Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

1
vote
1answer
44 views

Verify if user is wordpress logged in from another app since wordpress 4.0

I try to implement in my Node.js app a way to verify if the user cookie is valid. I've found some post in internet who explain me very well the things, but as i try to implement it, with the WordPress-...
2
votes
0answers
37 views

How to implement secure frontend image upload? [closed]

I would like to implement an public image upload in my Wordpress Theme with ajax. What's the secure way to do this? I have read many about security problems when allow users to upload files to the ...
1
vote
1answer
48 views

<meta name=“generator” content=“WordPress 4.4.2” /> neccessary?

Hello fellow WordPressers Today, I realized that most WordPress sites have this small footprint saying: <meta name="generator" content="WordPress 4.4.2" /> where it indicates what "system" ...
0
votes
0answers
32 views

Sanitization Function in Wordpress (Example Twentyfifteen.1.4 Default WP Theme)

The ThemeForest Submission Requires some sanitization functions that should be incorporated in the theme - This page says this. The WordPress theme should make use of the following inbuilt ...
7
votes
2answers
346 views

Where to securely store API keys and passwords in WordPress?

I'm looking to use a few APIs and many come with keys, secret keys and passwords required to work. Where in WordPress can you store that information? Assuming anyone can hack your DB is there anyway ...
3
votes
1answer
37 views

Extra themes - ok or bad?

I know I am a newbie here, but I'm just wondering, if you keep extra themes in your Wordpress setup, will it add bloat to your site? Can these other themes provide a security risk even if they aren't ...
0
votes
2answers
51 views

Correct and safe way to include php content in my page

I have a website where I use [insert_php] to insert php content to my page. What I do is simply use php's include inside insert_php to include my complex php script. I asked a question a while ago, ...
0
votes
2answers
33 views

Using an Encryption class in a WordPress Plugin

I'm making a WordPress plugin that works with sensitive data. So I need to store/retrieve date with a trusty encryption method. I did some searches among many php encryption wrapper classes, and ...
1
vote
2answers
143 views

How to check plugins for malicious code?

Our new hosting company ran a security check on our installation and I was very surprised to hear that a premium plugin we had purchased (Easy Media Gallery Pro) contained malicious code. (It may ...
6
votes
1answer
91 views

What is the purpose of having a token in cookies?

WordPress utilizes cookies for better security, and I've been trying to understand how exactly this could make a WordPress website more secure, and I found this article . There's a pretty decent ...
0
votes
2answers
60 views

Filter and validate user role in registration

I want to show a select box for user roles in the registration form. I am using this model: /* ROLES IN LIST REGISTRATION */ // 1. Add a new form element... add_action( 'register_form', '...
0
votes
2answers
62 views

Relative security of different releases of WordPress

Since each major-version of WordPress (like 4.0 or 4.4) gets its own series of security updates (currently 4.0.10 or 4.4.2), are the updated newer major-versions significantly more secure than updated ...
0
votes
0answers
19 views

Wordpress security - hiding WordPress directory [duplicate]

Note: edited my post to make it more "is it useful?" than "how to do it?" after toscho marked it as duplicate (the post tosho referenced is more or less what I had in mind for the "how to do it" part)....
0
votes
0answers
24 views

About plugin security

I'm developping a couple of simple plugins for specific use, and want to do it right. I've read multiple pages about plugin security, including those. Now, considering that my plugins have for ...
0
votes
1answer
32 views

Is it safe to give wordpress directories ownership to www-data?

I am not server or security expert so please excuse if my question sounds odd. I am running wordpress site on ubuntu 14.04 with nginx server. I had a problem while installing new plugin, So I have ...
9
votes
5answers
12k views

What are the recommended database permissions for WordPress?

I just got WP running on my own server. I am not trying to lock things down more. What permissions should the db user have to my WP db?
1
vote
0answers
16 views

Are there security risks in working directly in the themes folder that builds into a theme folder?

I'm wondering if there are any security risks in using the wp-content/themes/ folder as my project root and using wp-content/themes/my-theme as my build folder. Basically, in the themes folder I would ...
0
votes
1answer
21 views

Dangers to allowing Access-Control-Allow-Origin: * for Feeds only?

I want to use a function like this to allow access to the feeds from a variety of services but my knowledge of the security implications is limited. I think I'm being safe by limiting the access to ...
0
votes
0answers
17 views

Logout via Subdomain, non-wordpress page on a different server?

Similar to the question over at Get wp_logout_url function to work on external (non-Wordpress) page The problem I am facing is the fact the subdomain is on a different server so I am unable to ...
101
votes
12answers
38k views

Steps to Take to Hide the Fact a Site is Using WordPress?

I have a website for which we are trying to be discreet about the fact that we are using WordPress. What steps can we take to make it less obvious?
1
vote
1answer
75 views

Should I Worry About SQL Injection When Using wp_insert_post?

I have created a form to insert posts via front-end to users. I use wp_insert_post function. Should I worry about SQL injection or Does wp_insert_post function handle it?
-1
votes
2answers
1k views

Change Login URL Without Plugin

I want to change the login url of my Wordpress install away from /wp-admin.php I am aiming to do so and am looking at changing the .htaccess file to add in: RewriteRule ^login$ http://yourdomain.com/...
1
vote
1answer
40 views

Frontend Password change

First off, I apologize if there is a duplicate of this roaming around somewhere...I have spent the better part of the past hour looking for the solution, with no luck, but maybe I just suck at picking ...
6
votes
6answers
4k views

How to hide admin account in BuddyPress? (for security reasons)

I have been working with WordPress for the past 3-4 years, but I am new to BuddyPress. I would like to hide the admin account completely from BuddyPress for security reasons. For example with a ...
1
vote
3answers
1k views

Best way to eliminate xmlrpc.php?

What is a best way to eliminate xmlrpc.php file from WordPress when you don't need it?
0
votes
2answers
1k views

How to sanitize select box values in post meta?

I have added a select box in the Post meta. Here is the code, and it works fine. My question is, do I need to sanitize the values before updating the post meta? If yes, how it should be done? This is ...
6
votes
3answers
164 views

Are the default salts secure?

When installing a fresh wordpress, one of the things one should do is, updating the salts in wp-config.php. The section looks like this define('AUTH_KEY', 'put your unique phrase here'); ...
0
votes
0answers
28 views

Upload file via settings page

Question: Is there a secure way to upload files via a plugin settings page? Context: Hello world! A feature of my plugin requires the user to upload one or more files. More precisely, JSON files ...
0
votes
1answer
27 views

What is more secure checking capabilities of user or checking role of user in WordPress plugin development

Suppose I need to check the logged in user is subscriber not anyone else. So if I check the capability like "read". Then subscriber is OK but "read" capability is also associated to admin/publisher as ...
2
votes
0answers
62 views

Does Wordpress contain “default” anti-SQL injection code that responds with a 404 error?

I've been through the “seven layers of the candy cane forest” on this one… :) Our plugin receives data via a POST request. On a particular site that has our plugin installed, we observed odd ...
2
votes
1answer
51 views

Is revealing just the AUTH_KEY a security issue?

I am troubleshooting a Wordpress plugin issue. It is a plugin that generates a zip file of existing files on the server and returns a link to download the file. The plugin https://wordpress.org/...
0
votes
2answers
75 views

Wordpress restrict plugin file direct access

i am developing a wordpress plugin, but before that i have checked the code for the few plugin already developed. I have seen a common approach to restrict the direct where the plugin developer starts ...
0
votes
1answer
22 views

Make “default” wordpress pages & features unaccessible

I am trying to create specific password-protected mini-sites (single wordpress pages) for specific users or specific passwords to be precise. For example someone clicks the url domain.com/url1 and if ...
0
votes
0answers
19 views

Cross site domain cookies in Wordpress (v4.x)

I have a plugin that executes an external script (outside of Wordpress) that i'd like to make 'more secure'. I'd like to make this script only accessible/executable when logged in as the Wordpress ...
4
votes
2answers
73 views

Escaping built-in WP function return strings

Should one filter the output of builtin WP functions such as get_permalink() and well-known WP plugins such as ACF (Advanced Custom Fields) such as get_field()? For instance get_permalink() calls ...
0
votes
0answers
29 views

Vanilla Wordpress install, what can/should I put in disable_functions?

I would like to take steps to limit the damage a compromised Wordpress install can cause on the rest of my system. What system calls does Wordpress need? What can I put in the disable_functions ...
0
votes
1answer
31 views

How do I diagnose a plugin resource 404?

I'm doing some work for a new client (non-tech, their former tech person left). Their version of Wordpress is 4.3.2. The site gets some JavaScript errors on load. Using the Console I noticed two ...
21
votes
6answers
14k views

Can I Prevent Enumeration of Usernames?

Can I prevent enumeration of usernames on my wordpress site? I can see users at the moment using the WPScan tool.
2
votes
1answer
67 views

Do you need to escape hard coded plain text?

I started playing with the Underscores starter theme and noticed it uses esc_html_e() even on plain text: <a class="skip-link" href="#content"><?php esc_html_e( 'Skip to content', '_s' ); ?&...
1
vote
1answer
44 views

Using esc_url with a hard coded url

I've added following URL in my theme, but I have been informed that I must use esc_url(). I could not figure out, how can I use that function with following code? <a href="http://pinterest.com/pin/...
0
votes
2answers
2k views

How to secure or disable the RSS feeds?

I'm trying to set up WordPress as a CMS. As such, I want to disable the feeds since it's mostly a secured site. I've gone through all the Settings pages but found no setting to tweak or disable the ...
0
votes
0answers
51 views

PHP Code Sniffer - WordPress VIP Coding Standards

I'm trying to fix up my code to meet the WordPress VIP Coding Standards. I'm getting a couple of issues that I'd like to see go away, but i'm not sure what the best strategy is. The first issue is ...
0
votes
2answers
128 views

Security: blocking direct access of php files

I found 2 ways to block direct access to php files (although it's not always necessary, see http://wordpress.stackexchange.com/a/63004/60539) The first one is: defined( 'ABSPATH' ) or die( 'No script ...
2
votes
2answers
52 views

Is the “lost password” feature truly a vulnerability?

Disabling Password Resets I've come across numerous security hardening articles relating to various measures for disabling password resets (i.e. lost password retrieval). https://www.google.com/...
1
vote
1answer
26 views

Handling email piping attachments and detecting unsupported file types

I have a plugin that I am working on which uses Email Piping. When an email is processed I want all the attachments from the email to be added to the WordPress Media Library. Currently I am using ...
0
votes
1answer
26 views

Webservice credential storage [duplicate]

I am developing a plugin that calls a web-service with a security header. Can anyone recommend a best practice for storing those credentials on the WordPress site? Right now my best option seems to be ...
2
votes
2answers
125 views

site get login attempts after htaccess ip restriction

I'm using a security plugin that keep sending me emails: "A lockdown event has occurred due to too many failed login attempts or invalid username: Username: Admin IP Address: 195.154.243.31 IP Range:...
0
votes
1answer
22 views

Adding Security Keys?

I read the paragraph at the codex on Security Keys. It offers the example - define( 'AUTH_KEY', 't`DK%X:>xy|e-Z(BXb/f(Ur`8#~UzUQG-^_Cs_GHs5U-&Wb?pgn^p8(2@}IcnCa|' ); define( '...
0
votes
3answers
40 views

Directory to store secure file

I have a website hosted on ASP.NET server and using wordpress to build my site. I've extended its functionalities using PHP code. At which directory do I store secure files such as (passwords and ...
1
vote
1answer
36 views

How Restrict access to admin dashboard by specific static ip?

i'm trying to restrict access to admin dashboard (wp-admin.php) by specific static ip so tried to add .htaccess to the wp-admin and set <FilesMatch "admin\.php$"> Order deny,allow Deny from ...