Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

0
votes
0answers
14 views

Alternative ways to make ajax requests in wordpress [duplicate]

I'm currently having a problem with working with AJAX. Well not really a problem since I can pretty much do what I want to do. The only problem is my boss saying that the admin-ajax.php file is an ...
0
votes
0answers
11 views

Proper way to secure certain uploaded files [duplicate]

I'm working on a site which includes a members-only area. Once logged in, a user should see pages and posts that are otherwise hidden from view, and should be able to access file downloads which are ...
-1
votes
4answers
3k views

How to remove “Connection Information” requirement on localhost install of WP on MACOSX

I've just installed XAMPP on Mac OSX and when trying to install a theme or plugin in WP admin, I'm getting this screen. I've never gotten this on my shared hosting account. how to get rid of it on ...
-1
votes
1answer
23 views

is this code properly secured

The input will be an address. This is what I gather from looking at the Codex. See here: codex $wpdb->insert($address_table, array('address' => $address),array('%s'));
0
votes
0answers
51 views

Safe way to allow sample HTML code in comments?

I see that post comments do not allow short snippets of sample HTML code to be entered for safety reasons. But if you have a blog where you expect to have conversations about code, how do you handle ...
0
votes
0answers
14 views

Security: How to disallow viewing/browsing by author? [duplicate]

I've already inserted htaccess code to disallow searching for users by numeric id. However, one can still manually input a user name to view/browse by author, e.g. http://mywpsite.com/author/peter/ ...
0
votes
0answers
34 views

How to escape shortcode content? Do I even need to escape or validate?

I've written a small shortcode that wraps it's content into a HTML element, like so: [my_shortcode]The sun is shining today.[/my_shortcode] In my shortcode function, I basically return the string ...
-1
votes
3answers
3k views

nginx + wordpress: Best practices for configuring it to be secure, reliable, and fast? [closed]

BACKGROUND: Running everything up on Linode. Having followed the "Getting Started," "Securing Your Server," "LEMP Server on Ubuntu 12.04," and the "Manage Web Content with WordPress" guides I was ...
4
votes
5answers
5k views

Is there a way to force ssl on certain pages

I want to force a secure connection on some of my pages (ones with forms), but I don't want the whole site to work with ssl (slows it down) Is there a way to configure specific pages to require ssl?
0
votes
0answers
111 views

Nonces and Cache

It's clear that form submissions and AJAX requests, especially sensible ones, need "nonces" to avoid certain exploits. However, with heavy use of caching systems it becomes harder to generate them ...
0
votes
1answer
35 views

Restrict Content for only Contributors via .htaccess

I have been using this code to restrict content download from wp-content/uploads for only logged in users: RewriteEngine On RewriteBase / # Add these lines right after the preceding two ...
1
vote
1answer
32 views

Is it safe to hand over the admin rights?

I have a shared web hosting account where I have several different websites running on WordPress. I want to hand over the admin rights for one of my WordPress installs to someone and I am wondering ...
0
votes
0answers
111 views

Malware/Permission bug removal?

I'm facing a hell of a problem on a client's WP theme. Whenever I try to 'Activate' it, it gives me the following errors on a blank page: Warning: ...
0
votes
0answers
47 views

Allowing access to certain Wordpress created pages or posts with htaccess / htpasswd

Trying to figure out how to give access to a certain page, lets say http://mypage.com/page and not letting people access the main index via http://mypage.com. Or just simply disallow access to ...
0
votes
0answers
16 views

Permission of uploads folder [duplicate]

My Wordpress site was hacked today. When I investigated, I noticed that there were some malicious files under wp-content/uploads/ folder. I had set the permission of uploads folder to 777 for ...
0
votes
1answer
202 views

security concerns if using html data-* attribute for l10n?

I need to pass a localized multidimensional javascript object to a page. The object is constructed using php and represents some wp-theme settings. I cant find a way to utilize wp_localize_script for ...
2
votes
1answer
96 views

How does Cross Site Scripting (XSS) work exactly? [closed]

On WordCamp Europe I attended the talk by Brad Williams on Writing Secure WordPress Code and I would like to make sure that I implement these tips in my own code. In his presentation he gives the ...
0
votes
0answers
18 views

What is the Best Way to Secure a Commercial Wordpress Plugin? [duplicate]

A friend has built a very powerful Wordpress plugin that was build mainly for his own use - and now he is considering opening it up to the public by selling it, but... But he's concerned that it will ...
3
votes
1answer
658 views

What's the difference between esc_* functions?

I've read Professional WordPress and it says: esc_html function is used for scrubbing data that contains HTML. This function encodes special characters into their HTML entities esc_attr ...
0
votes
0answers
63 views

Encrypt Email Addresses at Rest

Some enterprise clients require that all email addresses be encrypted at rest (i.e., the actual values stored in the database must be encrypted). I've put together something that seems to do the ...
0
votes
0answers
11 views

Security threats if wp-config got exposed to the outsiders? [duplicate]

Usually, people setup so that the username/password can only access db from localhost. In case of php interpreter malfunction and the configuration wp-config got exposed to visitors, what harms could ...
4
votes
3answers
7k views

What are the recommended database permissions for WordPress?

I just got WP running on my own server. I am not trying to lock things down more. What permissions should the db user have to my WP db?
-2
votes
1answer
472 views

Step by Step Instructions for Making Media/Uploads Private to Only Logged-In Users

all. I found this site via a Google search that led me to this topic: How to Protect Uploads, if User is not Logged In? It looks like that solution would work for my situation (including hakre's ...
2
votes
1answer
211 views

Confusion on WP Nonce usage in my Plugin

I created a small plugin where users can set multiple featured image by clicking Add New link from the meta box and remove them as well. The user can use Set featured image link to select featured ...
0
votes
1answer
72 views

Unwanted Links and Spam Wordpress Pages and Posts

In webmaster tools I have a number of crawling errors of the Google spider. for example http://mydomain.com/my-page/de/roulette.html They say they cannot crawl to this page.. but what kind of page ...
1
vote
1answer
121 views

wp_insert_comment and security

I am using wp_insert_comment to offer an in-house better ajax conditional comments interface. i got it all working great. my only question is. What security measures should i take to make sure i ...
0
votes
0answers
50 views

checking the form submit in right order

With help from experts on this site, I have been able to put together a plugin that allows to choose and submit categories from the front-end. Further, in order to make it a bit more secure I have ...
0
votes
2answers
254 views

Wordfence detects change in wp-admin/includes/upgrade.php

I moved my site from hosting provider A and domain name B to hosting provider X and domain name Y. I had Wordfence in the old site. I just installed it in the new site and ran a scan. Wordfence found ...
1
vote
2answers
531 views

wp_nonce_field displaying twice

I have wp_nonce_field in my code but it's creating two instances to the html code for some reason, one where I'd expect it and another at the start of the entry. Is this correct or am I doing ...
0
votes
1answer
88 views

How do I determine if the user who registered is not spam?

I've recently set up a forum on my site with the bbpress-plugin. Now a user has registered on the site but the email-adress looks suspicious to me. How can I determine if the user is real? Is there a ...
0
votes
1answer
56 views

Hiding Media Source Links

I inserted an image onto my page from my WordPress media (Add Media -> Media Library -> Link To = None). However, when I right click on the page to view the source, I noticed the address to my media. ...
0
votes
0answers
72 views

Form That Submits Content Securely

I have built a WP site for a client. One of the pages has a form which my client's customers will use to submit material to my client, and one of the required fields is a file upload. My client ...
-2
votes
2answers
84 views

hardened wordpress linux install

Are there any best practices for wordpress hardened install on Linux? I have recently had a WAMP server get malware attacked via word press so I want to harden the server up using read only apache ...
0
votes
1answer
28 views

Secret keys in SCM

I have a WordPress installation in a Git repository and I'm wondering, if it's safe to have the 8 "secret keys" stored in there, or if I should insert them during deploy.
0
votes
2answers
64 views

Is that a malicious code?

Recently I have downloaded a wordpress theme . I use Theme Authenticity Checker (TAC) (http://wordpress.org/plugins/tac/) plugin to find any malicious data . According to it's report the theme ...
2
votes
2answers
79 views

Best Way to Enable Two Step Authentication

I'm looking for a bit of guidance on setting up a two step authentication system in WordPress. I've looked at a few of the main plugins and they seem to fall in to two camps: Add an extra field to ...
0
votes
1answer
32 views

Safe to say WordPress security releases don't have database upgrades

Since all security releases are based on last released codebase + security patch, I think its safe to say WordPress security releases don't have database upgrades, but I figured I will ask my fellow ...
0
votes
1answer
155 views

Selectively Disabling PHP via .htaccess in Root Directory

I'm reading up on securing WordPress and one of the commonly suggested techniques is to use an .htaccess file to disallow PHP execution in wp-content and wp-includes. I then read about another hack ...
12
votes
2answers
593 views

I found this in a plugin. What does it do? is it dangerous?

I found this in a plugin. What does it do? is it dangerous? add_action('admin_enqueue_scripts', 'pw_load_scripts'); if (!function_exists('wp__head'){ function wp__head() { ...
0
votes
1answer
44 views

Why do Metabox use Nonces?

Why is it advised for admin panel metaboxes to use nonces? Every example I see of creation and saving metabox data there are nonces involved but aren't nonces a bit unnecessary in this case?
3
votes
1answer
105 views

Do Cookies Need to be Sanatized Before Being Saved?

I recently wrote a plugin and now I'm backtracking a bit to sanitize any and all user input. I know that I should sanitize anything that comes from $_GET or $_POST as a user can insert malicious ...
1
vote
0answers
144 views

Can I Remove xmlrpc.php completely?

My site is getting a lot of malicious traffic to domain.com/xmlrpc.php, to the point that the server is not being able to handle it. I tried to disable it via the wp-config.php, by adding this line: ...
0
votes
2answers
32 views

Changing the default header name

Is it possible to change the default header.php file to something else for security reasons? It seems header.php is target for malicious attacks. I know all that, we have different named headers, I ...
0
votes
1answer
51 views

My website is getting too many dierect home arechives and this is increasing my bounce rate

My website is getting nearly 800 direct home archives daily, as a result the bounce rate of my website has increased. Usually i get only around 30 home archives a day These hits are not from Google, ...
1
vote
1answer
249 views

Securing my WordPress Files and Directories

I am new to WordPress and securely hosting it on Amazon EC2. My question is, how do I secure my WordPress files and directories properly? My file permissions are set to 644 and my directories are ...
1
vote
1answer
99 views

Is there a way to create a URL (new WP page) that can only be accessed from a specific source?

To explain further, here's what I"m looking to do: Create a WP page Use the URL and implement it in a reader service that is hosted (not downloadable) that in order to read (& access the URL) ...
0
votes
1answer
79 views

Can a WordPress administrator see other users' passwords?

Of course, an administrator in WordPress can reset other users' passwords (including that of other administrators). However, can a WordPress administrator see other users' passwords? Phrased ...
0
votes
0answers
32 views

False URL for shopping cart

OK. Re wording my question I have a digital product on a wordpress site Using a shopping cart I'm charging .99 cents for people to look at a video (going to charity) The cart directs them to a page ...
0
votes
1answer
54 views

Security and Must Use Plugins

From the codex article on Must Use Plugins: Can be enabled simply by uploading file to the mu-plugins directory, without having to log-in This feels like a potential security problem to me. ...
0
votes
1answer
456 views

How to rename the WordPress wp-login.php running on IIS6?

My Windows 2003 VPS recently hang due to bots hammering my WordPress login php non-stop for hours (determined from IIS6 logs). This caused MySQL to use up all the allocated 1G RAM. After resetting ...