Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

5
votes
3answers
789 views

Disabled plugins are they security holes - rumor or reality?

I've read many WordPress Security blog articles where the Security Experts are recommending some special steps to take care when somebody is concerned about his/her WordPress site's security. One of ...
5
votes
3answers
140 views

Are the default salts secure?

When installing a fresh wordpress, one of the things one should do is, updating the salts in wp-config.php. The section looks like this define('AUTH_KEY', 'put your unique phrase here'); ...
5
votes
3answers
1k views

Moving wp-config.php: Can this be done after site launch?

For additional security, the suggestion is made to move the wp-config.php up one level. Can this be done after the site has already been launched? Any potential issues in doing this? Are there an ...
5
votes
2answers
4k views

Can upload doc and pdf but not ppt - not permitted for security reasons

"Insert search engine here" was pretty useless for this one - I've had a look through wp-includes/functions.php, wp-admin/includes/file.php etc. but not found a reason for the behaviour I'm getting. ...
5
votes
1answer
2k views

Should I remove install.php and install-helper.php?

Is keeping wp-admin/install.php and wp-admin/install-helper.php a security leak on the newer versions of wordpress? By default file permission on those files are 644. If there is any leak, what kind ...
5
votes
2answers
1k views

File and directory permissions

I installed latest WordPress 3.5 in my CentOS server. When I tried accessing http://example.com/wp-includes/, I received a listing of the directory: (Index of wp-includes). I added the following code ...
5
votes
2answers
6k views

Limiting sessions to one IP at a time

On a site with premium user account subscriptions, I'd like to be able to limit logins to one computer at a time. The most straightforward way to accomplish this would be to limit by IP, but I haven't ...
5
votes
2answers
2k views

What security concerns should I have when setting FS_METHOD to “direct” in wp-config?

I have recently had an issue where I have been unable to install the WP Smush Pro plugin because I don't have the Manual Install or One-Click Installation options available. I came across this post ...
5
votes
1answer
254 views

What to use instead of wp_kses() in user output

I need some help here. While developing a theme, I want to make sure there are no security issues. So all dynamic data must be correctly escaped for the context where it is rendered. I know how to ...
5
votes
1answer
1k views

Multiple ajax nonce requests

I have a feature in my current project that will be allow multiple ajax requests - I've got a single nonce request worked out (via this tute), but am somewhat unsure how to figure in multiple nonce ...
5
votes
6answers
301 views

Share same domain for wp-admin but for different website

I have site like http://www.foo.com http://www.bar.com And I've a wildcard SSL cert *.example.com, instead of buying two SSL certs for the above two domains, can I re-use my existing wildcard SSL ...
5
votes
0answers
88 views

Improve wordpress security by hiding non public resources

I'm new from wordpress and i want improve security of wordpress multisite by hiding non public resources, eg. wp-admin, wp-config etc. My setting seem to work, but i don't know if this setting can ...
5
votes
1answer
70 views

What is the purpose of having a token in cookies?

WordPress utilizes cookies for better security, and I've been trying to understand how exactly this could make a WordPress website more secure, and I found this article . There's a pretty decent ...
4
votes
4answers
811 views

What are the pros and cons of using a custom front-end to retrieve content from a Wordpress back-end

I've been building wordpress sites for a few years now and have noticed a few things that bother me. 1. It's fairly slow (awful blanket statement, I apologize) My initial desire to create a ...
4
votes
1answer
469 views

Nonces can be reused multiple times? Bug / Security issue?

I've read that nonces are meant to be for one time use only, and after an ajax request, you should issue a new nonce so with the next ajax request, a new nonce would be sent to the server. However, I ...
4
votes
3answers
857 views

Secure WordPress paid plug-in

I want to create a WordPress plug-in but also want to ensure that the plugin can only be used after it has been activated with a serial key that should be unique for each domain. What is the best way ...
4
votes
2answers
226 views

What does a security risk in a plugin look like?

My server was hacked this weekend. By the Russians! Of the 50+ domains on my server, every single one had a hacked .htaccess file which was redirecting search results and a few other things to a ...
4
votes
1answer
111 views

Why do I get accidental comments without (the required) email address?

Somebody translated one of my tutorials here (with my permission). All fine but I got comments that seem unintended on two of my tutorials that the translation links to. Now the weird thing is that ...
4
votes
2answers
826 views

How Attackers write script into my php files?

I have a blog created with wordpress, now i have a problem. Attackers writes javascript codes into my files. Let's assume i have holes in my plugin scripts, but how can they write into php files? ...
4
votes
1answer
133 views

What are the security reasons to disallow Microsoft Word uploads?

When I try uploading a .doc or .docx file I get this message: Sorry, this file type is not permitted for security reasons What are the security risks involved in a multisite installation ...
4
votes
2answers
221 views

Is it safe to assume that a nonce may be validated more than once?

From what I have gathered, once a nonce is generated it is valid for reuse for the next 48 hours. Is it safe to code with this in mind? I'm writing a plugin that does a bit of toing and froing with ...
4
votes
3answers
166 views

Regular security checks - what steps should be included?

There are heaps of tutorials explaining how to secure a WordPress installation, but I couldn't find any that listed out steps for weekly or monthly security checks. What are some steps that you ...
4
votes
1answer
291 views

What is the most secure way to store post meta data in WP?

Sony's recent security "holes" showed how unsafe it can be to store data unencrypted. As some of you may know, I 'm working on re-releasing the free CRM theme Driftwood. What is the most secure way ...
4
votes
1answer
1k views

What's the difference between esc_* functions?

I've read Professional WordPress and it says: esc_html function is used for scrubbing data that contains HTML. This function encodes special characters into their HTML entities esc_attr ...
4
votes
1answer
1k views

Securing wp-admin folder - Purpose? Importance?

I am trying to understand how to secure a WordPress site. One security task I do not understand is...How important is it to protect the "wp-admin folder"? For example, I would consider limit login ...
4
votes
2answers
213 views

Is WP vulnerable when updating plugins or themes?

Once, I had a problem that somehow someone managed to change files of my website without FTP or SSH credentials. Probably he got in through WP (probably it wasn't a 'he', but an 'it', a bot), we said ...
4
votes
1answer
128 views

Will my Wordpress site become vulnerable to Cross-Site Scripting (XSS) if I allow img tags in the comments area?

I'm planning to follow this tutorial in order to allow my subscribers to add images to comments (actually a custom post type called "Replies"). Wordpress filters <img> tags by default (except ...
4
votes
1answer
505 views

How to protect uploads in multisite if user is not logged in?

I am trying to set up a multisite intranet (using subdomains) where content on each sub-site is only accessible to users logged into their respective site. The problem I am having is trying to ...
4
votes
1answer
341 views

Run WordPress frontend and backend in different domains

I want to run my WP frontend as www.example.com and my backend (i.e. wp-admin) as user1.example.org, is it possible? The reason is I want to host lot of sites in a single server which has only 1 IP ...
4
votes
2answers
349 views

Make password invalid once logged out of password-protected page

In a WP-based site I have a custom form which I need to hide from the general public and give access to only a select few who would then get a password from me, enter it and access the form and submit ...
4
votes
0answers
46 views

Should I check for ABSPATH in Themes? [duplicate]

I recently browsed WooCommerce source, and it appears that they're doing this: <?php /** * The template for displaying product content within loops. * * Override this template by copying it to ...
4
votes
2answers
2k views

wp.getUsersBlogs XMLRPC Brute Force Attack/Vulnerability

After the holiday weekend, one of the larger sites I manage had a brute force attack on it. The attacker was attempting to use the wp.getUsersBlogs function and a list of popular usernames and ...
3
votes
5answers
484 views

WordPress and Security

Are there some simple ways to beef up the security on a WordPress site?
3
votes
2answers
1k views

Secure Validation of wp_editor in Theme Options

So I just found this great WPSE thread about security for themes/plugins. It answered most of my questions but it was created before the new wp_editor() function was built. I have two TinyMCE editors ...
3
votes
4answers
770 views

Why should I use the esc_url?

This thing makes my coding difficult. Wordpress codex reasons the use of esc_url by talking vaguely about security. But is it really worth the trouble? For example, what's the important, practical ...
3
votes
1answer
13k views

Receiving “This content cannot be displayed in a frame” error on login page

I am using a new domain for my WordPress directory in different server. When I click the meta links such "Login" or "register", I get this page: This content cannot be displayed in a frame To ...
3
votes
2answers
299 views

What is the wp-includes/certificates/ca-bundle.crt used for?

I'm working on a Wordpress site and I stumbled upon that certificate. I would like to know what it is for. Is Wp using it in any way? Can I delete it (or move it outside the document root)? Thanks
3
votes
1answer
1k views

Is wp_nonce_field vulnerable if you know the action name?

Is wp_nonce_field vulnerable if you know the action name? I am actually adding a hidden field with name = the name of the action name in my form so that my plugin can identify it. I want to know if ...
3
votes
1answer
111 views

Secure my “add_settings_field” translation?

I am using "add_settings_field" and want to provide translation for it , but my problem is security. So is __('My Checbox:' , 'domain') secure enough for translation? If not what can I do about it? I ...
3
votes
2answers
226 views

Brute force attack?

I'm seeing this quite often: No OS, same Browser, weird hostname -- they're definitely not real users. Can I do anything to take precautions before they do something? Thanks!
3
votes
1answer
2k views

Is it true $wpdb->get_results is faster than WP_Query in most cases?

On my homepage, I have a section where I have to display the last five featured posts, where a featured post is simply a post with a custom field is_featured set to 1. I achieved what I want with two ...
3
votes
3answers
114 views

How can I easily verify a core or plugin update has not broken anything?

I'm looking for ways to make updating WordPress less frightening for me. I created around 30 company websites based in WP in my career and I feel somewhat responsible for them in regards to security. ...
3
votes
1answer
1k views

Encrypt emails?

We need to maintain HIPPA compliance for forms on our website that are currently mailed to an internal email address. While the user/customers provides the info over HTTPS, we still want to make sure ...
3
votes
2answers
2k views

Is there a security risk giving someone temporary access to my blog's code?

My blog is painfully slow for the last few days, and I would like to pay someone (anyone?) 15 BitCoins to optimize it for me (I would do it myself, but I'm not sure I have the time right now). It's ...
3
votes
2answers
1k views

Correct Approach for Validating Custom Field Input

I have a custom post type with several custom fields. I am looking to do some validation on these fields because they will be used downstream by other services. So, it is important that it can't be ...
3
votes
2answers
80 views

Any reason to be concerned by a wave of “zombie” blog signups?

I maintain a blog for a friend of mine. It's basically an aggregater of videos from other embeddable video sites, and provides a way for users to comment on those videos. Not really high-value ...
3
votes
2answers
59 views

Escaping built-in WP function return strings

Should one filter the output of builtin WP functions such as get_permalink() and well-known WP plugins such as ACF (Advanced Custom Fields) such as get_field()? For instance get_permalink() calls ...
3
votes
2answers
102 views

Is /wp-login.php?redirect_to[] exploitable?

I have a wordpress site, against which I ran a penetration testing tool (debug mode was on at the time) It reported a (medium severity) issue in that errors were being displayed, and cited ...
3
votes
1answer
89 views

Garbage in beginning of wp-config.php - was this WP installation compromised?

I hadn't realized that one of my WP sites wasn't being accessed in the last months, and consequently not being updated, and today I have found that my config.php has some garbage in the beginning of ...
3
votes
2answers
9k views

Tips for finding SPAM links injected into the_content

I'm working on a client's site and I noticed that posts have a hidden <div> filled to SPAM links to dick pills, etc. Hoping to get lucky, I searched for some of the keywords in the database ...