The security tag has no wiki summary.
0
votes
1answer
52 views
Wordpress custom admin functions security
i have a case in my admin panel where i need to call my own function that resides in my own php file, with a GET request. This function is actually removing entries from the database.
So, i would ...
0
votes
1answer
120 views
Secure Wordpress: Change admin
I'm sorry if this is an extremely stupid question.
I've been looking for ways how to secure my WP and a lot of websites suggest to create a new admin user account and delete the old one.
Now, if I ...
1
vote
0answers
45 views
Are un-sanitized theme options more vulnerable to malicious scripts than the theme editor?
I'd like to put text areas in a theme options area to allow users to easily add analytics code, scripts, and css.
Is it silly to worry about malicious code being inserted via un-sanitized theme ...
0
votes
0answers
24 views
Hiding Wordpress version and directory information [duplicate]
Possible Duplicate:
Steps to Take to Hide the Fact a Site is Using WordPress?
Is it possible to secure WP information and stop version numbers and location of theme directories being picked ...
1
vote
0answers
46 views
Network Admin URL is shown to anyone before accessing a blog
I have a multisite setup and I noticed today that my security was not working properly.
Each of my blogs has its own url :
http://www.example1.com
http://www.example2.com
…
My "main blog" is not ...
2
votes
1answer
255 views
Extend the list of MIME-types supported by the builtin uploader in 3.3
Goal
I want to be able to extend the list of mime-types supported by the builtin uploader in wp 3.3.1
For example when I try to upload an .apk file to our class blog, I get a
Sorry, this file type ...
1
vote
3answers
371 views
How to properly validate data from $_GET or $_REQUEST using WordPress functions?
I am working on a plugin that requires on-the-fly manipulation of content output. This is solely dependent on the current $_GET variable or $_REQUEST variable.
Depending on what the variable is set ...
12
votes
2answers
335 views
In Which Contexts are Plugins Responsible for Data Validation/Sanitization?
I want to make sure all of the data in my plugins/themes is handled securely before entering the database and before being output to the browser. My problem is that there are situations where the API ...
0
votes
0answers
56 views
Htaccess rule doesn`t work [closed]
I have .htacces in a root of site. And I wrote this rule to file:
<files .htaccess>
Order allow,deny
Deny from all
</files>
But i still see content of my .htaccess file in ...
11
votes
3answers
311 views
What are the common security flaws I need to look for? [closed]
As a wannabe WP plugin developper, what are the main security flaws/holes I should look for?
I'm about to create a new plugin with a configuration panel (ie input fields and stuff). What should I be ...
0
votes
1answer
242 views
Do I need to sanitize Wordpress search query?
I submit search data to custom page searchi.php
<?php
//
$search_variables = $_GET['s']. '+' .$_GET['cat'];
//This sends http post to url without curl
header("Status: 301 Moved ...
0
votes
2answers
192 views
Any known bugs that could cause disappearance of the wp_users table?
I administer a number of WordPress-powered web sites.
One of these sites is new, and has been running untouched since it was set up a month ago. Today, I tried to log in, but was unable to do so - ...
8
votes
1answer
502 views
Worthwhile to restrict direct access of theme files?
I've run across the following snippet in themes from time to time:
if ( ! defined('ABSPATH')) exit('restricted access');
It's at the beginning of some (all?) PHP files in a theme and it's supposed ...
0
votes
3answers
504 views
How to control who can view certain pages in BuddyPress?
I would like to control who can see a page in BuddyPress and restrict anyone else from accessing it.
Something along the lines of the following pseudocode:
<?php if ( loggedin_user_ids==1,4,5,7 ) ...
0
votes
1answer
258 views
Something is unescaping all html entities before output to browser [closed]
I have a nasty problem. In my wordpress site something unescapes all html entities before sending data to the browser. It happens for all of the following cases:
echo ""XSS"
print_r( ...
2
votes
2answers
71 views
How to limit WordPress pages during updates?
I will be doing upgrades to the design and content of my Wordpress site. During this time I only want the homepage to be available. Is there a good way to lock this down (through a plug-in, etc.).
...
1
vote
3answers
89 views
Why users disable the WordPress update?
Users install plugins which disable update reminders.
Plugins:
disable WordPress Core Updates
disable WordPress Plugin Updates
disable WordPress Theme Updates
Look at the counter of plugins ...
3
votes
2answers
386 views
Setting WP Admin passwords to expire
I'm aware it's not a feature of Wordpress, but I was wondering if there was a way or a plug-in (haven't found one from searching) that allows me to force a user to change their password after a ...
0
votes
1answer
2k views
Websites defaced by uploading script using theme editor
We've had several Wordpress sites defaced, all of them having the same pattern (at least the raw access log says so). From the logs it appears they directly login to Wordpress then go to theme editor ...
12
votes
2answers
4k views
How to Protect Uploads, if User is not Logged In?
I use wordpress for a private site where users upload files.
I use the "Private WordPress" to prevent access in to the site if the user is not logged in.
I would like to do the same to the files ...
2
votes
1answer
235 views
Generate Wordpress salt
I am in need of a function that automatically generates and returns salts for Wordpress wp-config.php (Don't link me to their API, I'm looking for offline solution).
Does Wordpress core has this ...
51
votes
7answers
12k views
Steps to Take to Hide the Fact a Site is Using WordPress?
I have a website for which we are trying to be discreet about the fact that we are using WordPress. What steps can we take to make it less obvious?
1
vote
1answer
28 views
correct tags for validating input types
I have following types of theme options inputs, which I need to validate.
$numbers = "#1234";
$email = "abc@example.com";
$simeple_text = "How's going?";
$code = "<script ...
0
votes
1answer
46 views
Is there any pre-existing plugin to track and block IPs with suspicious activity on my site?
The image below shows a recent (failed) attempt to crack my Wordpress install. It's easy for me to look at that and see what they were doing, but is there a plugin that exists that monitors this data ...
-1
votes
3answers
2k views
How to remove “Connection Information” requirement on localhost install of WP on MACOSX
I've just installed XAMPP on Mac OSX and when trying to install a theme or plugin in WP admin, I'm getting this screen. I've never gotten this on my shared hosting account. how to get rid of it on ...
3
votes
2answers
1k views
How do I create a WP user outside of Wordpress and auto login?
I've built a directory of members on a non-WP site (using php and mysql). Each member can log in and update their details using a username and password.
I want to be able to get this to automatically ...
0
votes
1answer
73 views
Basic File/Post restriction plugin
I am looking for a plugin that allows me to restrict access for a individual post/page to a specific role or individual. It also needs to restrict files attached to that post. I have tried several ...
0
votes
2answers
272 views
Is WordPress MultiSite secure & how much can it scale? [closed]
Great info on How to Scale Wordpress and more info on Wordpress Web Hosting. Still, I am left with questions.
Creating a project that for the sake of argument we will call a blog network. A user ...
2
votes
2answers
61 views
Can someone (Support of my themeprovider) get access to my server If I send them my admin login?
I have bought a WP theme from a huge provider (themeforest). But it has a lot of bugs. The support asked me to send my WP Admin Login/Password. What risk does this have?
I know the supportstaff will ...
1
vote
2answers
629 views
<?php echo $title ?> vs <?php echo esc_html( $title ); ?> Wordpress Security
Reading this great article Data Validation and Sanitization in Wordpress I've noticed that in my blog, in header.php, I used <?php echo $title ?> in a pair of codes.
According to the above ...
-1
votes
1answer
284 views
suspicious boolean.php file in wp web root [closed]
Today I noticed in my web root a suspicious php file: boolian.php and serveral .html files with random names, all containing trojans.
I remember yesterday I just uploaded and activated few themes I ...
3
votes
2answers
156 views
Brute force attack?
I'm seeing this quite often:
No OS, same Browser, weird hostname -- they're definitely not real users. Can I do anything to take precautions before they do something?
Thanks!
3
votes
1answer
651 views
How to make media upload private? [duplicate]
Possible Duplicate:
How to Protect Uploads, if User is not Logged In?
I know how to mark a Page or Post as visible only to members, using the Member Access plugin. This way, the public ...
0
votes
1answer
67 views
Secure way to use name_save_pre?
I created a custom post where I need to change the post name regarding to the custom field and taxonomy values. This is how I did it:
add_filter('name_save_pre', 'save_name');
function ...
0
votes
2answers
618 views
Is Timthumb still broken? What security measures should be taken?
A client has requested we use a theme, and that theme has a Timthumb dependency. I know that there has been some serious vulnerabilities in the past, but what is the current state of that plugin?
...
0
votes
1answer
75 views
WorldPress Site got lots of spam links [closed]
Recently my wordpress website has got a lot of spam links. Google has indexed a lot of spam links from my website. The links are like:
http://example.com/viagra-buy.html
I found out that my ...
0
votes
2answers
68 views
Which Versions of WordPress Ship with the Patched TimThumb?
Do you recall when the TimThumb exploit occurred? Which versions of WordPress bundled with this exploit? I need to inform a client that they should be upgrading to at least the version of WP when this ...
4
votes
3answers
103 views
Regular security checks - what steps should be included?
There are heaps of tutorials explaining how to secure a WordPress installation, but I couldn't find any that listed out steps for weekly or monthly security checks. What are some steps that you ...
6
votes
2answers
448 views
Should I escape wordpress functions like the_title, the_excerpt, the_content
I had look at the code but I couldnt see any escaping on funcions like the_title the_content the_excerptetc. I might not be reading it right. Do I need to escape these functions in theme development ...
1
vote
3answers
326 views
Simple Online Payment for Event Registration
I am looking for a simple (and secure) way to accept payment for event registration.
I am managing a Wordpress website for a organization that hosts events throughout the year. A handful of these ...
8
votes
1answer
543 views
wp_verify_nonce vs check_admin_referer
What is the difference, which one should I use?
I know that wp_verify_nonce checks the time limit, and check_admin_referer I think calls wp_verify_nonce as well as checking for an admin url segment, ...
0
votes
4answers
437 views
No option “I would like my site to be private, visible only to users I choose” in Privacy Settings
I am running WordPress 3.3.2 self-hosted. I used to see the option "I would like my site to be private, visible only to users I choose" under Privacy Settings but I no longer see this option. Instead, ...
2
votes
2answers
311 views
Secure Validation of wp_editor in Theme Options
So I just found this great WPSE thread about security for themes/plugins. It answered most of my questions but it was created before the new wp_editor() function was built.
I have two TinyMCE editors ...
1
vote
1answer
55 views
Does WordPress validate inputs to all functions? (such as get_user_meta and insert_user_meta)
Does WordPress validate inputs made to all built-in functions that access the database to protect against SQL injection vulnerabilities or do we have to validate before passing them?
0
votes
1answer
248 views
Does WP show me if I'm logged in from multiple locations?
Does word press show me if I'm logged in in another location?
Related: Limiting sessions to one IP at a time
0
votes
1answer
85 views
Security updates to 3.3.2
I know all security updates are important but given that how important on a scale from 1 to 10 is it to upgrade from 3.1.3 to 3.3.2.
I have some sites that need to be upgraded but the host has me ...
1
vote
1answer
215 views
How to expire all wordpress user passwords instantly?
So I own an article directory website and recently a lot of bots have signed up and started posting spam. (I approve posts prior to publication)
I've added a captcha to the user registration page now ...
2
votes
1answer
210 views
Is it possible to post with Word 2007 via XML-RPC and limit categories by user?
I'm working on a project for a school district I work at where we want to use Word Press to have employees from all of the buildings post announcements and press releases via Word 2007. We will then ...
-1
votes
2answers
365 views
What do spammers gain by signing up as a user?
The majority of new user signups I receive on my Wordpress blog look dodgy, with @someblog.com, @somearticle.com, or @gmail.com addresses.
What do they gain by signing up as a new user?
0
votes
1answer
76 views
Why do people use “admin” username by default? [closed]
WordPress users use "admin" username by default to login to admin panel because WordPress suggest this username at the end off install.
But "admin" username is the most common username to brute-force ...
