Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

0
votes
1answer
47 views

Access log “POST /wp-login.php HTTP/1.0” 400

I'm looking the access log and I tried some lines as: IP - - [date and hour] "POST /wp-login.php HTTP/1.0" 400 ... What's the problem? Someone wants hack my blog? How can I resolve?
2
votes
2answers
87 views

Which ways can be used to log in to Wordpress?

FYI: This has been also posted here since I'm fairly new to this website and didn't know that the Wordpress part existed. Sorry for the repost. I'm currently trying to tighten the security for a ...
0
votes
1answer
28 views

Use Google authentication for pages within a website [closed]

We are trying to restrict certain pages of our website, and we use Google Apps for Business, so we were hoping we could leverage Google authentication. Everything I've found on the topic though is ...
0
votes
1answer
160 views

.htaccess password protection bypassed

I’ve created .htaccess password in order to add a layer of security to a WordPress installation. The .htpasswd file is located one level above the installation. Yet, I’ve seen brute force attack ...
0
votes
1answer
104 views

Downloading File from Outside Web Root

I've set up some code to download zip files that exist in a folder above the web root. The download will be triggered from a user account page within WordPress. They don't need to be bank-level ...
0
votes
2answers
112 views

brute force attack even though it is limited by IP

The security settings of a website we have was done according to Wordpress Recommendations and we did not have any single hacking attempts for months. Especially that wp-login.php and wp-admin are ...
0
votes
1answer
32 views

Hash user emails in database?

I have a wordpress based website, a very important thing is that no one should get to know the email addresses of the people who will admin. I will make the whole website private but I am still ...
0
votes
0answers
157 views

wp_verify_nonce fails always

I have created nonce fro my plugin and trying to verify it with another plugin pages. it fails always. both we are creating nonce with same parameter. why it fails. Plugin name : Wordfence it creates ...
1
vote
2answers
37 views

Assuming a theme is properly secured, how save is the WordPress admin?

Regarding point 3 in this (awesome) article on mikejolley.com. It states: Never trust user input, even that provided by admin users, because: You have no way of knowing the user is whom ...
0
votes
1answer
254 views

What is pclzip.lib.php file that wordfence think it's a malicious code

I have checked original wordpress and this file isn't there but this file comes back every time I deleted it. Do you think it's a malicious script? Path: /wp-admin/uploader/pclzip.lib.php Code: ...
0
votes
2answers
2k views

Block access to wp-admin

I'm attempting to use a .htaccess file to block access to the wp-admin folder. I've read through the Brute Force Attacks doc (https://codex.wordpress.org/Brute_Force_Attacks) and I've added the block ...
3
votes
4answers
381 views

Why should I use the esc_url?

This thing makes my coding difficult. Wordpress codex reasons the use of esc_url by talking vaguely about security. But is it really worth the trouble? For example, what's the important, practical ...
0
votes
1answer
36 views

How might I sanitize an XML file before WP Import? (Does wordpress verify or clean text when importing from an XML document? )

I have been tasked to import an older, offline wordpress site. I have the XML export file and a tar-ball of the file tree. Nothing has given me reason to worry, but does WP check the contents of the ...
9
votes
3answers
4k views

Prevent access or auto-delete readme.html, license.txt, wp-config-sample.php

Just a quick question that might help a tad bit with security. I noticed that the readme.html file has the version number listed. It reappears after each upgrade and so do the licence.txt, and ...
5
votes
2answers
993 views

What security concerns should I have when setting FS_METHOD to “direct” in wp-config?

I have recently had an issue where I have been unable to install the WP Smush Pro plugin because I don't have the Manual Install or One-Click Installation options available. I came across this post ...
0
votes
1answer
152 views

Remove tinyMCE from admin and replace with textarea

I have created a plugin wherein I have a custom post type. I am using post_content for some simple text. I do not need to offer any fancy editing or insertion of data for this field, so I looked for a ...
0
votes
0answers
27 views

Server misconfiguration- Protect WordPress core files correctly from being called directly?

With a fresh WordPress 4.3 installation I have the following problem: If I call URLs like http://www.example.com/wp-admin/menu.php the script is executed directly. Is this a security issue which ...
3
votes
2answers
98 views

Is /wp-login.php?redirect_to[] exploitable?

I have a wordpress site, against which I ran a penetration testing tool (debug mode was on at the time) It reported a (medium severity) issue in that errors were being displayed, and cited ...
1
vote
1answer
47 views

How to delete Passwrd Protected posts cookies when a user logged out from the site

I wanted to delete all the cookies set for password protected posts when user logged out from the site after going through those Password protected posts. Is there any function to do this?
0
votes
0answers
22 views

wordfence reports exploited files but nothing visible when I edit file on server

Wordfence is reporting exploit code on some of the empty idnex.php files asswell as wp-config.php but when I access these files via ssh I see no malicious code. Wordfence reports this malicious code ...
0
votes
0answers
24 views

Is wp_kses safe against XSS

Is this code safe against complex types of XSS attack? $v = wp_kses(esc_attr( $bad_input ), $allowed); where $allowed = array( 'a' => array( 'href' => array(), 'title' ...
91
votes
11answers
35k views

Steps to Take to Hide the Fact a Site is Using WordPress?

I have a website for which we are trying to be discreet about the fact that we are using WordPress. What steps can we take to make it less obvious?
0
votes
2answers
1k views

What do spammers gain by signing up as a user?

The majority of new user signups I receive on my Wordpress blog look dodgy, with @someblog.com, @somearticle.com, or @gmail.com addresses. What do they gain by signing up as a new user?
0
votes
1answer
83 views

Can't reset WordPress password

I haven't logged onto my blog for years, and have, of course, forgotten the password. I click the 'Forgot' button and get a mail with a link, but that mail already says Sorry, that key does not ...
0
votes
1answer
72 views

How to check plugins for malicious code?

Our new hosting company ran a security check on our installation and I was very surprised to hear that a premium plugin we had purchased (Easy Media Gallery Pro) contained malicious code. (It may ...
0
votes
2answers
28 views

Is wp_login_form secure on a non secure page?

I am using the wp_login_form on a non-secure (http) website. The form is in a modal window, so that you can log in from any page on the website. Is using the wp_login_form() in this way safe? Thanks, ...
5
votes
3answers
693 views

Disabled plugins are they security holes - rumor or reality?

I've read many WordPress Security blog articles where the Security Experts are recommending some special steps to take care when somebody is concerned about his/her WordPress site's security. One of ...
1
vote
0answers
27 views

Underscore Based Theme File Permissions in Git

I'm using underscores to develop my theme. For some reason git is saying that my file permissions are being changed from 10644 to 10744. I can override this in git's settings this but is it safe for ...
2
votes
1answer
54 views

Is it safe to enqueue a font style without putting http or https?

I have seen a few WordPress sites and tutorials enqueuing fonts like this. Does this work with http and https sites? Is it safe to do this? I see these exact URL's in the source code when testing ...
0
votes
1answer
40 views

Suspicious lines of code

Our company website was handed to me and source code was created by previous person. I noticed that there are lots of . I am getting suspicious with these I have the urge to delete these 18 lines of ...
0
votes
0answers
10 views

What is wp-admin/strebam_filter_register.php file?

I ran Sucuri Security integrity check for one of my wordpress websites which had been compromised by malware. I found two suspicious files: wp-admin/strebam_filter_register.php and ...
0
votes
1answer
38 views

Password-protect feed and make it usable in major aggregators

A WordPress site I'm on uses WordPress's default cookie-based authentication. This means that the RSS feed of the page is password-protected and can only be read when the cookie is available. ...
0
votes
0answers
22 views

WordPress and user security

When we talk about Information Security, many things come into mind and people tend to use CMS to be clear on security as CMS people do the job for you, in terms on hashing passwords, encryption etc. ...
1
vote
0answers
687 views

Core files changed - site hacked? [closed]

Got a WordFence alert last night for one of our WordPress sites, saying that some WordPress core files had been changed: WordPress core file modified: wp-content/plugins/akismet/admin.php WordPress ...
3
votes
1answer
107 views

Secure my “add_settings_field” translation?

I am using "add_settings_field" and want to provide translation for it , but my problem is security. So is __('My Checbox:' , 'domain') secure enough for translation? If not what can I do about it? I ...
0
votes
0answers
40 views

Force reauthentication/login for specific page for currently logged in users

I have a page that searches user information. The site is a record keeping site. I want it so that when people click the "View Records" link that they mus re-authenticate before proceeding. I'm not ...
0
votes
4answers
488 views

WP Cron doesn't save <iframe> or <object> in post body

I am using wp_cron to auto grab posts from a remote website and save them in my wp db. NOTICE! I am executing my code from my plugin, not from my template functions.php or somewhere else. I have my ...
0
votes
3answers
776 views

Wordfence detects change in wp-admin/includes/upgrade.php

I moved my site from hosting provider A and domain name B to hosting provider X and domain name Y. I had Wordfence in the old site. I just installed it in the new site and ran a scan. Wordfence found ...
2
votes
2answers
103 views

Is security a problem in Wordpress?

I am going to start a big corporate website for his car shop which is supposed be more secured. Is Wordpress okay to start a secured and reliable website? As far as i heard, Wordpress hackers ...
1
vote
0answers
113 views

How to set up fail2ban with WordFence?

I found a blog post that talks about setting up Wordfence and fail2ban but it's quite useless as there is no mention of any technical activity. Only that it took the author a total of 5 hours. I ...
0
votes
2answers
35 views

Secure Multiple WordPress Installations on shared hosting

Most shared hosting packages store all files of a given user under something like /user/myuser/www/ or /var/html. Addon domains are usually located under /var/html/domain1.com/, ...
0
votes
0answers
17 views

XSS Scripting in Cache files

On one of my client's sites I was going through a few of the pages ann noticed a popup appear with a spam advert on it. Finding this highly unusual I inspected the page source and found a bunch of ...
2
votes
1answer
32 views

Strange Search Queries in Apache Status

I am running a wordpress website with high traffic, my server load gets very high and while checking apache status i found flood of wordpress searches like this /?s=\"khabarnaak\"&id=39790 ...
0
votes
1answer
84 views

How many security plugins are too many? [closed]

I currently have three security plugins installed on WordPress, one of them I have a paid subscription to. Do you think this is overkill? I took a lot of steps to secure my WP site, and I'm worried ...
12
votes
1answer
699 views

For what security reasons are svgs blocked in the media uploader?

I see that SVGs are blocked by default in the media uploader and you have to add it as a supported MIME type in functions.php. What security reasons are behind this?
2
votes
1answer
75 views

Whats the safest way to output custom JavaScript and Css code entered by the admin in the Theme Settings?

I'm creating a theme in which I've created options for the admin to enter custom Javascript and Css code in the "Theme Settings" page (created using Options API). Now I'm just not sure how to output ...
8
votes
4answers
11k views

What are the recommended database permissions for WordPress?

I just got WP running on my own server. I am not trying to lock things down more. What permissions should the db user have to my WP db?
-3
votes
1answer
144 views

How to make a WordPress site unhackable (except during during upgrade/plugin update)?

We've had numerous cases where client's WordPress based sites have been hacked due to various reasons, mostly related to a unsecured PHP file inside a theme allowing POST uploads and planting a ...
1
vote
0answers
24 views

What is the purpose of having a token in cookies?

WordPress utilizes cookies for better security, and I've been trying to understand how exactly this could make a WordPress website more secure, and I found this article . There's a pretty decent ...
0
votes
1answer
48 views

RESTRICT EDIT of PHP files?

I wanted to restrict access to ALL Administrators to have access to EDIT any php file (Like Theme+plugin editor AND ETC..) I have developed a plugin, named System Edit Restriction. Currently, I use ...