Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

3
votes
1answer
400 views

Disallow file edit not preventing plugin install

I have a little demo site (admin details are listed publicly), and I've configured the wp-config.php to disallow file edits, so in theory no one can install a theme / plugin. define( ...
2
votes
1answer
54 views

Is it safe to enqueue a font style without putting http or https?

I have seen a few WordPress sites and tutorials enqueuing fonts like this. Does this work with http and https sites? Is it safe to do this? I see these exact URL's in the source code when testing ...
2
votes
1answer
200 views

Which of WordPress's .php files need to be directly accessible via HTTP?

I'm trying to tighten up security on my WordPress installation, and one of the things that seems like it might be a good idea is preventing all of the internal-use .php files from being accessed ...
1
vote
1answer
49 views

Failed login attempts

I'm using WordFence for site monitoring and overall security. I'm seeing some failed login attempts from a couple of different locations with username "admin" and "companyname". I'm not familiar with ...
1
vote
1answer
69 views

Is it important to sanitize inputs in a shortcode that will be used in site that only I will post to?

Is there any security risk in not sanitizing shortcodes in a wordpress site if I am the only one who has access to the admin panel?
1
vote
1answer
88 views

Is it safe to allow non-admin users access to media uploader

Hi fellow Wordpress users :) I wanted to ask is it safe to allow non-admin users access to WordPress media uploader. Can they inject a virus while uploading media? How is WP system fighting against ...
1
vote
1answer
33 views

Is it safe to hand over the admin rights?

I have a shared web hosting account where I have several different websites running on WordPress. I want to hand over the admin rights for one of my WordPress installs to someone and I am wondering ...
1
vote
1answer
193 views

How can I secure a WordPress blog using OpenID from a single provider?

We're about to launch an internal blog for the company I work at. Much of the blog will be available to the public, but certain posts will be for employees only. Our intranet/extranet has an OpenID ...
1
vote
1answer
131 views

using rewrites to secure login page

I'm trying to be sneaky with iis to secure a wordpress login page (not my choice to run a windows server, but that's the reality of things). It's worked so far, only the login page itself loads itself ...
1
vote
1answer
33 views

correct tags for validating input types

I have following types of theme options inputs, which I need to validate. $numbers = "#1234"; $email = "abc@example.com"; $simeple_text = "How's going?"; $code = "<script ...
0
votes
1answer
62 views

Being hacked. Is there a list of Wordpress security holes I can check against?

I observe a file being uploaded into various plugin folders in my Wordpress site. The file is used to send out spam from my server and every time I remove it it gets uploaded to another folder. There ...
0
votes
1answer
162 views

.htaccess password protection bypassed

I’ve created .htaccess password in order to add a layer of security to a WordPress installation. The .htpasswd file is located one level above the installation. Yet, I’ve seen brute force attack ...
0
votes
1answer
105 views

Downloading File from Outside Web Root

I've set up some code to download zip files that exist in a folder above the web root. The download will be triggered from a user account page within WordPress. They don't need to be bank-level ...
0
votes
1answer
255 views

What is pclzip.lib.php file that wordfence think it's a malicious code

I have checked original wordpress and this file isn't there but this file comes back every time I deleted it. Do you think it's a malicious script? Path: /wp-admin/uploader/pclzip.lib.php Code: ...
0
votes
1answer
40 views

Suspicious lines of code

Our company website was handed to me and source code was created by previous person. I noticed that there are lots of . I am getting suspicious with these I have the urge to delete these 18 lines of ...
0
votes
1answer
38 views

Password-protect feed and make it usable in major aggregators

A WordPress site I'm on uses WordPress's default cookie-based authentication. This means that the RSS feed of the page is password-protected and can only be read when the cookie is available. ...
0
votes
1answer
49 views

RESTRICT EDIT of PHP files?

I wanted to restrict access to ALL Administrators to have access to EDIT any php file (Like Theme+plugin editor AND ETC..) I have developed a plugin, named System Edit Restriction. Currently, I use ...
0
votes
1answer
228 views

wp-content - permissions for files/folders created by apache

My wp-content folder has owner 'User' and group 'www-data'. The permissions are 775 for folders and 664 for files, so the server can write inside folder. But when the server creates folder and files ...
0
votes
1answer
101 views

WP upload/select image , isn't this a security issue?

If in image upload frame I select a zip http://prntscr.com/6ypjlv, it does not show it in list of files but it is up http://prntscr.com/6ypjvp shouldn't we only be able to upload image types if ...
0
votes
1answer
380 views

Single sign-on: wp_authenticate_user vs wp_authenticate

I have a wordpress site (lets call it site1) and another site with oauth2 (site2). When a new user is created, a record is created in both site1 and site2 databases with the same email as username, ...
0
votes
1answer
109 views

How can i see/log all requests coming from a registration form (not from the UI)?

I am talking about the REGISTER form PROBLEM: I have some requests that are coming from somewhere else - not from the user interface. I know this, because these requests don't have all the mandatory ...
0
votes
1answer
46 views

Write mysql credentials in plugin

I've to create a custom plugin to print data from a database different from the wordpress one. I'm using wpdb. Is it fine, from a security point, to write database credantials in the plugin files in ...
0
votes
1answer
20 views

Site is continuously accessing by several IPs

I have high traffic wordpress blog, but for last two days i am constantly getting the error "Error establishing a database connection". I have called to my hosting customer care and they are saying ...
0
votes
1answer
587 views

FORCE_SSL_ADMIN not working

Any ideas why define('FORCE_SSL_ADMIN', true); wouldn't work? I'm not getting any errors at all, but a http request to example.com/wp-admin isn't redirecting to https
0
votes
1answer
1k views

How do I properly update the Wordpress database password?

A site that I manage was recently compromised and I am going through the steps to harden and re-secure the site. I would like to change the MySql database password and want to make sure I do not take ...
0
votes
1answer
33 views

How to display post meta data in secure manner

I have have a custom post meta field where I can add a embedding code (a video for example, an iframe). Now I want to retrieve the code from the post meta and display it securely. I can display it ...
0
votes
1answer
101 views

How can I save a password securely as a settings field

I have a plugin that requires the user to enter a password (to access an external site) into a form field on the plugin settings page. Right now this is just saved as plain text, but I need to make it ...
0
votes
1answer
145 views

Any way to disable /wp-login.php redirecting to the site folder?

We have our WP installs in folders on the server. We created folders called wp-admin and login to thwart hackers. However, incredulously, when you type in /wp-login.php it REDIRECTS to our ...
0
votes
1answer
881 views

Change Login URL Without Plugin

I want to change the login url of my Wordpress install away from /wp-admin.php I am aiming to do so and am looking at changing the .htaccess file to add in: RewriteRule ^login$ ...
0
votes
1answer
35 views

Should I change the default file and folder permissions?

After reading the Hardening WordPress article I realise a good permission scheme is essential to the security of my WordPress installation. The article suggests a possible permissions scheme but my ...
0
votes
1answer
420 views

Which WordPress scripts need to be executable for a fresh installation?

For security reasons I need to block access to scripts that will not be executed on a fresh WordPress installation. Example: /index.php --> needs to be executable /wp-includes/cache.php --> should ...
0
votes
1answer
22 views

Validating values using Settings API?

I'm using the Settings API to create options for plugin. Do I need to validate the input values for the security (for example stripslashes etc)? (I could not find that part in most of the tutorials). ...
0
votes
1answer
184 views

using .htaccess only for wordpress security no plugins

Right now I am using bulletproof wordpress security for my websites, but when i am installing W3 Total Cache plugin it gives me some errors related to .htaccess file and bulletproof wordpress security ...
0
votes
1answer
80 views

404 errors in log showing urls with 'GET', plus and numerical code

My wordpress logs show 404 errors to URLs having the following pattern: http://example.com/path/++GET+http:/example/+0,48595,73506+- Web searches do not return answers because of the plus and minus ...
0
votes
1answer
96 views

Able to go to WordPress admin even after deleting auth cookies from request headers

I discovered that if I remove my auth cookies from my browser's request header, I am still able to view a page. Steps: Log into my WordPress installation Go to the wp-admin page In Chrome, use the ...
0
votes
1answer
51 views

Restrict Content for only Contributors via .htaccess

I have been using this code to restrict content download from wp-content/uploads for only logged in users: RewriteEngine On RewriteBase / # Add these lines right after the preceding two ...
0
votes
1answer
617 views

How to rename the WordPress wp-login.php running on IIS6?

My Windows 2003 VPS recently hang due to bots hammering my WordPress login php non-stop for hours (determined from IIS6 logs). This caused MySQL to use up all the allocated 1G RAM. After resetting ...
0
votes
1answer
97 views

Trying to understand nature of hacking

Today we saw suddenly two files created in root folder in one of our wordpress websites - file name owp.php and gmail.html On investigating the access logs following entries were found which seem to ...
0
votes
1answer
350 views

If I use an alternative login (e.g. CAS or other SSO) plugin, is my site protected from the recent brute force login attempts?

I've been hearing about the recent increase in brute-force WordPress login attempts due to a massive botnet attack. Everything I've read so far indicates that the attack works by just trying different ...
0
votes
0answers
174 views

Why are xmlrpc.php and wp-cron.php being called so often?

I'm running a Wordpress website and I have found from the server logs that xmlrpc.php and wp-cron.php are being requested (POST requests, of course) very frequently--including some suspicious ips that ...
0
votes
0answers
161 views

Hide wp-login.php but not the widget

I have a website which is still under nascent construction stage: http://42charts.com . Lately I find that couple of users are registering themselves in my site. It seems like a bot as the mails IDs ...
0
votes
0answers
469 views

Nonces and Cache

It's clear that form submissions and AJAX requests, especially sensible ones, need "nonces" to avoid certain exploits. However, with heavy use of caching systems it becomes harder to generate them ...
0
votes
0answers
317 views

Malware/Permission bug removal?

I'm facing a hell of a problem on a client's WP theme. Whenever I try to 'Activate' it, it gives me the following errors on a blank page: Warning: ...
0
votes
0answers
58 views

Allowing access to certain Wordpress created pages or posts with htaccess / htpasswd

Trying to figure out how to give access to a certain page, lets say http://mypage.com/page and not letting people access the main index via http://mypage.com. Or just simply disallow access to ...
0
votes
0answers
72 views

checking the form submit in right order

With help from experts on this site, I have been able to put together a plugin that allows to choose and submit categories from the front-end. Further, in order to make it a bit more secure I have ...
0
votes
0answers
114 views

Form That Submits Content Securely

I have built a WP site for a client. One of the pages has a form which my client's customers will use to submit material to my client, and one of the required fields is a file upload. My client ...
0
votes
0answers
47 views

False URL for shopping cart

OK. Re wording my question I have a digital product on a wordpress site Using a shopping cart I'm charging .99 cents for people to look at a video (going to charity) The cart directs them to a page ...
0
votes
0answers
35 views

Malware installation during plugin update?

I update my wordpress blog daily (current version: WordPress 3.5.2). Today I installed an update of "Search everything". After that, my webspace was infected by malware. Interestingly, my blog is ...
0
votes
0answers
29 views

Is [admin / admin] acceptable for all local websites?

Are there security issues with using the same credentials [admin / admin] for all client websites on a working, local server ?
-4
votes
0answers
17 views

Best security plugins

I'd like to know what's the best WP plugin for security, by blocking brute-force attack, XSS, SQL Injection and other kind of attacks.. Is there one or several good plugins?