Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

0
votes
1answer
173 views

Troll the hackers by redirecting them

My website is getting somewhat popular, and with the it's increasing popularity there's an increase in the hackers. Last night I visited my security logs and found that everyday approximately 10 ...
2
votes
1answer
289 views

Is $wpdb->prepare escaping to much? How to use it properly?

Im pretty much confused by $wpdb->prepare. I want to use it to sanitize user input but it turned out that it destroys the query. I cannot imagine that this is how it's intended to work but I can't ...
4
votes
2answers
211 views

Is WP vulnerable when updating plugins or themes?

Once, I had a problem that somehow someone managed to change files of my website without FTP or SSH credentials. Probably he got in through WP (probably it wasn't a 'he', but an 'it', a bot), we said ...
0
votes
2answers
56 views

How to give the same error message when the wrong password or wrong username is used?

For security reasons, my WordPress instance should give the same error message when an incorrect password or wrong username is used. How can it be done?
0
votes
0answers
9 views

xmlrpc.php act as threat to wordpress security? [duplicate]

please could any one suggest what are the necessary steps needs to make wordpress sites more secure. i know it is kind of general question but still if still any hacks which improves security of ...
0
votes
0answers
297 views

Can I make an ajax response cross-domain?

I am trying to make a single ajax response cross-domain. Is that possible? I tried something like this, but that did not work: function my_call_callback() { header("Access-Control-Allow-Origin: ...
0
votes
1answer
48 views

Secure my “add_settings_field” translation?

I am using "add_settings_field" and want to provide translation for it , but my problem is security. So is __('My Checbox:' , 'domain') secure enough for translation? If not what can I do about it? I ...
0
votes
0answers
79 views

Wordpress exploited theme is causing high io load on server

I used a Wordpress theme for a while that was causing high IO-load on my server. That was because there was some kind of exploits made/available for the theme: ...
1
vote
2answers
150 views

How to hide easy access to my website temporarily?

I am developing a new website and I do not want others, except for my colleagues, to access it easily. I don't want it to be password protected because my colleagues are testing it intensively. Is ...
0
votes
1answer
66 views

Storing FTP details in wp-config.php

I'd like to hear about the security concerns for storing FTP details in wp-config.php on a shared server. It doesn't 'feel' safe to me. I'm using ManageWP to control sites on a shared server and have ...
0
votes
1answer
88 views

Specific way to allow Wordpress users to view their current password? And edit it?

I know the built in user manager doesn't allow a user to see what her current pass is, just recover / reset it via email or write in a new one in the admin but I am looking for a plugin or other ...
0
votes
0answers
11 views

Configuration File Safety [duplicate]

I'm new to PHP and WordPress and I've a few questions to ask about database and configuration file security. I hope you answer them. When I try to reach some wp sites config file by typing ...
0
votes
0answers
116 views

Why are xmlrpc.php and wp-cron.php being called so often?

I'm running a Wordpress website and I have found from the server logs that xmlrpc.php and wp-cron.php are being requested (POST requests, of course) very frequently--including some suspicious ips that ...
1
vote
2answers
4k views

Tips for finding SPAM links injected into the_content

I'm working on a client's site and I noticed that posts have a hidden <div> filled to SPAM links to dick pills, etc. Hoping to get lucky, I searched for some of the keywords in the database ...
0
votes
1answer
39 views

Is it necessary to use a WordPress nonce when allowing users to download public data?

I am using jQuery .load() to load the next page of WordPress posts after a button is clicked. The next page of posts is public data (no access restrictions on it whatsoever). Should I use a WordPress ...
0
votes
4answers
89 views

Do we need to escape data that we receive from theme options?

I'm creating a Wordpress theme that I'm hoping to sell on Themeforest. Now I know much about escaping user inputted data using functions like esc_html, esc_url and so on and I use them in the comments ...
1
vote
0answers
164 views

Renaming admin user on multisite install by MySQL

As part of a general tightening of security, I want to change the name of the admin user on my multisite install to something less commonly used. This user is admin on all five sites in the network ...
0
votes
1answer
130 views

Hide wp-login.php but not the widget

I have a website which is still under nascent construction stage: http://42charts.com . Lately I find that couple of users are registering themselves in my site. It seems like a bot as the mails IDs ...
1
vote
2answers
362 views

Restrict Access in Admin Panel

I want to restrict access to certain plugin pages / normal WP Pages. I've found a way to Hide these pages from the menu but currently not restrict them. For instance, I have an editor and I don't want ...
0
votes
1answer
73 views

Able to go to WordPress admin even after deleting auth cookies from request headers

I discovered that if I remove my auth cookies from my browser's request header, I am still able to view a page. Steps: Log into my WordPress installation Go to the wp-admin page In Chrome, use the ...
0
votes
1answer
80 views

User meta and public function security

I am using stripe to setup a system of buying credits, which can be used on my wordpress site. I save credits using wordpress user meta, and I increment those credits after a successful transaction ...
0
votes
1answer
80 views

Remove hacked code - out of ideas! [closed]

I've been working on a project which keeps getting some PHP inserted into the config.php file and it's causing a lot of issues with SEO. I'll paste in a sample of it (it's quite long) after this ...
0
votes
2answers
763 views

How to rewrite rules for WP-security in Nginx?

I have a WordPress website on a VPS running nginx. I have installed the WP Security plugin to improve the security of my site. After changing all the settings to my liking, a pop-up notifies me that I ...
14
votes
6answers
448 views

Are Wordpress Plugins essential?

I'm new to WordPress. I recently read an article about how hackers can exploit vulnerabilities in plugins. Various sources such as Google Pagespeed has also disssuaded me from using plugins or at ...
0
votes
0answers
16 views

Alternative ways to make ajax requests in wordpress [duplicate]

I'm currently having a problem with working with AJAX. Well not really a problem since I can pretty much do what I want to do. The only problem is my boss saying that the admin-ajax.php file is an ...
-1
votes
1answer
25 views

is this code properly secured

The input will be an address. This is what I gather from looking at the Codex. See here: codex $wpdb->insert($address_table, array('address' => $address),array('%s'));
4
votes
3answers
302 views

Disabled plugins are the security holes - rumor or reality?

I've read many WordPress Security blog articles, where the Security Experts're recommending some special matters to take care when somebody is concern about his/her WordPress site's security. Among ...
0
votes
0answers
14 views

Security: How to disallow viewing/browsing by author? [duplicate]

I've already inserted htaccess code to disallow searching for users by numeric id. However, one can still manually input a user name to view/browse by author, e.g. http://mywpsite.com/author/peter/ ...
0
votes
0answers
272 views

Nonces and Cache

It's clear that form submissions and AJAX requests, especially sensible ones, need "nonces" to avoid certain exploits. However, with heavy use of caching systems it becomes harder to generate them ...
0
votes
1answer
48 views

Restrict Content for only Contributors via .htaccess

I have been using this code to restrict content download from wp-content/uploads for only logged in users: RewriteEngine On RewriteBase / # Add these lines right after the preceding two ...
1
vote
1answer
32 views

Is it safe to hand over the admin rights?

I have a shared web hosting account where I have several different websites running on WordPress. I want to hand over the admin rights for one of my WordPress installs to someone and I am wondering ...
0
votes
0answers
238 views

Malware/Permission bug removal?

I'm facing a hell of a problem on a client's WP theme. Whenever I try to 'Activate' it, it gives me the following errors on a blank page: Warning: ...
0
votes
2answers
98 views

Config file with no Keys..?

I'm working on a site for someone that doesn't have any keys in the wp-config file. Isn't this a serious issue? I know I can generate these but I wonder if this will have any side-effects..also, is ...
0
votes
0answers
20 views

Permission of uploads folder [duplicate]

My Wordpress site was hacked today. When I investigated, I noticed that there were some malicious files under wp-content/uploads/ folder. I had set the permission of uploads folder to 777 for ...
4
votes
2answers
284 views

Make password invalid once logged out of password-protected page

In a WP-based site I have a custom form which I need to hide from the general public and give access to only a select few who would then get a password from me, enter it and access the form and submit ...
1
vote
2answers
102 views

Moving wordpress out of the public directory

Is there a way to move wordpress out of the public html directory? The PHP files responsible for generating html output should be hosted but the php files responsible for database connections and ...
2
votes
1answer
157 views

How does Cross Site Scripting (XSS) work exactly? [closed]

On WordCamp Europe I attended the talk by Brad Williams on Writing Secure WordPress Code and I would like to make sure that I implement these tips in my own code. In his presentation he gives the ...
0
votes
0answers
20 views

What is the Best Way to Secure a Commercial Wordpress Plugin? [duplicate]

A friend has built a very powerful Wordpress plugin that was build mainly for his own use - and now he is considering opening it up to the public by selling it, but... But he's concerned that it will ...
2
votes
1answer
333 views

Confusion on WP Nonce usage in my Plugin

I created a small plugin where users can set multiple featured image by clicking Add New link from the meta box and remove them as well. The user can use Set featured image link to select featured ...
10
votes
1answer
173 views

Why does WordPress need my private ssh key to update?

Configuring WordPress to update within the application (i.e. WordPress) is ideal for me because of its convenience. Nonetheless, I'm troubled by the requirements. The requested fields that show up ...
-2
votes
1answer
830 views

Step by Step Instructions for Making Media/Uploads Private to Only Logged-In Users

all. I found this site via a Google search that led me to this topic: How to Protect Uploads, if User is not Logged In? It looks like that solution would work for my situation (including hakre's ...
0
votes
0answers
52 views

Allowing access to certain Wordpress created pages or posts with htaccess / htpasswd

Trying to figure out how to give access to a certain page, lets say http://mypage.com/page and not letting people access the main index via http://mypage.com. Or just simply disallow access to ...
1
vote
1answer
157 views

wp_insert_comment and security

I am using wp_insert_comment to offer an in-house better ajax conditional comments interface. i got it all working great. my only question is. What security measures should i take to make sure i ...
0
votes
1answer
146 views

Unwanted Links and Spam Wordpress Pages and Posts

In webmaster tools I have a number of crawling errors of the Google spider. for example http://mydomain.com/my-page/de/roulette.html They say they cannot crawl to this page.. but what kind of page ...
0
votes
0answers
59 views

checking the form submit in right order

With help from experts on this site, I have been able to put together a plugin that allows to choose and submit categories from the front-end. Further, in order to make it a bit more secure I have ...
0
votes
1answer
157 views

How do I determine if the user who registered is not spam?

I've recently set up a forum on my site with the bbpress-plugin. Now a user has registered on the site but the email-adress looks suspicious to me. How can I determine if the user is real? Is there a ...
0
votes
1answer
83 views

Hiding Media Source Links

I inserted an image onto my page from my WordPress media (Add Media -> Media Library -> Link To = None). However, when I right click on the page to view the source, I noticed the address to my media. ...
0
votes
0answers
92 views

Form That Submits Content Securely

I have built a WP site for a client. One of the pages has a form which my client's customers will use to submit material to my client, and one of the required fields is a file upload. My client ...
-1
votes
2answers
102 views

hardened wordpress linux install

Are there any best practices for wordpress hardened install on Linux? I have recently had a WAMP server get malware attacked via word press so I want to harden the server up using read only apache ...
0
votes
1answer
29 views

Secret keys in SCM

I have a WordPress installation in a Git repository and I'm wondering, if it's safe to have the 8 "secret keys" stored in there, or if I should insert them during deploy.