The security tag has no wiki summary.
6
votes
2answers
208 views
Securing Admin Accounts - Username Discovery
We've had Limit Login Attempts installed for some weeks now, and the number of brute force attempts occurring on wp-admin/wp-login is pretty amazing. At first the attempts were all with the username ...
0
votes
1answer
54 views
Auto log in hook is requiring a page refresh
I have a simple auto log in hook that looks like the following:
function auto_login() {
if (!is_user_logged_in()) {
//Removed some code for brevity.
$user = ...
35
votes
8answers
7k views
Is moving wp-config outside the web root really beneficial?
One of the most common security best practices these days seems to be moving wp-config.php one directory higher than the vhost's document root. I've never really found a good explanation for that, but ...
0
votes
1answer
52 views
Security to delete post by Admin
My code is so simple like when admin delete a post by Wordpress fucntion (PHP) and do action with jQuery
<?php
include('../../../../../../wp-config.php');
if(current_user_can('edit_posts')){
$id = ...
2
votes
2answers
141 views
wordfence scan warning on W3 Total Cache
I use Wordfence plugin which scans server side plugins with original plugin files to see if anything was modified by hacker/cracker. Today I got a warning and it shows these modifications on ...
-1
votes
1answer
84 views
FERPA Security and Gravity Forms [closed]
I have a bit of a new question that I haven't seen talked about anywhere.
I made a website for a school who has a Gravity Form setup on the site that collects students names. Recently this school ...
5
votes
2answers
415 views
File and directory permissions
I installed latest WordPress 3.5 in my CentOS server. When I tried accessing http://example.com/wp-includes/, I received a listing of the directory: (Index of wp-includes).
I added the following code ...
0
votes
1answer
671 views
Problem with permissions in wp-content/plugins
I have a WP installation on my local machine and trying to get my hands dirty with plugins. I wish to clone a project from github which has this plugin code. However, i dont have the permissions ...
0
votes
1answer
171 views
Wordpress Security - How to block alternative Wordpress access
I own a self-hosted Wordpress 3.5 blog. I'm working on its security and I'm trying to prevent non-writers from accessing anything admin-ish they shouldn't.
Recently I tried Better Wordpress Security, ...
0
votes
1answer
935 views
Receiving “This content cannot be displayed in a frame” error on login page
I am using a new domain for my WordPress directory in different server. When I click the meta links such "Login" or "register", I get this page:
This content cannot be displayed in a frame
To ...
-1
votes
1answer
99 views
Default installation permissions for wp-config.php
Recently I've noticed that many of the wordpress installations we have on our servers where being attacked and ifected by this thing
...
-2
votes
2answers
85 views
Is this a WordPress security bug?
<?php
if ( ! is_admin() ) return;
echo 'You should not see this if you\'re not logged in!';
?>
If you put this in a mu-plugin, and go to your admin, e.g., example.com/wp-admin/ while you are ...
6
votes
1answer
145 views
From a security standpoint, should bloginfo() or get_bloginfo() be escaped?
I've been reviewing a lot of information about WP theme and plugin security and understand the concept that you should escape attributes and HTML values in themes and plugins. I've seen bloginfo() and ...
0
votes
2answers
133 views
How to prevent plugins from sniffing/stealing other plugins' options?
Many plugins require configuration with sensitive data such as API keys, passwords, etc. When implementing these plugins, this sensitive data is stored using functions such as update_option() and ...
1
vote
1answer
111 views
Which of WordPress's .php files need to be directly accessible via HTTP?
I'm trying to tighten up security on my WordPress installation, and one of the things that seems like it might be a good idea is preventing all of the internal-use .php files from being accessed ...
0
votes
1answer
45 views
Is this plugin safe to run?
This is an extract of code from a wordpress plugin. Is it safe to run despite the variables not being filtered? Also does the wpdb class filter to prevent any injection?
list($email_id, $user_id, ...
-2
votes
3answers
705 views
nginx + wordpress: Best practices for configuring it to be secure, reliable, and fast?
BACKGROUND:
Running everything up on Linode. Having followed the "Getting Started," "Securing Your Server," "LEMP Server on Ubuntu 12.04," and the "Manage Web Content with WordPress" guides I was ...
0
votes
1answer
116 views
Admin can enter JavaScript - potential security risk?
WP 3.5/TwentyTwelve/Clean install. I try this when login as admin and editor.
I try add reply for first post "Hello World":
<script>alert('XSS')</script><script><</script>
...
0
votes
1answer
146 views
Basic password protection without using users and roles
I'm using WooCommerce, and want to be able to password protect products (or preferably whole categories if possible), but without using the Users & Roles functionality build into WP(because I need ...
0
votes
2answers
76 views
File permissions for wp-minify plugin
I am worried on installing Wp-Minify plugin. But it needs 777 permission for the cache directory located inside wp-uploads directory. Isn't it a security issue?
0
votes
1answer
84 views
security issue in wordpress?
I have installed wordpress in www.mysite.com/user and now suppose if someone is familiare with wordpress he/she can easily access my stuffs through www.mysite.com/user/members
...
2
votes
2answers
930 views
How does admin-ajax.php work?
we are having some issues with an external developer. i am not a wp person so i turn to the masses to help out.
we want to limit access to the wp-admin site to internal access only (via vpn). simply ...
2
votes
1answer
91 views
Nonces can be reused multiple times? Bug / Security issue?
I've read that nonces are meant to be for one time use only, and after an ajax request, you should issue a new nonce so with the next ajax request, a new nonce would be sent to the server.
However, I ...
0
votes
2answers
2k views
Protecting HTML5 video
I shall explain my situation as best I can so you can see where i'm coming from. I'm working on a wordpress site for a sports team, there are loads of teams. We want to put coaching sessions on our ...
1
vote
1answer
369 views
Disable directory browsing of uploads folder
I'm using Wordpress as a CMS for a simple website.
I want to prevent users from being able to browse the directories such as the wp-content/uploads folder or any directories of my theme.
My host does ...
3
votes
1answer
243 views
Masking logout URL
The primary goal is to hide that the site is driven by wordpress. I've got the login part all locked up, but the logout URL still has those blasted wp delineators that give away it's a wordpress site. ...
1
vote
0answers
138 views
Security - Ajax and Nonce use [closed]
I'm developing a site which posts a number of ajax calls from jquery to PHP and returns data from PhP to jquery.
Everything is working, but i'd to know if my approach to handling the calls is ok, in ...
-1
votes
1answer
28 views
How To Secure Word Press? [closed]
I am working in web hosting company so my job is to fix clients problem, one of the biggest problem we are facing right now is that our only word press customer site got hacked 'not one all of them', ...
0
votes
1answer
247 views
wp_insert_post disable HTML filter
I have input value "<iframe>....</iframe>" (param 'post_content'). When i execute wp_insert_post, function cut off my tag.
How to disable HTML filter in wp_insert_post ?
1
vote
3answers
985 views
Why do I need to check if wp_nonce_field() exists before using it
i dont really understand why the check if the nonce function exists before running it ...
if ( function_exists('wp_nonce_field') )
wp_nonce_field('gmp_nonce_check');
i understand its for ...
1
vote
1answer
37 views
About WordPress site security
If I install WordPress on my server, does it mean that Akismet is installed automatically?
If so - do I still need to create e-mail verification and captcha tools for improving site security (as I see ...
0
votes
1answer
46 views
When not to use Wordpress? [closed]
I have a project that I would like to do in WP, but can't really decide if it's the correct CMS or not.
Among the thing it is suppose to do is and I'm struggling with are:
Create Report/Publication ...
1
vote
0answers
59 views
using rewrites to secure login page
I'm trying to be sneaky with iis to secure a wordpress login page (not my choice to run a windows server, but that's the reality of things). It's worked so far, only the login page itself loads itself ...
-1
votes
3answers
622 views
Wordpress Hacks/Defacing [closed]
Im trying to figure out how Wordpress sites become defaced/hacked. I know development very well. I know how to secure code, etc. But I am finding recently, that tons of Wordpress sites are becoming ...
3
votes
1answer
137 views
How to protect uploads in multisite if user is not logged in?
I am trying to set up a multisite intranet (using subdomains) where content on each sub-site is only accessible to users logged into their respective site. The problem I am having is trying to ...
0
votes
0answers
32 views
How to make wordpress as a provate membership site? [closed]
can you help me how to create a stockiest/dealer website.
This site is not for public, is will be a membership site for reseller.
Reseller can see stock of products.
Administrator can change ...
2
votes
0answers
222 views
comment_post_ID 0 (cannot remove from dashboard)
Ran across something a bit odd that I haven't seen before. A client has a pretty active blog and uses Akismet (paid) to protect against spam. At least once a day, they're reporting a spam comment that ...
9
votes
2answers
159 views
How Can I Securely Implement a Password-less Login Feature?
Just posted a new plugin: No More Passwords
I currently have it tagged beta because logging into a platform is a sensitive issue and I don't want to release something that may have security holes. So ...
5
votes
3answers
444 views
Filter any HTTP request URI?
I want to filter any HTTP request URI done through the HTTP API.
Use cases:
The WordPress update check goes to http://api.wordpress.org/core/version-check/1.6/, but ...
-1
votes
2answers
482 views
How can I build an e-commerce website with wordpress for selling services? [closed]
If that is possible, I would want my site to be the safest possible and most secure when it comes to online monetary transactions. is that possible with wordpress? Also, are there any good themes ...
2
votes
2answers
363 views
Renaming wp-content folder dynamically
Is it possible to rename the wp-content folder dynamically? I am building a custom framework to use on themes and it would be nice to set it up where it does everything on its own.
I am using this ...
5
votes
2answers
985 views
Prevent access or auto-delete readme.html, license.txt, wp-config-sample.php
Just a quick question that might help a tad bit with security. I noticed that the readme.html file has the version number listed. It reappears after each upgrade and so do the licence.txt, and ...
0
votes
1answer
180 views
What is the best method to close off the backend?
The goal: Completely remove the ability to access the WordPress backend on the production domain. Ex. return a 404 for http://example.com/wp-admin
Purpose: I don't want any possibility of WordPress' ...
0
votes
1answer
55 views
How 'secure' are loops?
I am using loops as means of displaying personal meta and customer information on the frontend.
For example, I have a page which displays a user's 'profile' information to edit. Their profile is ...
6
votes
1answer
64 views
Is it safe to store a user setting you don't want the user to ever modify as a user option?
I have added some custom user options to the profile page on my site, and most are all OK for the user to modify themselves. These options live in their own section. The users have read access and ...
8
votes
2answers
3k views
Getting a List of Currently Available Roles on a WordPress Site?
When writing WordPress plugins there is often a need to set up options for which roles on the site have access to certain functionality or content. To do this a plugin dev needs to fetch the list of ...
2
votes
1answer
305 views
how can i embed wordpress backend in iframe
I have 2 websites http://www.aaa.com and http://www.bbb.com and need it show the same.
now i put iframe in index.html and upload to aaa.com. it's ok for frontend but it's doesn't work for backend, ...
2
votes
1answer
35 views
What is the most secure way to set up the MySQL user in WPMU?
I am setting up Subdomain based MU on my domain.Everything is hosted by me running on one CentOS/Webmin VPS. Will I be better off setting the MySQL user's domain as localhost, 127.0.0.1 or with a ...
0
votes
0answers
49 views
How should I debug this spam? [closed]
I manage a large news site powered by Wordpress. Recently, when visitors go to the site, they are redirected to very sketchy pages as this picture shows (The URL redirected to could differ every ...
0
votes
1answer
52 views
Wordpress custom admin functions security
i have a case in my admin panel where i need to call my own function that resides in my own php file, with a GET request. This function is actually removing entries from the database.
So, i would ...
