The security tag has no wiki summary.
3
votes
2answers
386 views
Setting WP Admin passwords to expire
I'm aware it's not a feature of Wordpress, but I was wondering if there was a way or a plug-in (haven't found one from searching) that allows me to force a user to change their password after a ...
3
votes
1answer
49 views
Why allow overriding crucial pluggable functions wp_verify_nonce and wp_create_nonce?
Among the functions in /wp-includes/pluggable.php are the functions wp_verify_nonce and wp_create_nonce. Both functions are very important in the protection against CSRF-attacks. However, it is easy ...
3
votes
1answer
73 views
Allow Profile HTML for select users
I know there are a ton of post out there about how to allow html in profiles. Most of these warn about the security risk of doing so. My thinking is there has to be a way to only allow users to use ...
3
votes
1answer
241 views
Masking logout URL
The primary goal is to hide that the site is driven by wordpress. I've got the login part all locked up, but the logout URL still has those blasted wp delineators that give away it's a wordpress site. ...
3
votes
1answer
406 views
What is the difference between strip_tags and wp_filter_nohtml_kses?
What is the difference between strip_tags and wp_filter_nohtml_kses. I tried to figure wp_filter_nohtml_kses from the source but it looks like it does something a bit more complex than strip all html ...
3
votes
2answers
1k views
How do I create a WP user outside of Wordpress and auto login?
I've built a directory of members on a non-WP site (using php and mysql). Each member can log in and update their details using a username and password.
I want to be able to get this to automatically ...
3
votes
1answer
647 views
Multiple ajax nonce requests
I have a feature in my current project that will be allow multiple ajax requests - I've got a single nonce request worked out (via this tute), but am somewhat unsure how to figure in multiple nonce ...
3
votes
1answer
108 views
Will my Wordpress site become vulnerable to Cross-Site Scripting (XSS) if I allow img tags in the comments area?
I'm planning to follow this tutorial in order to allow my subscribers to add images to comments (actually a custom post type called "Replies").
Wordpress filters <img> tags by default (except ...
3
votes
4answers
541 views
ensure user can only be logged in on one computer at a time?
how can i make sure a user can only be logged in on one computer at a time? I want to make a wordpress site that could potentially have paid accounts for content in the future. Is there anything built ...
3
votes
2answers
695 views
Can I force a password change?
When I create a new user, I would like to force that user to change their password on first log in, can this be done?
3
votes
3answers
831 views
Options for restricting access to wp-admin
So i've installed a plug-in which allows me to enable two-factor authentication for my users. The problem is that to enable the plug-in i have to log in as that user and enable it via their profile ...
3
votes
1answer
137 views
How to protect uploads in multisite if user is not logged in?
I am trying to set up a multisite intranet (using subdomains) where content on each sub-site is only accessible to users logged into their respective site. The problem I am having is trying to ...
3
votes
1answer
641 views
How to make media upload private? [duplicate]
Possible Duplicate:
How to Protect Uploads, if User is not Logged In?
I know how to mark a Page or Post as visible only to members, using the Member Access plugin. This way, the public ...
2
votes
4answers
520 views
What are the pros and cons of using a custom front-end to retrieve content from a Wordpress back-end
I've been building wordpress sites for a few years now and have noticed a few things that bother me.
1. It's fairly slow (awful blanket statement, I apologize)
My initial desire to create a ...
2
votes
1answer
91 views
Nonces can be reused multiple times? Bug / Security issue?
I've read that nonces are meant to be for one time use only, and after an ajax request, you should issue a new nonce so with the next ajax request, a new nonce would be sent to the server.
However, I ...
2
votes
2answers
311 views
Secure Validation of wp_editor in Theme Options
So I just found this great WPSE thread about security for themes/plugins. It answered most of my questions but it was created before the new wp_editor() function was built.
I have two TinyMCE editors ...
2
votes
3answers
116 views
How brute-forcer knows that the password is cracked for target username?
There are very many brute-force attacks (mostly for 'admin' username) on WordPress sites.
All these attacks are made automatically via post requests.
The question 1: how brute-forcer knows that the ...
2
votes
2answers
61 views
Can someone (Support of my themeprovider) get access to my server If I send them my admin login?
I have bought a WP theme from a huge provider (themeforest). But it has a lot of bugs. The support asked me to send my WP Admin Login/Password. What risk does this have?
I know the supportstaff will ...
2
votes
1answer
511 views
Encrypt emails?
We need to maintain HIPPA compliance for forms on our website that are currently mailed to an internal email address. While the user/customers provides the info over HTTPS, we still want to make sure ...
2
votes
1answer
219 views
Wordpress Malware Problem help! [duplicate]
Possible Duplicate:
Wordpress Trojan issue help!
I accessed the wordpress website I am building and received a warning about a trojan from my anti virus software. I have now checked the ...
2
votes
1answer
549 views
What is the relationship between cURL, WordPress and cacert.pem?
I've run into a problem concerning wp_remote_get() and the underlying cURL call. On some WordPress installations I see the following SSL error:
httprequest_failed: SSL certificate problem, verify ...
2
votes
1answer
233 views
Generate Wordpress salt
I am in need of a function that automatically generates and returns salts for Wordpress wp-config.php (Don't link me to their API, I'm looking for offline solution).
Does Wordpress core has this ...
2
votes
2answers
759 views
Correct Approach for Validating Custom Field Input
I have a custom post type with several custom fields. I am looking to do some validation on these fields because they will be used downstream by other services. So, it is important that it can't be ...
2
votes
1answer
47 views
Protecting against malicious code in Wordpress plugin updates
One of the most popular Wordpress plugins listed on the Wordpress plugins database got malicious code injected into it recently (April 2013):
...
2
votes
2answers
362 views
Renaming wp-content folder dynamically
Is it possible to rename the wp-content folder dynamically? I am building a custom framework to use on themes and it would be nice to set it up where it does everything on its own.
I am using this ...
2
votes
1answer
255 views
Extend the list of MIME-types supported by the builtin uploader in 3.3
Goal
I want to be able to extend the list of mime-types supported by the builtin uploader in wp 3.3.1
For example when I try to upload an .apk file to our class blog, I get a
Sorry, this file type ...
2
votes
2answers
140 views
wordfence scan warning on W3 Total Cache
I use Wordfence plugin which scans server side plugins with original plugin files to see if anything was modified by hacker/cracker. Today I got a warning and it shows these modifications on ...
2
votes
2answers
909 views
How does admin-ajax.php work?
we are having some issues with an external developer. i am not a wp person so i turn to the masses to help out.
we want to limit access to the wp-admin site to internal access only (via vpn). simply ...
2
votes
1answer
35 views
What is the most secure way to set up the MySQL user in WPMU?
I am setting up Subdomain based MU on my domain.Everything is hosted by me running on one CentOS/Webmin VPS. Will I be better off setting the MySQL user's domain as localhost, 127.0.0.1 or with a ...
2
votes
1answer
305 views
how can i embed wordpress backend in iframe
I have 2 websites http://www.aaa.com and http://www.bbb.com and need it show the same.
now i put iframe in index.html and upload to aaa.com. it's ok for frontend but it's doesn't work for backend, ...
2
votes
1answer
146 views
Stop wordpress automatically escaping $_POST data
I have a custom front end form which creates a custom post type post and have just discovered WordPress automatically escapes $_POST data in the same way that Magic Quotes does.
I have Magic Quotes ...
2
votes
1answer
94 views
Restricting access to content
I'm developing a functionality to let only customers and doctors have access to exam results. But i'm not so sure about the strenght of my code in securing view only to those authorised.
I've gotten ...
2
votes
1answer
118 views
Changing Table Prefixes - once done, am I good to go going forward?
In the book Beginning WordPress 3 the author advises that changing the default WP table prefixes can provide some slight security advantage (protects from SQL injection scripts). I found several ...
2
votes
2answers
5k views
How to change “wp-admin” to something else without search-replacing the core?
for example: foobar.com/wp/edit instead of foobar.com/wp/wp-admin
How would I do that?
I've tried using this in htaccess but it won't work:
##### ABOVE THIS POINT IS ALREADY INSERTED BY WORD PRESS
...
2
votes
1answer
210 views
Is it possible to post with Word 2007 via XML-RPC and limit categories by user?
I'm working on a project for a school district I work at where we want to use Word Press to have employees from all of the buildings post announcements and press releases via Word 2007. We will then ...
2
votes
0answers
222 views
comment_post_ID 0 (cannot remove from dashboard)
Ran across something a bit odd that I haven't seen before. A client has a pretty active blog and uses Akismet (paid) to protect against spam. At least once a day, they're reporting a spam comment that ...
2
votes
2answers
71 views
How to limit WordPress pages during updates?
I will be doing upgrades to the design and content of my Wordpress site. During this time I only want the homepage to be available. Is there a good way to lock this down (through a plug-in, etc.).
...
2
votes
2answers
777 views
Has anyone experience w/ WordPress (MultiSite) hidden users (possibly hacked)?
I have 2 WordPress MultiSite installs (on different accounts, but under the same HostGator reseller a/c) and both seem to have been compromised. I say "compromised" because the user_logins have been ...
1
vote
4answers
14k views
Is there any way to rename or hide wp-login.php?
Any way to change the wp-login.php url? It seems insecure that everyone that's ever used Wordpress could easily see if your site is using it, and get right to the login page.
There used to be a ...
1
vote
4answers
101 views
How to properly secure my Wordpress installation?
I'm currently on my own server (fredericpilon.com) with my own website.
Wordpress being kind of a big shot of CMS, it may be targeted by hacks.
Any tips and tricks on how to properly secure my ...
1
vote
3answers
89 views
Why users disable the WordPress update?
Users install plugins which disable update reminders.
Plugins:
disable WordPress Core Updates
disable WordPress Plugin Updates
disable WordPress Theme Updates
Look at the counter of plugins ...
1
vote
3answers
981 views
Why do I need to check if wp_nonce_field() exists before using it
i dont really understand why the check if the nonce function exists before running it ...
if ( function_exists('wp_nonce_field') )
wp_nonce_field('gmp_nonce_check');
i understand its for ...
1
vote
1answer
89 views
Why was my blog post inserted lot's of ad links by others?
I found that my blog posts are inserted lot's of ad links, I'm using WordPress 2.9.2, is there a known security vulnerability in it?
A screenshot : I post some codes on my blog, the ad links are ...
1
vote
2answers
4k views
What are the recommended database permissions for WordPress?
I just got WP running on my own server. I am not trying to lock things down more. What permissions should the db user have to my WP db?
1
vote
2answers
119 views
Weird problems after recovery from security breach
The shared server that I used for hosting my WordPress website was hacked recently, and many of the index.php files, plugin files and uploads were deleted, with my MySQL databases untouched. But after ...
1
vote
1answer
546 views
Securing wp-config leads to sensitive information leak on wp-settings
I read the following tutorial, which mentions moving your config file out of an HTTP-accessible folder.
http://codex.wordpress.org/Hardening_WordPress#Securing_wp-config.php
I did this, and it works ...
1
vote
1answer
68 views
Moving wp-config.php up 2 levels
Is it possible to change a setting so that wp-config.php could be moved up two directory levels (instead of the default 1 level)? This would allow the core WP files to be moved from public_html to a ...
1
vote
2answers
626 views
<?php echo $title ?> vs <?php echo esc_html( $title ); ?> Wordpress Security
Reading this great article Data Validation and Sanitization in Wordpress I've noticed that in my blog, in header.php, I used <?php echo $title ?> in a pair of codes.
According to the above ...
1
vote
2answers
73 views
esc_html__ security : what for in this example?
how does esc_html__ (the 2nd one) protect the $message variable from being hacked ? what's the point to use this protection here (the second one with a plain text)?
<?php
function unknown(){
...
1
vote
1answer
99 views
The 'https_local_ssl_verify' filter
I have run into some WordPress code which does POST requests to API sites and in the POST parameters for the SSL property it has
$params = array( 'body' => $_POST, 'sslverify' => ...
