plain text: <a class="skip-link" href="#content"><?php esc_html_e( 'Skip to content', '_s' ); ...
1
vote
1answer
20 views

Using esc_url with a hard coded url

I've added following URL in my theme, but I have been informed that I must use esc_url(). I could not figure out, how can I use that function with following code? <a ...
0
votes
2answers
2k views

How to secure or disable the RSS feeds?

I'm trying to set up WordPress as a CMS. As such, I want to disable the feeds since it's mostly a secured site. I've gone through all the Settings pages but found no setting to tweak or disable the ...
0
votes
0answers
24 views

PHP Code Sniffer - WordPress VIP Coding Standards

I'm trying to fix up my code to meet the WordPress VIP Coding Standards. I'm getting a couple of issues that I'd like to see go away, but i'm not sure what the best strategy is. The first issue is ...
0
votes
1answer
1k views

How do I properly update the Wordpress database password?

A site that I manage was recently compromised and I am going through the steps to harden and re-secure the site. I would like to change the MySql database password and want to make sure I do not take ...
0
votes
2answers
23 views

Security: blocking direct access of php files

I found 2 ways to block direct access to php files (although it's not always necessary, see http://wordpress.stackexchange.com/a/63004/60539) The first one is: defined( 'ABSPATH' ) or die( 'No script ...
0
votes
1answer
874 views

Change Login URL Without Plugin

I want to change the login url of my Wordpress install away from /wp-admin.php I am aiming to do so and am looking at changing the .htaccess file to add in: RewriteRule ^login$ ...
2
votes
2answers
35 views

Is the “lost password” feature truly a vulnerability?

Disabling Password Resets I've come across numerous security hardening articles relating to various measures for disabling password resets (i.e. lost password retrieval). ...
3
votes
1answer
399 views

Disallow file edit not preventing plugin install

I have a little demo site (admin details are listed publicly), and I've configured the wp-config.php to disallow file edits, so in theory no one can install a theme / plugin. define( ...
1
vote
1answer
12 views

Handling email piping attachments and detecting unsupported file types

I have a plugin that I am working on which uses Email Piping. When an email is processed I want all the attachments from the email to be added to the WordPress Media Library. Currently I am using ...
0
votes
1answer
12 views

Webservice credential storage [duplicate]

I am developing a plugin that calls a web-service with a security header. Can anyone recommend a best practice for storing those credentials on the WordPress site? Right now my best option seems to be ...
0
votes
1answer
586 views

FORCE_SSL_ADMIN not working

Any ideas why define('FORCE_SSL_ADMIN', true); wouldn't work? I'm not getting any errors at all, but a http request to example.com/wp-admin isn't redirecting to https
2
votes
2answers
1k views

how can i embed wordpress backend in iframe

I have 2 websites http://www.aaa.com and http://www.bbb.com and need it show the same. now i put iframe in index.html and upload to aaa.com. it's ok for frontend but it's doesn't work for backend, ...
1
vote
2answers
33 views

site get login attempts after htaccess ip restriction

I'm using a security plugin that keep sending me emails: "A lockdown event has occurred due to too many failed login attempts or invalid username: Username: Admin IP Address: 195.154.243.31 IP ...
0
votes
1answer
416 views

Which WordPress scripts need to be executable for a fresh installation?

For security reasons I need to block access to scripts that will not be executed on a fresh WordPress installation. Example: /index.php --> needs to be executable /wp-includes/cache.php --> should ...
6
votes
2answers
93 views

Where to securely store API keys and passwords in WordPress?

I'm looking to use a few APIs and many come with keys, secret keys and passwords required to work. Where in WordPress can you store that information? Assuming anyone can hack your DB is there anyway ...
0
votes
1answer
21 views

Adding Security Keys?

I read the paragraph at the codex on Security Keys. It offers the example - define( 'AUTH_KEY', 't`DK%X:>xy|e-Z(BXb/f(Ur`8#~UzUQG-^_Cs_GHs5U-&Wb?pgn^p8(2@}IcnCa|' ); define( ...
0
votes
3answers
26 views

Directory to store secure file

I have a website hosted on ASP.NET server and using wordpress to build my site. I've extended its functionalities using PHP code. At which directory do I store secure files such as (passwords and ...
1
vote
0answers
19 views

Hacked site is now Generating Users..What can we do? [closed]

Our site is hacked and auto-registering 1 new user/3min. What we did so far : 1- Added Captcha on all the registration pages 2- Changed the superAdmin pswd 3- upgraded WP to 4.4 4- upgraded all ...
1
vote
1answer
26 views

How Restrict access to admin dashboard by specific static ip?

i'm trying to restrict access to admin dashboard (wp-admin.php) by specific static ip so tried to add .htaccess to the wp-admin and set <FilesMatch "admin\.php$"> Order deny,allow Deny from ...
1
vote
2answers
46 views

Developing a secure front end post editing form

I want to add a front end post editing functionality to one of my Wordpress sites. I found a few plugins that do this, but they don't fits all my needs, so I decided to adapt an existing solution to ...
3
votes
2answers
124 views

What is the wp-includes/certificates/ca-bundle.crt used for?

I'm working on a Wordpress site and I stumbled upon that certificate. I would like to know what it is for. Is Wp using it in any way? Can I delete it (or move it outside the document root)? Thanks
0
votes
1answer
95 views

Developing a secure front end posting form

I want to add a front end posting functionality to one of my Wordpress sites. For more control and for more understanding of how this works (I am not a professional programmer) I choosed to use as a ...
0
votes
0answers
13 views

Access passworded post with URL

I'm using Woocommerce to sell memberships which users must apply for and I've passworded them all to prevent unauthorized purchases. The best solution for me would be to have a link which 'unlocks' ...
0
votes
0answers
22 views

AJAX - nonce verification fails

I have a simple add-to-newsletter widge. I created a hidden input with nonce: $nlnonce = wp_create_nonce("add-newsletter"); echo '<input type="hidden" id="nlnonce" value="'.$nlnonce.'" />'; ...
1
vote
2answers
57 views

Limit access to wp_admin

I'm attempting to limit access to wp_admin by IP address but I still have a few that are getting through. I have an htaccess file in my wp_admin folder with the following: # Block access to wp-admin. ...
-2
votes
2answers
91 views

How to Find WordPress site has backdoor login Codes

This is a very common question. There are plenty of plugins available in WordPress Plugins directory Under GPL. And many plugins have some backdoor login attempts. So, can't trust which plugin is ...
0
votes
0answers
12 views

Download security

I would like to create a secure download link for digital content e.g. PDFs, Zips etc. There's a few plugins that offer "secure downloads" but they just block the download page. I need it so the ...
7
votes
1answer
80 views

Why does wordpress have more then one salt

I guess I am exposing here some lack of security knowledge, but shouldn't it be enough to have one salt? why does there need to be four different ones define('AUTH_SALT', ...
0
votes
1answer
46 views

Force SSL on a single page which is used as iFrame

I have one WordPress page that only contains a shortcode for a slider and is used by other websites as an iFrame. I need to force SSL one this one single page, but whatever I try, it is not being ...
0
votes
1answer
36 views

WordPress security [closed]

I created a website for my customer via wordpress and I uploaded it in their server ..we assume the user have the access in the whole server ..is it possible to protect this website from being used in ...
0
votes
1answer
21 views

How to protect Wordpress from security scanner [closed]

I wondered how can we protect our wordpress site from security fail scanner (ex: wpscsan) or scanner that gives info like if our site is using wordpress, plugins and theme (ex: What WordPress Theme Is ...
0
votes
0answers
455 views

Full path disclosure on rss-functions.php

I was running some security test on my WordPress apps and noticed that all of them have a full path disclosure on the following url. I am sure this has been answered before but I can't find any ...
0
votes
1answer
62 views

Being hacked. Is there a list of Wordpress security holes I can check against?

I observe a file being uploaded into various plugin folders in my Wordpress site. The file is used to send out spam from my server and every time I remove it it gets uploaded to another folder. There ...
18
votes
3answers
8k views

Increase of failed login attempts, brute force attacks? [closed]

I Installed the plugin Simple Login Lockdown and since a couple of days ago the database is recording over 200 records by day. I think that is not possible to have my site attacked by so many IP's ...
0
votes
0answers
27 views

Some crawlers/bots attempting to login with very good guesses. How?

I am trying to figure out if wordpress exposes the user e-mail or any other user information to crawlers/bots? I have a couple of security plugins that have been blocking these bots IPs on the third ...
0
votes
2answers
87 views

Changing Table Prefix for an Existing WordPresss Site

Hoping someone can assist with Wordpress table prefix for an already established site. What is the best approach in changing the existing table prefix within both DB and wp-config file to reflect new ...
1
vote
4answers
5k views

How to remove “Connection Information” requirement on localhost install of WP on MACOSX

I've just installed XAMPP on Mac OSX and when trying to install a theme or plugin in WP admin, I'm getting this screen. I've never gotten this on my shared hosting account. how to get rid of it on ...
0
votes
0answers
25 views

How to distinguish between a hack and an encoding error?

This morning I was working with a new image gallery plugin. After two hours of working with it, our server was struggling with a heavy network traffic, and then the server appeared to go out. ...
2
votes
1answer
96 views

How do I bypass Wordpress 404 handling?

How do I skip Wordpress altogether if there's a 404? I've tried adding an ErrorDocument to the .htaccess with no joy. The reason I'm asking is that we use a lot of custom fields and as such our site ...
0
votes
2answers
73 views

Allow SVG in WP step by step

I'm not strong in WP programming, bu I try to understand what to do to enable SVG in my site. I found that in need to add function below to functions.php: /** * Add SVG capabilities */ function ...