Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

1
vote
0answers
16 views

How do I authenticate WP users from a chrome extension?

I'm new to WordPress, and I need help. I am writing a chrome extension and intend to use wordpress as the user database. I intend that because I'm using a subscription management WP plugin that keeps ...
0
votes
1answer
745 views

Full path disclosure on rss-functions.php

I was running some security test on my WordPress apps and noticed that all of them have a full path disclosure on the following url. I am sure this has been answered before but I can't find any ...
0
votes
0answers
9 views

Send media uploads to different directories

I am making a website for my local primary school, and I have each class page as a separate page template. Rather than have all their uploads go into the general /uploads/ folder I'd like to direct ...
0
votes
1answer
30 views

How to distinguish between a hack and an encoding error?

This morning I was working with a new image gallery plugin. After two hours of working with it, our server was struggling with a heavy network traffic, and then the server appeared to go out. ...
0
votes
3answers
35 views

Limit Login Attempts BEFORE PHP is executed?

I manage multiple WordPress installs (all related/cross-linked) and I've been getting hit hard with brute force attempts for the past few weeks, enough to crash my servers on multiple occasions. I ...
0
votes
0answers
25 views

How to remove mysterious whatsmyrank-dev plugin exploit [on hold]

My site http://mike-eng.com has been having a 15 second delay for a while. I checked my error log. Here's the result: [thomas-nelson-jr]$ tail -n 10 error.log [Tue Apr 26 05:22:25 2016] [error] ...
1
vote
1answer
147 views

Security issues with WP sites

I have just had to deal with a few of my WordPress websites being hacked. First time put an index.html file in the cpanel of each site and replenished my admin user. Once I felt I cleaned this up, ...
0
votes
1answer
1k views

How do I properly update the Wordpress database password?

A site that I manage was recently compromised and I am going through the steps to harden and re-secure the site. I would like to change the MySql database password and want to make sure I do not take ...
0
votes
1answer
686 views

FORCE_SSL_ADMIN not working

Any ideas why define('FORCE_SSL_ADMIN', true); wouldn't work? I'm not getting any errors at all, but a http request to example.com/wp-admin isn't redirecting to https
1
vote
1answer
458 views

Which WordPress scripts need to be executable for a fresh installation?

For security reasons I need to block access to scripts that will not be executed on a fresh WordPress installation. Example: /index.php --> needs to be executable /wp-includes/cache.php --> should ...
1
vote
1answer
27 views

Verify if user is wordpress logged in from another app since wordpress 4.0

I try to implement in my Node.js app a way to verify if the user cookie is valid. I've found some post in internet who explain me very well the things, but as i try to implement it, with the ...
4
votes
0answers
79 views

Improve wordpress security by hiding non public resources

I'm new from wordpress and i want improve security of wordpress multisite by hiding non public resources, eg. wp-admin, wp-config etc. My setting seem to work, but i don't know if this setting can ...
0
votes
1answer
453 views

Single sign-on: wp_authenticate_user vs wp_authenticate

I have a wordpress site (lets call it site1) and another site with oauth2 (site2). When a new user is created, a record is created in both site1 and site2 databases with the same email as username, ...
2
votes
0answers
27 views

How to implement secure frontend image upload? [on hold]

I would like to implement an public image upload in my Wordpress Theme with ajax. What's the secure way to do this? I have read many about security problems when allow users to upload files to the ...
1
vote
1answer
34 views

<meta name=“generator” content=“WordPress 4.4.2” /> neccessary?

Hello fellow WordPressers Today, I realized that most WordPress sites have this small footprint saying: <meta name="generator" content="WordPress 4.4.2" /> where it indicates what "system" ...
0
votes
0answers
23 views

Sanitization Function in Wordpress (Example Twentyfifteen.1.4 Default WP Theme)

The ThemeForest Submission Requires some sanitization functions that should be incorporated in the theme - This page says this. The WordPress theme should make use of the following inbuilt ...
7
votes
2answers
154 views

Where to securely store API keys and passwords in WordPress?

I'm looking to use a few APIs and many come with keys, secret keys and passwords required to work. Where in WordPress can you store that information? Assuming anyone can hack your DB is there anyway ...
3
votes
1answer
35 views

Extra themes - ok or bad?

I know I am a newbie here, but I'm just wondering, if you keep extra themes in your Wordpress setup, will it add bloat to your site? Can these other themes provide a security risk even if they aren't ...
-1
votes
0answers
25 views

How can someone login-attempt my Wordpress site when wp-login.php is forbidden?

Title is pretty much all. I get a lot of login attempts on my WP site, security plugin often notifies me when blocks attacker's IP address and when I got tired, I've done in .htaccess something like: ...
0
votes
2answers
39 views

Correct and safe way to include php content in my page

I have a website where I use [insert_php] to insert php content to my page. What I do is simply use php's include inside insert_php to include my complex php script. I asked a question a while ago, ...
0
votes
2answers
29 views

Using an Encryption class in a WordPress Plugin

I'm making a WordPress plugin that works with sensitive data. So I need to store/retrieve date with a trusty encryption method. I did some searches among many php encryption wrapper classes, and ...
1
vote
2answers
124 views

How to check plugins for malicious code?

Our new hosting company ran a security check on our installation and I was very surprised to hear that a premium plugin we had purchased (Easy Media Gallery Pro) contained malicious code. (It may ...
5
votes
1answer
69 views

What is the purpose of having a token in cookies?

WordPress utilizes cookies for better security, and I've been trying to understand how exactly this could make a WordPress website more secure, and I found this article . There's a pretty decent ...
0
votes
2answers
46 views

Filter and validate user role in registration

I want to show a select box for user roles in the registration form. I am using this model: /* ROLES IN LIST REGISTRATION */ // 1. Add a new form element... add_action( 'register_form', ...
0
votes
2answers
49 views

Relative security of different releases of WordPress

Since each major-version of WordPress (like 4.0 or 4.4) gets its own series of security updates (currently 4.0.10 or 4.4.2), are the updated newer major-versions significantly more secure than updated ...
0
votes
0answers
19 views

Wordpress security - hiding WordPress directory [duplicate]

Note: edited my post to make it more "is it useful?" than "how to do it?" after toscho marked it as duplicate (the post tosho referenced is more or less what I had in mind for the "how to do it" ...
0
votes
0answers
22 views

About plugin security

I'm developping a couple of simple plugins for specific use, and want to do it right. I've read multiple pages about plugin security, including those. Now, considering that my plugins have for ...
0
votes
1answer
22 views

Is it safe to give wordpress directories ownership to www-data?

I am not server or security expert so please excuse if my question sounds odd. I am running wordpress site on ubuntu 14.04 with nginx server. I had a problem while installing new plugin, So I have ...
8
votes
5answers
12k views

What are the recommended database permissions for WordPress?

I just got WP running on my own server. I am not trying to lock things down more. What permissions should the db user have to my WP db?
0
votes
0answers
12 views

Are there security risks in working directly in the themes folder that builds into a theme folder?

I'm wondering if there are any security risks in using the wp-content/themes/ folder as my project root and using wp-content/themes/my-theme as my build folder. Basically, in the themes folder I would ...
0
votes
1answer
16 views

Dangers to allowing Access-Control-Allow-Origin: * for Feeds only?

I want to use a function like this to allow access to the feeds from a variety of services but my knowledge of the security implications is limited. I think I'm being safe by limiting the access to ...
0
votes
0answers
11 views

Logout via Subdomain, non-wordpress page on a different server?

Similar to the question over at Get wp_logout_url function to work on external (non-Wordpress) page The problem I am facing is the fact the subdomain is on a different server so I am unable to ...
97
votes
12answers
37k views

Steps to Take to Hide the Fact a Site is Using WordPress?

I have a website for which we are trying to be discreet about the fact that we are using WordPress. What steps can we take to make it less obvious?
1
vote
1answer
58 views

Should I Worry About SQL Injection When Using wp_insert_post?

I have created a form to insert posts via front-end to users. I use wp_insert_post function. Should I worry about SQL injection or Does wp_insert_post function handle it?
-1
votes
2answers
1k views

Change Login URL Without Plugin

I want to change the login url of my Wordpress install away from /wp-admin.php I am aiming to do so and am looking at changing the .htaccess file to add in: RewriteRule ^login$ ...
3
votes
1answer
418 views

Disallow file edit not preventing plugin install

I have a little demo site (admin details are listed publicly), and I've configured the wp-config.php to disallow file edits, so in theory no one can install a theme / plugin. define( ...
1
vote
1answer
29 views

Frontend Password change

First off, I apologize if there is a duplicate of this roaming around somewhere...I have spent the better part of the past hour looking for the solution, with no luck, but maybe I just suck at picking ...
6
votes
6answers
4k views

How to hide admin account in BuddyPress? (for security reasons)

I have been working with WordPress for the past 3-4 years, but I am new to BuddyPress. I would like to hide the admin account completely from BuddyPress for security reasons. For example with a ...
1
vote
3answers
187 views

Best way to eliminate xmlrpc.php?

What is a best way to eliminate xmlrpc.php file from WordPress when you don't need it?
0
votes
2answers
1k views

How to sanitize select box values in post meta?

I have added a select box in the Post meta. Here is the code, and it works fine. My question is, do I need to sanitize the values before updating the post meta? If yes, how it should be done? This is ...
5
votes
3answers
136 views

Are the default salts secure?

When installing a fresh wordpress, one of the things one should do is, updating the salts in wp-config.php. The section looks like this define('AUTH_KEY', 'put your unique phrase here'); ...
0
votes
0answers
22 views

Upload file via settings page

Question: Is there a secure way to upload files via a plugin settings page? Context: Hello world! A feature of my plugin requires the user to upload one or more files. More precisely, JSON files ...
0
votes
1answer
24 views

What is more secure checking capabilities of user or checking role of user in WordPress plugin development

Suppose I need to check the logged in user is subscriber not anyone else. So if I check the capability like "read". Then subscriber is OK but "read" capability is also associated to admin/publisher as ...
2
votes
0answers
54 views

Does Wordpress contain “default” anti-SQL injection code that responds with a 404 error?

I've been through the “seven layers of the candy cane forest” on this one… :) Our plugin receives data via a POST request. On a particular site that has our plugin installed, we observed odd ...
2
votes
1answer
50 views

Is revealing just the AUTH_KEY a security issue?

I am troubleshooting a Wordpress plugin issue. It is a plugin that generates a zip file of existing files on the server and returns a link to download the file. The plugin ...
0
votes
2answers
49 views

Wordpress restrict plugin file direct access

i am developing a wordpress plugin, but before that i have checked the code for the few plugin already developed. I have seen a common approach to restrict the direct where the plugin developer starts ...
0
votes
1answer
21 views

Make “default” wordpress pages & features unaccessible

I am trying to create specific password-protected mini-sites (single wordpress pages) for specific users or specific passwords to be precise. For example someone clicks the url domain.com/url1 and if ...
0
votes
0answers
15 views

Cross site domain cookies in Wordpress (v4.x)

I have a plugin that executes an external script (outside of Wordpress) that i'd like to make 'more secure'. I'd like to make this script only accessible/executable when logged in as the Wordpress ...
3
votes
2answers
58 views

Escaping built-in WP function return strings

Should one filter the output of builtin WP functions such as get_permalink() and well-known WP plugins such as ACF (Advanced Custom Fields) such as get_field()? For instance get_permalink() calls ...
23
votes
3answers
11k views

Getting a List of Currently Available Roles on a WordPress Site?

When writing WordPress plugins there is often a need to set up options for which roles on the site have access to certain functionality or content. To do this a plugin dev needs to fetch the list of ...