Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

0
votes
2answers
92 views

Security: blocking direct access of php files

I found 2 ways to block direct access to php files (although it's not always necessary, see http://wordpress.stackexchange.com/a/63004/60539) The first one is: defined( 'ABSPATH' ) or die( 'No script ...
2
votes
2answers
51 views

Is the “lost password” feature truly a vulnerability?

Disabling Password Resets I've come across numerous security hardening articles relating to various measures for disabling password resets (i.e. lost password retrieval). https://www.google.com/...
1
vote
1answer
25 views

Handling email piping attachments and detecting unsupported file types

I have a plugin that I am working on which uses Email Piping. When an email is processed I want all the attachments from the email to be added to the WordPress Media Library. Currently I am using ...
0
votes
1answer
26 views

Webservice credential storage [duplicate]

I am developing a plugin that calls a web-service with a security header. Can anyone recommend a best practice for storing those credentials on the WordPress site? Right now my best option seems to be ...
0
votes
1answer
22 views

Adding Security Keys?

I read the paragraph at the codex on Security Keys. It offers the example - define( 'AUTH_KEY', 't`DK%X:>xy|e-Z(BXb/f(Ur`8#~UzUQG-^_Cs_GHs5U-&Wb?pgn^p8(2@}IcnCa|' ); define( '...
2
votes
2answers
115 views

site get login attempts after htaccess ip restriction

I'm using a security plugin that keep sending me emails: "A lockdown event has occurred due to too many failed login attempts or invalid username: Username: Admin IP Address: 195.154.243.31 IP Range:...
0
votes
3answers
39 views

Directory to store secure file

I have a website hosted on ASP.NET server and using wordpress to build my site. I've extended its functionalities using PHP code. At which directory do I store secure files such as (passwords and ...
1
vote
1answer
36 views

How Restrict access to admin dashboard by specific static ip?

i'm trying to restrict access to admin dashboard (wp-admin.php) by specific static ip so tried to add .htaccess to the wp-admin and set <FilesMatch "admin\.php$"> Order deny,allow Deny from ...
7
votes
2answers
236 views

Where to securely store API keys and passwords in WordPress?

I'm looking to use a few APIs and many come with keys, secret keys and passwords required to work. Where in WordPress can you store that information? Assuming anyone can hack your DB is there anyway ...
1
vote
2answers
82 views

Developing a secure front end post editing form

I want to add a front end post editing functionality to one of my Wordpress sites. I found a few plugins that do this, but they don't fits all my needs, so I decided to adapt an existing solution to ...
0
votes
0answers
18 views

Access passworded post with URL

I'm using Woocommerce to sell memberships which users must apply for and I've passworded them all to prevent unauthorized purchases. The best solution for me would be to have a link which 'unlocks' ...
0
votes
1answer
116 views

Developing a secure front end posting form

I want to add a front end posting functionality to one of my Wordpress sites. For more control and for more understanding of how this works (I am not a professional programmer) I choosed to use as a ...
0
votes
0answers
69 views

AJAX - nonce verification fails

I have a simple add-to-newsletter widge. I created a hidden input with nonce: $nlnonce = wp_create_nonce("add-newsletter"); echo '<input type="hidden" id="nlnonce" value="'.$nlnonce.'" />'; ...
3
votes
2answers
397 views

What is the wp-includes/certificates/ca-bundle.crt used for?

I'm working on a Wordpress site and I stumbled upon that certificate. I would like to know what it is for. Is Wp using it in any way? Can I delete it (or move it outside the document root)? Thanks
1
vote
2answers
97 views

Limit access to wp_admin

I'm attempting to limit access to wp_admin by IP address but I still have a few that are getting through. I have an htaccess file in my wp_admin folder with the following: # Block access to wp-admin. ...
-2
votes
2answers
235 views

How to Find WordPress site has backdoor login Codes

This is a very common question. There are plenty of plugins available in WordPress Plugins directory Under GPL. And many plugins have some backdoor login attempts. So, can't trust which plugin is ...
0
votes
0answers
13 views

Download security

I would like to create a secure download link for digital content e.g. PDFs, Zips etc. There's a few plugins that offer "secure downloads" but they just block the download page. I need it so the ...
8
votes
1answer
102 views

Why does wordpress have more then one salt

I guess I am exposing here some lack of security knowledge, but shouldn't it be enough to have one salt? why does there need to be four different ones define('AUTH_SALT', 'z(ly|p-aeKf^I~...
0
votes
1answer
95 views

Force SSL on a single page which is used as iFrame

I have one WordPress page that only contains a shortcode for a slider and is used by other websites as an iFrame. I need to force SSL one this one single page, but whatever I try, it is not being ...
0
votes
1answer
41 views

WordPress security [closed]

I created a website for my customer via wordpress and I uploaded it in their server ..we assume the user have the access in the whole server ..is it possible to protect this website from being used in ...
0
votes
1answer
23 views

How to protect Wordpress from security scanner [closed]

I wondered how can we protect our wordpress site from security fail scanner (ex: wpscsan) or scanner that gives info like if our site is using wordpress, plugins and theme (ex: What WordPress Theme Is ...
0
votes
1answer
88 views

Being hacked. Is there a list of Wordpress security holes I can check against?

I observe a file being uploaded into various plugin folders in my Wordpress site. The file is used to send out spam from my server and every time I remove it it gets uploaded to another folder. There ...
0
votes
0answers
33 views

Some crawlers/bots attempting to login with very good guesses. How?

I am trying to figure out if wordpress exposes the user e-mail or any other user information to crawlers/bots? I have a couple of security plugins that have been blocking these bots IPs on the third ...
0
votes
1answer
31 views

How to distinguish between a hack and an encoding error?

This morning I was working with a new image gallery plugin. After two hours of working with it, our server was struggling with a heavy network traffic, and then the server appeared to go out. ...
2
votes
1answer
161 views

How do I bypass Wordpress 404 handling?

How do I skip Wordpress altogether if there's a 404? I've tried adding an ErrorDocument to the .htaccess with no joy. The reason I'm asking is that we use a lot of custom fields and as such our site ...
0
votes
2answers
220 views

Allow SVG in WP step by step

I'm not strong in WP programming, bu I try to understand what to do to enable SVG in my site. I found that in need to add function below to functions.php: /** * Add SVG capabilities */ function ...
0
votes
1answer
69 views

Access log “POST /wp-login.php HTTP/1.0” 400

I'm looking the access log and I tried some lines as: IP - - [date and hour] "POST /wp-login.php HTTP/1.0" 400 ... What's the problem? Someone wants hack my blog? How can I resolve?
2
votes
2answers
94 views

Which ways can be used to log in to Wordpress?

FYI: This has been also posted here since I'm fairly new to this website and didn't know that the Wordpress part existed. Sorry for the repost. I'm currently trying to tighten the security for a ...
0
votes
1answer
32 views

Use Google authentication for pages within a website [closed]

We are trying to restrict certain pages of our website, and we use Google Apps for Business, so we were hoping we could leverage Google authentication. Everything I've found on the topic though is ...
0
votes
1answer
332 views

.htaccess password protection bypassed

I’ve created .htaccess password in order to add a layer of security to a WordPress installation. The .htpasswd file is located one level above the installation. Yet, I’ve seen brute force attack ...
0
votes
1answer
199 views

Downloading File from Outside Web Root

I've set up some code to download zip files that exist in a folder above the web root. The download will be triggered from a user account page within WordPress. They don't need to be bank-level secure,...
0
votes
2answers
146 views

brute force attack even though it is limited by IP

The security settings of a website we have was done according to Wordpress Recommendations and we did not have any single hacking attempts for months. Especially that wp-login.php and wp-admin are ...
0
votes
1answer
35 views

Hash user emails in database?

I have a wordpress based website, a very important thing is that no one should get to know the email addresses of the people who will admin. I will make the whole website private but I am still ...
0
votes
0answers
250 views

wp_verify_nonce fails always

I have created nonce fro my plugin and trying to verify it with another plugin pages. it fails always. both we are creating nonce with same parameter. why it fails. Plugin name : Wordfence it creates ...
1
vote
2answers
37 views

Assuming a theme is properly secured, how save is the WordPress admin?

Regarding point 3 in this (awesome) article on mikejolley.com. It states: Never trust user input, even that provided by admin users, because: You have no way of knowing the user is whom ...
0
votes
2answers
962 views

Full path disclosure on rss-functions.php

I was running some security test on my WordPress apps and noticed that all of them have a full path disclosure on the following url. I am sure this has been answered before but I can't find any ...
0
votes
1answer
538 views

What is pclzip.lib.php file that wordfence think it's a malicious code

I have checked original wordpress and this file isn't there but this file comes back every time I deleted it. Do you think it's a malicious script? Path: /wp-admin/uploader/pclzip.lib.php Code: http:/...
3
votes
4answers
1k views

Why should I use the esc_url?

This thing makes my coding difficult. Wordpress codex reasons the use of esc_url by talking vaguely about security. But is it really worth the trouble? For example, what's the important, practical ...
0
votes
1answer
49 views

How might I sanitize an XML file before WP Import? (Does wordpress verify or clean text when importing from an XML document? )

I have been tasked to import an older, offline wordpress site. I have the XML export file and a tar-ball of the file tree. Nothing has given me reason to worry, but does WP check the contents of the ...
0
votes
1answer
313 views

Remove tinyMCE from admin and replace with textarea

I have created a plugin wherein I have a custom post type. I am using post_content for some simple text. I do not need to offer any fancy editing or insertion of data for this field, so I looked for a ...
0
votes
0answers
29 views

Server misconfiguration- Protect WordPress core files correctly from being called directly?

With a fresh WordPress 4.3 installation I have the following problem: If I call URLs like http://www.example.com/wp-admin/menu.php the script is executed directly. Is this a security issue which ...
3
votes
2answers
105 views

Is /wp-login.php?redirect_to[] exploitable?

I have a wordpress site, against which I ran a penetration testing tool (debug mode was on at the time) It reported a (medium severity) issue in that errors were being displayed, and cited /wp-...
1
vote
1answer
73 views

How to delete Passwrd Protected posts cookies when a user logged out from the site

I wanted to delete all the cookies set for password protected posts when user logged out from the site after going through those Password protected posts. Is there any function to do this?
0
votes
0answers
26 views

wordfence reports exploited files but nothing visible when I edit file on server

Wordfence is reporting exploit code on some of the empty idnex.php files asswell as wp-config.php but when I access these files via ssh I see no malicious code. Wordfence reports this malicious code ...
0
votes
0answers
35 views

Is wp_kses safe against XSS

Is this code safe against complex types of XSS attack? $v = wp_kses(esc_attr( $bad_input ), $allowed); where $allowed = array( 'a' => array( 'href' => array(), 'title' =&...
0
votes
1answer
106 views

Can't reset WordPress password

I haven't logged onto my blog for years, and have, of course, forgotten the password. I click the 'Forgot' button and get a mail with a link, but that mail already says Sorry, that key does not ...
1
vote
2answers
136 views

How to check plugins for malicious code?

Our new hosting company ran a security check on our installation and I was very surprised to hear that a premium plugin we had purchased (Easy Media Gallery Pro) contained malicious code. (It may ...
0
votes
2answers
33 views

Is wp_login_form secure on a non secure page?

I am using the wp_login_form on a non-secure (http) website. The form is in a modal window, so that you can log in from any page on the website. Is using the wp_login_form() in this way safe? Thanks, ...
1
vote
2answers
154 views

Changing Table Prefix for an Existing WordPresss Site

Hoping someone can assist with Wordpress table prefix for an already established site. What is the best approach in changing the existing table prefix within both DB and wp-config file to reflect new ...
1
vote
0answers
35 views

Underscore Based Theme File Permissions in Git

I'm using underscores to develop my theme. For some reason git is saying that my file permissions are being changed from 10644 to 10744. I can override this in git's settings this but is it safe for ...