Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

5
votes
1answer
1k views

Multiple ajax nonce requests

I have a feature in my current project that will be allow multiple ajax requests - I've got a single nonce request worked out (via this tute), but am somewhat unsure how to figure in multiple nonce ...
5
votes
6answers
221 views

Share same domain for wp-admin but for different website

I have site like http://www.foo.com http://www.bar.com And I've a wildcard SSL cert *.example.com, instead of buying two SSL certs for the above two domains, can I re-use my existing wildcard SSL ...
4
votes
4answers
753 views

What are the pros and cons of using a custom front-end to retrieve content from a Wordpress back-end

I've been building wordpress sites for a few years now and have noticed a few things that bother me. 1. It's fairly slow (awful blanket statement, I apologize) My initial desire to create a ...
4
votes
5answers
8k views

Is there a way to force ssl on certain pages

I want to force a secure connection on some of my pages (ones with forms), but I don't want the whole site to work with ssl (slows it down) Is there a way to configure specific pages to require ssl?
4
votes
1answer
2k views

When to use esc_html and when to use sanitize_text_field?

It seems that they do almost same type of job. So... When should I use esc_html() instead of sanitize_text_field()?
4
votes
3answers
794 views

Secure WordPress paid plug-in

I want to create a WordPress plug-in but also want to ensure that the plugin can only be used after it has been activated with a serial key that should be unique for each domain. What is the best way ...
4
votes
3answers
398 views

Disabled plugins are the security holes - rumor or reality?

I've read many WordPress Security blog articles, where the Security Experts're recommending some special matters to take care when somebody is concern about his/her WordPress site's security. Among ...
4
votes
2answers
4k views

Can upload doc and pdf but not ppt - not permitted for security reasons

"Insert search engine here" was pretty useless for this one - I've had a look through wp-includes/functions.php, wp-admin/includes/file.php etc. but not found a reason for the behaviour I'm getting. ...
4
votes
2answers
223 views

What does a security risk in a plugin look like?

My server was hacked this weekend. By the Russians! Of the 50+ domains on my server, every single one had a hacked .htaccess file which was redirecting search results and a few other things to a ...
4
votes
1answer
109 views

Why do I get accidental comments without (the required) email address?

Somebody translated one of my tutorials here (with my permission). All fine but I got comments that seem unintended on two of my tutorials that the translation links to. Now the weird thing is that ...
4
votes
2answers
702 views

How Attackers write script into my php files?

I have a blog created with wordpress, now i have a problem. Attackers writes javascript codes into my files. Let's assume i have holes in my plugin scripts, but how can they write into php files? ...
4
votes
1answer
104 views

What are the security reasons to disallow Microsoft Word uploads?

When I try uploading a .doc or .docx file I get this message: Sorry, this file type is not permitted for security reasons What are the security risks involved in a multisite installation ...
4
votes
3answers
145 views

Regular security checks - what steps should be included?

There are heaps of tutorials explaining how to secure a WordPress installation, but I couldn't find any that listed out steps for weekly or monthly security checks. What are some steps that you ...
4
votes
1answer
262 views

What is the most secure way to store post meta data in WP?

Sony's recent security "holes" showed how unsafe it can be to store data unencrypted. As some of you may know, I 'm working on re-releasing the free CRM theme Driftwood. What is the most secure way ...
4
votes
2answers
5k views

Limiting sessions to one IP at a time

On a site with premium user account subscriptions, I'd like to be able to limit logins to one computer at a time. The most straightforward way to accomplish this would be to limit by IP, but I haven't ...
4
votes
1answer
982 views

What's the difference between esc_* functions?

I've read Professional WordPress and it says: esc_html function is used for scrubbing data that contains HTML. This function encodes special characters into their HTML entities esc_attr ...
4
votes
1answer
743 views

Securing wp-admin folder - Purpose? Importance?

I am trying to understand how to secure a WordPress site. One security task I do not understand is...How important is it to protect the "wp-admin folder"? For example, I would consider limit login ...
4
votes
2answers
211 views

Is WP vulnerable when updating plugins or themes?

Once, I had a problem that somehow someone managed to change files of my website without FTP or SSH credentials. Probably he got in through WP (probably it wasn't a 'he', but an 'it', a bot), we said ...
4
votes
1answer
127 views

Will my Wordpress site become vulnerable to Cross-Site Scripting (XSS) if I allow img tags in the comments area?

I'm planning to follow this tutorial in order to allow my subscribers to add images to comments (actually a custom post type called "Replies"). Wordpress filters <img> tags by default (except ...
4
votes
1answer
63 views

What security concerns should I have when setting FS_METHOD to “direct” in wp-config?

I have recently had an issue where I have been unable to install the WP Smush Pro plugin because I don't have the Manual Install or One-Click Installation options available. I came across this post ...
4
votes
1answer
427 views

How to protect uploads in multisite if user is not logged in?

I am trying to set up a multisite intranet (using subdomains) where content on each sub-site is only accessible to users logged into their respective site. The problem I am having is trying to ...
4
votes
1answer
205 views

Run WordPress frontend and backend in different domains

I want to run my WP frontend as www.example.com and my backend (i.e. wp-admin) as user1.example.org, is it possible? The reason is I want to host lot of sites in a single server which has only 1 IP ...
4
votes
2answers
303 views

Make password invalid once logged out of password-protected page

In a WP-based site I have a custom form which I need to hide from the general public and give access to only a select few who would then get a password from me, enter it and access the form and submit ...
4
votes
0answers
42 views

Should I check for ABSPATH in Themes? [duplicate]

I recently browsed WooCommerce source, and it appears that they're doing this: <?php /** * The template for displaying product content within loops. * * Override this template by copying it to ...
4
votes
2answers
1k views

wp.getUsersBlogs XMLRPC Brute Force Attack/Vulnerability

After the holiday weekend, one of the larger sites I manage had a brute force attack on it. The attacker was attempting to use the wp.getUsersBlogs function and a list of popular usernames and ...
3
votes
5answers
471 views

WordPress and Security

Are there some simple ways to beef up the security on a WordPress site?
3
votes
2answers
1k views

Secure Validation of wp_editor in Theme Options

So I just found this great WPSE thread about security for themes/plugins. It answered most of my questions but it was created before the new wp_editor() function was built. I have two TinyMCE editors ...
3
votes
1answer
350 views

Nonces can be reused multiple times? Bug / Security issue?

I've read that nonces are meant to be for one time use only, and after an ajax request, you should issue a new nonce so with the next ajax request, a new nonce would be sent to the server. However, I ...
3
votes
2answers
214 views

Brute force attack?

I'm seeing this quite often: No OS, same Browser, weird hostname -- they're definitely not real users. Can I do anything to take precautions before they do something? Thanks!
3
votes
1answer
1k views

Is it true $wpdb->get_results is faster than WP_Query in most cases?

On my homepage, I have a section where I have to display the last five featured posts, where a featured post is simply a post with a custom field is_featured set to 1. I achieved what I want with two ...
3
votes
1answer
82 views

Secure my “add_settings_field” translation?

I am using "add_settings_field" and want to provide translation for it , but my problem is security. So is __('My Checbox:' , 'domain') secure enough for translation? If not what can I do about it? I ...
3
votes
3answers
111 views

How can I easily verify a core or plugin update has not broken anything?

I'm looking for ways to make updating WordPress less frightening for me. I created around 30 company websites based in WP in my career and I feel somewhat responsible for them in regards to security. ...
3
votes
1answer
993 views

Encrypt emails?

We need to maintain HIPPA compliance for forms on our website that are currently mailed to an internal email address. While the user/customers provides the info over HTTPS, we still want to make sure ...
3
votes
2answers
2k views

Is there a security risk giving someone temporary access to my blog's code?

My blog is painfully slow for the last few days, and I would like to pay someone (anyone?) 15 BitCoins to optimize it for me (I would do it myself, but I'm not sure I have the time right now). It's ...
3
votes
2answers
78 views

Any reason to be concerned by a wave of “zombie” blog signups?

I maintain a blog for a friend of mine. It's basically an aggregater of videos from other embeddable video sites, and provides a way for users to comment on those videos. Not really high-value ...
3
votes
1answer
74 views

Garbage in beginning of wp-config.php - was this WP installation compromised?

I hadn't realized that one of my WP sites wasn't being accessed in the last months, and consequently not being updated, and today I have found that my config.php has some garbage in the beginning of ...
3
votes
2answers
157 views

Is it safe to assume that a nonce may be validated more than once?

From what I have gathered, once a nonce is generated it is valid for reuse for the next 48 hours. Is it safe to code with this in mind? I'm writing a plugin that does a bit of toing and froing with ...
3
votes
1answer
837 views

When to use esc_url, esc_html, esc_attr, and friends?

Discovered esc_url today while customizing an _s theme. I understand what the function does (sanitizes the URL inside), but what I'm unsure of is the scope of its use. It makes sense to me that if ...
3
votes
1answer
736 views

Generate Wordpress salt

I am in need of a function that automatically generates and returns salts for Wordpress wp-config.php (Don't link me to their API, I'm looking for offline solution). Does Wordpress core has this ...
3
votes
1answer
1k views

What is the difference between strip_tags and wp_filter_nohtml_kses?

What is the difference between strip_tags and wp_filter_nohtml_kses. I tried to figure wp_filter_nohtml_kses from the source but it looks like it does something a bit more complex than strip all html ...
3
votes
2answers
536 views

Setting WP Admin passwords to expire

I'm aware it's not a feature of Wordpress, but I was wondering if there was a way or a plug-in (haven't found one from searching) that allows me to force a user to change their password after a ...
3
votes
2answers
4k views

Password protect some uploaded files, so only logged-in users can view them

I would like to protect some uploaded files, so that they are not publicly accessible (they are not accessible without a login). I'm uploading some PDF files, and I'd like to mark some of them as ...
3
votes
1answer
141 views

Why allow overriding crucial pluggable functions wp_verify_nonce and wp_create_nonce?

Among the functions in /wp-includes/pluggable.php are the functions wp_verify_nonce and wp_create_nonce. Both functions are very important in the protection against CSRF-attacks. However, it is easy ...
3
votes
1answer
275 views

Allow Profile HTML for select users

I know there are a ton of post out there about how to allow html in profiles. Most of these warn about the security risk of doing so. My thinking is there has to be a way to only allow users to use ...
3
votes
1answer
2k views

Masking logout URL

The primary goal is to hide that the site is driven by wordpress. I've got the login part all locked up, but the logout URL still has those blasted wp delineators that give away it's a wordpress site. ...
3
votes
3answers
1k views

Options for restricting access to wp-admin

So i've installed a plug-in which allows me to enable two-factor authentication for my users. The problem is that to enable the plug-in i have to log in as that user and enable it via their profile ...
3
votes
1answer
243 views

Do Cookies Need to be Sanatized Before Being Saved?

I recently wrote a plugin and now I'm backtracking a bit to sanitize any and all user input. I know that I should sanitize anything that comes from $_GET or $_POST as a user can insert malicious ...
3
votes
2answers
2k views

How do I create a WP user outside of Wordpress and auto login?

I've built a directory of members on a non-WP site (using php and mysql). Each member can log in and update their details using a username and password. I want to be able to get this to automatically ...
3
votes
4answers
1k views

ensure user can only be logged in on one computer at a time?

how can i make sure a user can only be logged in on one computer at a time? I want to make a wordpress site that could potentially have paid accounts for content in the future. Is there anything built ...
3
votes
2answers
783 views

Can I force a password change?

When I create a new user, I would like to force that user to change their password on first log in, can this be done?