Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

1
vote
2answers
62 views

Moving wordpress out of the public directory

Is there a way to move wordpress out of the public html directory? The PHP files responsible for generating html output should be hosted but the php files responsible for database connections and ...
2
votes
1answer
76 views

How does Cross Site Scripting (XSS) work exactly? [closed]

On WordCamp Europe I attended the talk by Brad Williams on Writing Secure WordPress Code and I would like to make sure that I implement these tips in my own code. In his presentation he gives the ...
0
votes
0answers
16 views

What is the Best Way to Secure a Commercial Wordpress Plugin? [duplicate]

A friend has built a very powerful Wordpress plugin that was build mainly for his own use - and now he is considering opening it up to the public by selling it, but... But he's concerned that it will ...
0
votes
0answers
52 views

Encrypt Email Addresses at Rest

Some enterprise clients require that all email addresses be encrypted at rest (i.e., the actual values stored in the database must be encrypted). I've put together something that seems to do the ...
0
votes
0answers
11 views

Security threats if wp-config got exposed to the outsiders? [duplicate]

Usually, people setup so that the username/password can only access db from localhost. In case of php interpreter malfunction and the configuration wp-config got exposed to visitors, what harms could ...
2
votes
1answer
161 views

Confusion on WP Nonce usage in my Plugin

I created a small plugin where users can set multiple featured image by clicking Add New link from the meta box and remove them as well. The user can use Set featured image link to select featured ...
10
votes
1answer
128 views

Why does WordPress need my private ssh key to update?

Configuring WordPress to update within the application (i.e. WordPress) is ideal for me because of its convenience. Nonetheless, I'm troubled by the requirements. The requested fields that show up ...
-2
votes
1answer
330 views

Step by Step Instructions for Making Media/Uploads Private to Only Logged-In Users

all. I found this site via a Google search that led me to this topic: How to Protect Uploads, if User is not Logged In? It looks like that solution would work for my situation (including hakre's ...
0
votes
0answers
45 views

Allowing access to certain Wordpress created pages or posts with htaccess / htpasswd

Trying to figure out how to give access to a certain page, lets say http://mypage.com/page and not letting people access the main index via http://mypage.com. Or just simply disallow access to ...
1
vote
1answer
104 views

wp_insert_comment and security

I am using wp_insert_comment to offer an in-house better ajax conditional comments interface. i got it all working great. my only question is. What security measures should i take to make sure i ...
0
votes
1answer
45 views

Unwanted Links and Spam Wordpress Pages and Posts

In webmaster tools I have a number of crawling errors of the Google spider. for example http://mydomain.com/my-page/de/roulette.html They say they cannot crawl to this page.. but what kind of page ...
0
votes
0answers
47 views

checking the form submit in right order

With help from experts on this site, I have been able to put together a plugin that allows to choose and submit categories from the front-end. Further, in order to make it a bit more secure I have ...
0
votes
1answer
68 views

How do I determine if the user who registered is not spam?

I've recently set up a forum on my site with the bbpress-plugin. Now a user has registered on the site but the email-adress looks suspicious to me. How can I determine if the user is real? Is there a ...
0
votes
1answer
51 views

Hiding Media Source Links

I inserted an image onto my page from my WordPress media (Add Media -> Media Library -> Link To = None). However, when I right click on the page to view the source, I noticed the address to my media. ...
0
votes
0answers
61 views

Form That Submits Content Securely

I have built a WP site for a client. One of the pages has a form which my client's customers will use to submit material to my client, and one of the required fields is a file upload. My client ...
-2
votes
2answers
76 views

hardened wordpress linux install

Are there any best practices for wordpress hardened install on Linux? I have recently had a WAMP server get malware attacked via word press so I want to harden the server up using read only apache ...
0
votes
1answer
27 views

Secret keys in SCM

I have a WordPress installation in a Git repository and I'm wondering, if it's safe to have the 8 "secret keys" stored in there, or if I should insert them during deploy.
0
votes
2answers
63 views

Is that a malicious code?

Recently I have downloaded a wordpress theme . I use Theme Authenticity Checker (TAC) (http://wordpress.org/plugins/tac/) plugin to find any malicious data . According to it's report the theme ...
2
votes
2answers
74 views

Best Way to Enable Two Step Authentication

I'm looking for a bit of guidance on setting up a two step authentication system in WordPress. I've looked at a few of the main plugins and they seem to fall in to two camps: Add an extra field to ...
0
votes
1answer
31 views

Safe to say WordPress security releases don't have database upgrades

Since all security releases are based on last released codebase + security patch, I think its safe to say WordPress security releases don't have database upgrades, but I figured I will ask my fellow ...
0
votes
1answer
94 views

Selectively Disabling PHP via .htaccess in Root Directory

I'm reading up on securing WordPress and one of the commonly suggested techniques is to use an .htaccess file to disallow PHP execution in wp-content and wp-includes. I then read about another hack ...
0
votes
1answer
43 views

Why do Metabox use Nonces?

Why is it advised for admin panel metaboxes to use nonces? Every example I see of creation and saving metabox data there are nonces involved but aren't nonces a bit unnecessary in this case?
3
votes
1answer
65 views

Do Cookies Need to be Sanatized Before Being Saved?

I recently wrote a plugin and now I'm backtracking a bit to sanitize any and all user input. I know that I should sanitize anything that comes from $_GET or $_POST as a user can insert malicious ...
1
vote
0answers
102 views

Can I Remove xmlrpc.php completely?

My site is getting a lot of malicious traffic to domain.com/xmlrpc.php, to the point that the server is not being able to handle it. I tried to disable it via the wp-config.php, by adding this line: ...
12
votes
2answers
571 views

I found this in a plugin. What does it do? is it dangerous?

I found this in a plugin. What does it do? is it dangerous? add_action('admin_enqueue_scripts', 'pw_load_scripts'); if (!function_exists('wp__head'){ function wp__head() { ...
0
votes
2answers
31 views

Changing the default header name

Is it possible to change the default header.php file to something else for security reasons? It seems header.php is target for malicious attacks. I know all that, we have different named headers, I ...
0
votes
1answer
51 views

My website is getting too many dierect home arechives and this is increasing my bounce rate

My website is getting nearly 800 direct home archives daily, as a result the bounce rate of my website has increased. Usually i get only around 30 home archives a day These hits are not from Google, ...
1
vote
1answer
190 views

Securing my WordPress Files and Directories

I am new to WordPress and securely hosting it on Amazon EC2. My question is, how do I secure my WordPress files and directories properly? My file permissions are set to 644 and my directories are ...
0
votes
1answer
71 views

Can a WordPress administrator see other users' passwords?

Of course, an administrator in WordPress can reset other users' passwords (including that of other administrators). However, can a WordPress administrator see other users' passwords? Phrased ...
1
vote
1answer
91 views

Is there a way to create a URL (new WP page) that can only be accessed from a specific source?

To explain further, here's what I"m looking to do: Create a WP page Use the URL and implement it in a reader service that is hosted (not downloadable) that in order to read (& access the URL) ...
0
votes
0answers
29 views

False URL for shopping cart

OK. Re wording my question I have a digital product on a wordpress site Using a shopping cart I'm charging .99 cents for people to look at a video (going to charity) The cart directs them to a page ...
0
votes
1answer
48 views

Security and Must Use Plugins

From the codex article on Must Use Plugins: Can be enabled simply by uploading file to the mu-plugins directory, without having to log-in This feels like a potential security problem to me. ...
5
votes
1answer
92 views

Close a wordpress blog - keep site as it is but prevent hacks

Last summer I created a travelling-blog on my webspace to document my journey. Now the journey is over and I won't put any new posts in this blog. I also don't whish to have any new comments. How can ...
0
votes
1answer
429 views

How to rename the WordPress wp-login.php running on IIS6?

My Windows 2003 VPS recently hang due to bots hammering my WordPress login php non-stop for hours (determined from IIS6 logs). This caused MySQL to use up all the allocated 1G RAM. After resetting ...
0
votes
0answers
28 views

Malware installation during plugin update?

I update my wordpress blog daily (current version: WordPress 3.5.2). Today I installed an update of "Search everything". After that, my webspace was infected by malware. Interestingly, my blog is ...
3
votes
1answer
117 views

WordPress Capabilities: edit_user vs edit_users

The official documentation only mentions edit_users, but in the source I found many places are using edit_user, what is the difference? Are there any conventions for singular and plural capabilities? ...
1
vote
1answer
56 views

Security checking in meta_box save is reluctant?

For example, in this tutorial, the code suggested when saving meta box data is /* Verify the nonce before proceeding. */ if ( !isset( $_POST['smashing_post_class_nonce'] ) || !wp_verify_nonce( ...
2
votes
4answers
152 views

Will WordPress username displayed somewhere in the site?

I am considering enforcing all my users to use email as their login name. But I am afraid that the username is being used somewhere that is publicly accessible, e.g. author pages, such as that it will ...
0
votes
5answers
241 views

Prevent Brute Force Attack

I already used Limit Login Attempts wordpress plugin. Are there other ways to prevent brute force attacks? I'm worried because I saw a lot of locked out.
2
votes
1answer
2k views

Why Better WP security plugin returns 418 I'm a Teapot “error”?

I am working on the Wordpress website and all of a sudden after deploying it on the server, I started seeing a problem where some of the pages on my website return 418 I'm a Teapot as Response status ...
0
votes
0answers
126 views

Protect uploaded files in Wordpress 3.5 multisite

I have a multisite which I use for sharing private information (and files like pdf etc). Each client has its own 'site' example.com/client1, example.com/client2 etc I already set permissions to ...
0
votes
1answer
70 views

Form Post results in 404 Not Found [duplicate]

I am creating a POST-able form on the front-end of Wordpress (via a shortcode). If I submit this form without any input, the form submits fine. But as soon as I enter an data in the fields and POST ...
1
vote
2answers
2k views

Password protect some uploaded files, so only logged-in users can view them

I would like to protect some uploaded files, so that they are not publicly accessible (they are not accessible without a login). I'm uploading some PDF files, and I'd like to mark some of them as ...
1
vote
2answers
203 views

Is Wordpress vulnerable to “comment posting forgery”?

I recently scanned my Wordpress site using 6scan's security scanning service. It reported a high severity vulnerability: "Wordpress comment posting forgery". Technical details from 6scan: The ...
1
vote
2answers
37 views

Secure Pages Best Practice

I am in process of writing a plugin that has front-end shortcodes that display a user's information/data. If the user is not logged in, I need to redirect to a front-end login page/form. What would ...
4
votes
1answer
1k views

simple solution for restricting access to (some) uploads/downloads

Initial Situation For a site I'm setting up I was looking into the whole field of securing uploads/downloads and restricting access to them based on user roles/capabilities. Of course I have read ...
2
votes
3answers
95 views

How can I easily verify a core or plugin update has not broken anything?

I'm looking for ways to make updating WordPress less frightening for me. I created around 30 company websites based in WP in my career and I feel somewhat responsible for them in regards to security. ...
0
votes
2answers
169 views

WP Cron doesn't save <iframe> or <object> in post body

I am using wp_cron to auto grab posts from a remote website and save them in my wp db. NOTICE! I am executing my code from my plugin, not from my template functions.php or somewhere else. I have my ...
0
votes
0answers
277 views

Core files changed - site hacked?

Got a WordFence alert last night for one of our WordPress sites, saying that some WordPress core files had been changed: WordPress core file modified: wp-content/plugins/akismet/admin.php WordPress ...
1
vote
2answers
68 views

How to protect wp-admin through .htaccess?

I'd like to protect the /wp-admin/ directory at the server level. This means two logins. One through the server and another through WordPress. I believe this can be handled through .htaccess. Does ...