Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

0
votes
1answer
632 views

How to rename the WordPress wp-login.php running on IIS6?

My Windows 2003 VPS recently hang due to bots hammering my WordPress login php non-stop for hours (determined from IIS6 logs). This caused MySQL to use up all the allocated 1G RAM. After resetting ...
0
votes
1answer
43 views

Load all files from folder in theme – Security concerns?

I'm using this code below in a config file to automatically require other PHP files in the same directory and in subdirectories. This helps my work flow become more efficient. I'm concerned that I ...
-1
votes
5answers
3k views

Is it a bad idea to CHMOD 777 all the files on your site?

I think i heard that it might pose a security threat to your site, is that right? Makes it more vulnerable to it getting hacked? How should I undo this, which files should be chmod to what number?
-1
votes
2answers
2k views

How to improve WordPress security by hiding non public facing files?

e.g. curl -I http://ma.tt/blog/wp-config.php 200 OK The wp-config.php is not public facing file, since it currently just return blank page, so why not return 404 instead. (so will not be cached by ...
-1
votes
3answers
5k views

nginx + wordpress: Best practices for configuring it to be secure, reliable, and fast? [closed]

BACKGROUND: Running everything up on Linode. Having followed the "Getting Started," "Securing Your Server," "LEMP Server on Ubuntu 12.04," and the "Manage Web Content with WordPress" guides I was ...
-1
votes
1answer
421 views

suspicious boolean.php file in wp web root [closed]

Today I noticed in my web root a suspicious php file: boolian.php and serveral .html files with random names, all containing trojans. I remember yesterday I just uploaded and activated few themes I ...
-1
votes
1answer
28 views

Website that sells statistics

I'm building a website that will have statistics based on user activity on the website (online votes and views etc). People will have to pay to view those stats. I am utilising wodpress features ...
-1
votes
2answers
1k views

Change Login URL Without Plugin

I want to change the login url of my Wordpress install away from /wp-admin.php I am aiming to do so and am looking at changing the .htaccess file to add in: RewriteRule ^login$ http://yourdomain.com/...
-1
votes
2answers
152 views

hardened wordpress linux install

Are there any best practices for wordpress hardened install on Linux? I have recently had a WAMP server get malware attacked via word press so I want to harden the server up using read only apache ...
-1
votes
1answer
219 views

Default installation permissions for wp-config.php

Recently I've noticed that many of the wordpress installations we have on our servers where being attacked and ifected by this thing eval(base64_decode("...
-1
votes
2answers
2k views

Securing Contact Form 7 [closed]

I have a client who's website I created with Wordpress. It has a contact form created with contact form 7. This client is a subsidiary of a larger organization who's IT department runs scans on their ...
-1
votes
1answer
150 views

Will my Wordpress site become vulnerable after adding this functions which allows more HTML tags for subscribers?

I was thinking of adding the following lines of code to my functions.php file: /** * Change the default list of allowed html tags */ add_action('init', 'edittag', 10); function edittag() { ...
-1
votes
1answer
305 views

How to protect wp-admin from third party access?

How can the wordpress administration panel and the login page wp-login.php be hidden such that only the website administrator can access it? Can the URL be rewritten through some mod_rewrite rule ...
-1
votes
3answers
137 views

What techniques can a user employ to achieve a password rated “strong” in the WordPress password checker

I have strong passwords enforced for all my clients but I got some complaints recently as some users tried to change their password and gave up trying to achieve a strong rating. I was initially ...
-1
votes
1answer
26 views

is this code properly secured

The input will be an address. This is what I gather from looking at the Codex. See here: codex $wpdb->insert($address_table, array('address' => $address),array('%s'));
-2
votes
3answers
196 views

Should WordPress Add Options to Enhance Security or Leave it to plugin developers?

Based on the passion engendered with the responses to this question. It appears that the answer is a resounding "Nothing!" or "leave it to plugin developers to handle, WP is already secure enough"... ...
-2
votes
3answers
1k views

Wordpress Hacks/Defacing [closed]

Im trying to figure out how Wordpress sites become defaced/hacked. I know development very well. I know how to secure code, etc. But I am finding recently, that tons of Wordpress sites are becoming ...
-2
votes
2answers
131 views

Is this a WordPress security bug?

<?php if ( ! is_admin() ) return; echo 'You should not see this if you\'re not logged in!'; ?> If you put this in a mu-plugin, and go to your admin, e.g., example.com/wp-admin/ while you are ...
-2
votes
2answers
235 views

How to Find WordPress site has backdoor login Codes

This is a very common question. There are plenty of plugins available in WordPress Plugins directory Under GPL. And many plugins have some backdoor login attempts. So, can't trust which plugin is ...
-2
votes
1answer
1k views

Step by Step Instructions for Making Media/Uploads Private to Only Logged-In Users

all. I found this site via a Google search that led me to this topic: How to Protect Uploads, if User is not Logged In? It looks like that solution would work for my situation (including hakre's ...
-2
votes
2answers
2k views

Is there a secure way for the public to submit images, videos, and documents using WordPress?

I want the public to submit images, photo simulations, models, video, animation, illustrated narration, papers and other publications and multimedia. images - 30" x 42" 300 dpi . pdf format file size. ...
-3
votes
0answers
16 views

Save banking information to bill client by myself [on hold]

I am looking for a CRM manager that allow people to register on my website. The main feature i need is to save banking information of my client because i will deliver the service FIRST and then bill ...
-3
votes
1answer
217 views

How to make a WordPress site unhackable (except during during upgrade/plugin update)?

We've had numerous cases where client's WordPress based sites have been hacked due to various reasons, mostly related to a unsecured PHP file inside a theme allowing POST uploads and planting a ...