Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

0
votes
1answer
18 views

is_email() VS sanitize_email()

If I'm allowing a user to enter an email address to be saved into the database, should I use is_email() or sanitize_email()? Ex. update_user_meta( $user_id, $social_site, sanitize_email( ...
0
votes
4answers
54 views

Do we need to escape data that we receive from theme options?

I'm creating a Wordpress theme that I'm hoping to sell on Themeforest. Now I know much about escaping user inputted data using functions like esc_html, esc_url and so on and I use them in the comments ...
-1
votes
0answers
17 views

Will WordPress get my server hacked? [closed]

I'm building a web application where the needs of security are the most important thing. If my server/website were to be vulnerable for an attack, my entire business would collapse and my brand would ...
0
votes
0answers
14 views

How can I obscure the fact my site uses WordPress? [duplicate]

Is there anything I can do to prevent somebody from knowing my site is using WordPress by looking at the source code of the front page and trying to access the login page? I am referring to people who ...
2
votes
1answer
102 views

Security error WP 4.0 + WP phpBB Bridge [closed]

so today I updated to 4.0 (glad I had backup). Everything was working fine until I tried to publish a post. There I got Are you sure you want to do this. Also had Cheatin' Uh under ...
0
votes
0answers
21 views

WordPress XML-RPC attack [migrated]

Yesterday I suffered a DDoS attack on my WordPress site. I had 21,443 hits with HTTP Status code 404 and a Bandwidth of 711.85 MB. Also, CPU usage went to 100%. Logs show a lot of this entries: ... ...
0
votes
0answers
35 views

Change Login URL Without Plugin

I want to change the login url of my Wordpress install away from /wp-admin.php I am aiming to do so and am looking at changing the .htaccess file to add in: RewriteRule ^login$ ...
9
votes
3answers
1k views

What could a hacker do with my wp-config.php

I am trying to secure my wordpress blog. I read some posts on the web that I should change my table_prefix and hide my wp-config.php. However, I do not get it? What could an attacker do with my ...
0
votes
1answer
21 views

Should I change the default file and folder permissions?

After reading the Hardening WordPress article I realise a good permission scheme is essential to the security of my WordPress installation. The article suggests a possible permissions scheme but my ...
1
vote
3answers
3k views

Protecting HTML5 video [closed]

I shall explain my situation as best I can so you can see where i'm coming from. I'm working on a wordpress site for a sports team, there are loads of teams. We want to put coaching sessions on our ...
0
votes
4answers
4k views

How to remove “Connection Information” requirement on localhost install of WP on MACOSX

I've just installed XAMPP on Mac OSX and when trying to install a theme or plugin in WP admin, I'm getting this screen. I've never gotten this on my shared hosting account. how to get rid of it on ...
1
vote
0answers
32 views

How do I get around “Sorry, this file type is not permitted for security reasons”?

I was wondering how I could allow .tiff files to be uploaded in my wordpress site. I get the message "Sorry this file type is not permitted for security reasons". This question has been asked in ...
4
votes
1answer
103 views

Share same domain for wp-admin but for different website

I have site like http://www.foo.com http://www.bar.com And I've a wildcard SSL cert *.example.com, instead of buying two SSL certs for the above two domains, can I re-use my existing wildcard SSL ...
7
votes
2answers
245 views

Why are passwords exportable as plain text in WordPress?

On my WordPress 3.9.2 installation can I extract the users plain text passwords by going to Users, select all users, and choosing Bulk Actions Export. When I look in the mySQL database with ...
1
vote
1answer
109 views

Is there a way to create a URL (new WP page) that can only be accessed from a specific source?

To explain further, here's what I"m looking to do: Create a WP page Use the URL and implement it in a reader service that is hosted (not downloadable) that in order to read (& access the URL) ...
5
votes
4answers
7k views

What are the recommended database permissions for WordPress?

I just got WP running on my own server. I am not trying to lock things down more. What permissions should the db user have to my WP db?
0
votes
3answers
27 views

How can I restrict access to specific parts of a page, not just the page itself?

I looked at WP's site and didn't see a role I could use. I can create my own, but how do I limit the content on the page itself? Some private and some public information can be on the same page. I ...
0
votes
2answers
29 views

Is it necessary to use esc_url with template tags such as get_permalink?

I have been reading that sanitizing data output is important in theme / plugin development for wordpress. Is it necessary to use functions such as esc_url with template tags like get_permalink, or ...
4
votes
1answer
102 views

Why do I get accidental comments without (the required) email address?

Somebody translated one of my tutorials here (with my permission). All fine but I got comments that seem unintended on two of my tutorials that the translation links to. Now the weird thing is that ...
0
votes
2answers
22 views

Is there a way to remove the option to modify the Slug in post.php

I am trying to remove the option to edit the Permalink. I know how to hide it with CSS and I have. But a hacker could simply just go to Inspect Element and change display: none; to display: block; ...
4
votes
1answer
90 views

Run WordPress frontend and backend in different domains

I want to run my WP frontend as www.example.com and my backend (i.e. wp-admin) as user1.example.org, is it possible? The reason is I want to host lot of sites in a single server which has only 1 IP ...
4
votes
2answers
480 views

wp.getUsersBlogs XMLRPC Brute Force Attack/Vulnerability

After the holiday weekend, one of the larger sites I manage had a brute force attack on it. The attacker was attempting to use the wp.getUsersBlogs function and a list of popular usernames and ...
4
votes
2answers
3k views

Limiting sessions to one IP at a time

On a site with premium user account subscriptions, I'd like to be able to limit logins to one computer at a time. The most straightforward way to accomplish this would be to limit by IP, but I haven't ...
-1
votes
2answers
1k views

Securing Contact Form 7 [closed]

I have a client who's website I created with Wordpress. It has a contact form created with contact form 7. This client is a subsidiary of a larger organization who's IT department runs scans on their ...
1
vote
0answers
43 views

How to allow internal links using wp_kses filtration

I'm working on front end submission and of course I want to secure data by filtering before inserting to database. The form contains repeatable fields group data which I want filter by wp_kses ...
0
votes
0answers
23 views

Remove user credentials from GET or POST on login

This may be a totally noob question but... I noticed that, with the standard Wordpress install, it seems like one can obtain the user's login credentials just by viewing the GET and/or POST vars ...
1
vote
2answers
21 views

Would it be dangerous to send all the wp_options to javascript file?

I've noticed that wordpress allows me to send the wordpress options to javascript via wp_localize_script: wp_localize_script( $this->plugin_slug . '-plugin-script', 'wp_options', ...
2
votes
1answer
72 views

Security around save_post hook

There are a lot of examples using the save_post hook, that include adding and verifying a nonce, and checking the user has appropriate permissions before you continue. Is this necessary? When ...
0
votes
2answers
293 views

How can I password protect a WordPress site without requiring users to log in?

I don't want people to have to log in, I just want to prompt them with a question and if they can answer it, they can access the site. All the solutions and plugins that I've found seem to be overkill ...
1
vote
1answer
127 views

How can I secure a WordPress blog using OpenID from a single provider?

We're about to launch an internal blog for the company I work at. Much of the blog will be available to the public, but certain posts will be for employees only. Our intranet/extranet has an OpenID ...
0
votes
0answers
29 views

How to escape custom css?

I'm creating a WordPress theme in which I've allowed users to add some custom css from the Theme Options. This css code then directly gets echoed out in the head section of the page, with the ...
3
votes
1answer
166 views

Is it true $wpdb->get_results is faster than WP_Query in most cases?

On my homepage, I have a section where I have to display the last five featured posts, where a featured post is simply a post with a custom field is_featured set to 1. I achieved what I want with two ...
2
votes
1answer
70 views

WordPress salts set in config and database

I have come across the following code in a new clients existing website in wp-config.php define('AUTH_KEY', 'put your unique phrase here'); define('SECURE_AUTH_KEY', 'put your unique phrase ...
0
votes
1answer
53 views

Which WordPress scripts need to be executable for a fresh installation?

For security reasons I need to block access to scripts that will not be executed on a fresh WordPress installation. Example: /index.php --> needs to be executable /wp-includes/cache.php --> should ...
0
votes
0answers
29 views

Background Updates Not Happening

I have some sites which are not updating with the background updater. I installed the Background Update Tester plugin and everything looks fine. Currently they are at 3.9 but they are telling me that ...
2
votes
0answers
16 views

hSite has no css on mobile [closed]

Our WP site got hacked and we've been working with our hosting to clean all malware etc. However, now the site appears on desktop fine, but on mobile it looks as though all the css is stripped. ...
1
vote
1answer
684 views

What is the best method to close off the backend?

The goal: Completely remove the ability to access the WordPress backend on the production domain. Ex. return a 404 for http://example.com/wp-admin Purpose: I don't want any possibility of WordPress' ...
0
votes
0answers
24 views

Folder Permissions + Security Concerns

I messed up bad guys. I while working on another part of my website I accidentally nuked my WordPress folder permissions. I was able to find/fix some problems and I got my site up and running but some ...
0
votes
2answers
35 views

How to give the same error message when the wrong password or wrong username is used?

For security reasons, my WordPress instance should give the same error message when an incorrect password or wrong username is used. How can it be done?
2
votes
1answer
59 views

Enforcing password complexity

We need to enforce password complexity in a wordpress site, we used this article: http://www.webtipblog.com/force-password-complexity-requirements-wordpress/ We created the following in ...
4
votes
1answer
72 views

What are the security reasons to disallow Microsoft Word uploads?

When I try uploading a .doc or .docx file I get this message: Sorry, this file type is not permitted for security reasons What are the security risks involved in a multisite installation ...
16
votes
2answers
10k views

How to Protect Uploads, if User is not Logged In?

I use wordpress for a private site where users upload files. I use the "Private WordPress" to prevent access in to the site if the user is not logged in. I would like to do the same to the files ...
2
votes
0answers
211 views

How to get WordPress to save upload file beyond web root

I am using nginx on a multisite install. I am trying to get WordPress to save uploads to a folder beyond the webroot : /home/mydomain/file_secure as opposed to ...
0
votes
1answer
15 views

Validating values using Settings API?

I'm using the Settings API to create options for plugin. Do I need to validate the input values for the security (for example stripslashes etc)? (I could not find that part in most of the tutorials). ...
2
votes
3answers
6k views

How to change “wp-admin” to something else without search-replacing the core?

for example: foobar.com/wp/edit instead of foobar.com/wp/wp-admin How would I do that? I've tried using this in htaccess but it won't work: ##### ABOVE THIS POINT IS ALREADY INSERTED BY WORD PRESS ...
30
votes
10answers
19k views

Can I rename the wp-admin folder?

Is it possible to rename the wp-admin folder? I know I could just rename it, but unless it's supported by the code lots of things would break. If I use a custom folder name, it will make it slightly ...
0
votes
1answer
81 views

using .htaccess only for wordpress security no plugins

Right now I am using bulletproof wordpress security for my websites, but when i am installing W3 Total Cache plugin it gives me some errors related to .htaccess file and bulletproof wordpress security ...
0
votes
0answers
18 views

How to get WP to run plugin code triggered by an external site hook?

I have written a plugin to sync data from a WP blog to an external website. Changes to made to the external site also sync back to the WP blog. Right now the external website executes a POST request ...
0
votes
2answers
464 views

How to rewrite rules for WP-security in Nginx?

I have a WordPress website on a VPS running nginx. I have installed the WP Security plugin to improve the security of my site. After changing all the settings to my liking, a pop-up notifies me that I ...
0
votes
0answers
58 views

WordPress it's cleaning a custom query_var to avoid sql injections?

I am using get_query_var function to get a custom query_var. This query_var will be used later in to query arguments to retrieve posts with: $the_query = new WP_Query( $args ); . My question is, ...