The security tag has no wiki summary.
1
vote
2answers
627 views
<?php echo $title ?> vs <?php echo esc_html( $title ); ?> Wordpress Security
Reading this great article Data Validation and Sanitization in Wordpress I've noticed that in my blog, in header.php, I used <?php echo $title ?> in a pair of codes.
According to the above ...
3
votes
2answers
156 views
Brute force attack?
I'm seeing this quite often:
No OS, same Browser, weird hostname -- they're definitely not real users. Can I do anything to take precautions before they do something?
Thanks!
-1
votes
1answer
284 views
suspicious boolean.php file in wp web root [closed]
Today I noticed in my web root a suspicious php file: boolian.php and serveral .html files with random names, all containing trojans.
I remember yesterday I just uploaded and activated few themes I ...
0
votes
1answer
67 views
Secure way to use name_save_pre?
I created a custom post where I need to change the post name regarding to the custom field and taxonomy values. This is how I did it:
add_filter('name_save_pre', 'save_name');
function ...
3
votes
1answer
649 views
How to make media upload private? [duplicate]
Possible Duplicate:
How to Protect Uploads, if User is not Logged In?
I know how to mark a Page or Post as visible only to members, using the Member Access plugin. This way, the public ...
0
votes
1answer
1k views
Password protect a specific category page/post
I have searched high and low for this but nothing is sticking out at me. I am looking to password protect posts and/or pages based on a certain category.
The reason for this is that I am creating a ...
0
votes
1answer
75 views
WorldPress Site got lots of spam links [closed]
Recently my wordpress website has got a lot of spam links. Google has indexed a lot of spam links from my website. The links are like:
http://example.com/viagra-buy.html
I found out that my ...
0
votes
2answers
614 views
Is Timthumb still broken? What security measures should be taken?
A client has requested we use a theme, and that theme has a Timthumb dependency. I know that there has been some serious vulnerabilities in the past, but what is the current state of that plugin?
...
0
votes
2answers
68 views
Which Versions of WordPress Ship with the Patched TimThumb?
Do you recall when the TimThumb exploit occurred? Which versions of WordPress bundled with this exploit? I need to inform a client that they should be upgrading to at least the version of WP when this ...
6
votes
2answers
445 views
Should I escape wordpress functions like the_title, the_excerpt, the_content
I had look at the code but I couldnt see any escaping on funcions like the_title the_content the_excerptetc. I might not be reading it right. Do I need to escape these functions in theme development ...
0
votes
4answers
432 views
No option “I would like my site to be private, visible only to users I choose” in Privacy Settings
I am running WordPress 3.3.2 self-hosted. I used to see the option "I would like my site to be private, visible only to users I choose" under Privacy Settings but I no longer see this option. Instead, ...
2
votes
2answers
311 views
Secure Validation of wp_editor in Theme Options
So I just found this great WPSE thread about security for themes/plugins. It answered most of my questions but it was created before the new wp_editor() function was built.
I have two TinyMCE editors ...
1
vote
3answers
89 views
Why users disable the WordPress update?
Users install plugins which disable update reminders.
Plugins:
disable WordPress Core Updates
disable WordPress Plugin Updates
disable WordPress Theme Updates
Look at the counter of plugins ...
0
votes
1answer
85 views
Security updates to 3.3.2
I know all security updates are important but given that how important on a scale from 1 to 10 is it to upgrade from 3.1.3 to 3.3.2.
I have some sites that need to be upgraded but the host has me ...
1
vote
3answers
325 views
Simple Online Payment for Event Registration
I am looking for a simple (and secure) way to accept payment for event registration.
I am managing a Wordpress website for a organization that hosts events throughout the year. A handful of these ...
1
vote
1answer
215 views
How to expire all wordpress user passwords instantly?
So I own an article directory website and recently a lot of bots have signed up and started posting spam. (I approve posts prior to publication)
I've added a captcha to the user registration page now ...
-1
votes
2answers
483 views
How can I build an e-commerce website with wordpress for selling services? [closed]
If that is possible, I would want my site to be the safest possible and most secure when it comes to online monetary transactions. is that possible with wordpress? Also, are there any good themes ...
2
votes
1answer
306 views
how can i embed wordpress backend in iframe
I have 2 websites http://www.aaa.com and http://www.bbb.com and need it show the same.
now i put iframe in index.html and upload to aaa.com. it's ok for frontend but it's doesn't work for backend, ...
0
votes
1answer
76 views
Why do people use “admin” username by default? [closed]
WordPress users use "admin" username by default to login to admin panel because WordPress suggest this username at the end off install.
But "admin" username is the most common username to brute-force ...
8
votes
1answer
541 views
wp_verify_nonce vs check_admin_referer
What is the difference, which one should I use?
I know that wp_verify_nonce checks the time limit, and check_admin_referer I think calls wp_verify_nonce as well as checking for an admin url segment, ...
1
vote
2answers
576 views
Can I Prevent Enumeration of Usernames?
Can I prevent enumeration of usernames on my wordpress site? I can see users at the moment using the WPScan tool.
1
vote
2answers
73 views
esc_html__ security : what for in this example?
how does esc_html__ (the 2nd one) protect the $message variable from being hacked ? what's the point to use this protection here (the second one with a plain text)?
<?php
function unknown(){
...
0
votes
1answer
672 views
Problem with permissions in wp-content/plugins
I have a WP installation on my local machine and trying to get my hands dirty with plugins. I wish to clone a project from github which has this plugin code. However, i dont have the permissions ...
0
votes
1answer
229 views
wp_nonce_field displaying twice
I have wp_nonce_field in my code but it's creating two instances to the html code for some reason, one where I'd expect it and another at the start of the entry. Is this correct or am I doing ...
0
votes
1answer
128 views
Spam in Wordpress root folder
Two questions in one. A php file was recently introduced in the root directory of my Wordpress installation (a domain installation). It didn't disturb my website but was apparently using the domain ...
3
votes
1answer
406 views
What is the difference between strip_tags and wp_filter_nohtml_kses?
What is the difference between strip_tags and wp_filter_nohtml_kses. I tried to figure wp_filter_nohtml_kses from the source but it looks like it does something a bit more complex than strip all html ...
0
votes
1answer
92 views
Contact Form Security
Building my own contact form in Wordpress. Any there any security steps I need to consider other than the typical email etc validation and maybe a captcha. I am not sending any data to the database.
0
votes
2answers
95 views
Side effects of disallowing *.php requests in production environment?
For security in the production environment a company I work with has removed the whole wp-admin/ directory, and is about to disallow all *.php file calls with a 403 Forbidden HTTP error.
Are there ...
4
votes
1answer
385 views
What is the difference between esc_html and wp_filter_nohtml_kses?
What is the exact difference between esc_html and wp_filter_nohtml_kses. Everywhere I look says that both strip all the html, the only difference I can see is to do with exactly how they do this. Does ...
2
votes
1answer
512 views
Encrypt emails?
We need to maintain HIPPA compliance for forms on our website that are currently mailed to an internal email address. While the user/customers provides the info over HTTPS, we still want to make sure ...
1
vote
1answer
100 views
The 'https_local_ssl_verify' filter
I have run into some WordPress code which does POST requests to API sites and in the POST parameters for the SSL property it has
$params = array( 'body' => $_POST, 'sslverify' => ...
1
vote
1answer
111 views
Which of WordPress's .php files need to be directly accessible via HTTP?
I'm trying to tighten up security on my WordPress installation, and one of the things that seems like it might be a good idea is preventing all of the internal-use .php files from being accessed ...
4
votes
3answers
103 views
Regular security checks - what steps should be included?
There are heaps of tutorials explaining how to secure a WordPress installation, but I couldn't find any that listed out steps for weekly or monthly security checks. What are some steps that you ...
2
votes
1answer
219 views
Wordpress Malware Problem help! [duplicate]
Possible Duplicate:
Wordpress Trojan issue help!
I accessed the wordpress website I am building and received a warning about a trojan from my anti virus software. I have now checked the ...
5
votes
1answer
133 views
multi page password protection
Is it possible to have the "password protected page" feature of WordPress apply to more than one page? I have dozens of pages which I wish to protect with the same password, but I don't want people to ...
0
votes
2answers
2k views
Protecting HTML5 video
I shall explain my situation as best I can so you can see where i'm coming from. I'm working on a wordpress site for a sports team, there are loads of teams. We want to put coaching sessions on our ...
7
votes
2answers
1k views
Handling front-end file uploads, considering safety and ease of use
I'm looking to adapt an existing forum-like plugin which has no facility for attaching media.
The plugin works as a Custom Post Type, so it would be as "simple" as attaching an image to a post.
I am ...
1
vote
2answers
50 views
What permissions should I give directories if I want to make WordPress more secure?
A follow up to a previous question found here How can I lock down an old wordpress install I don't intend to update?
Same info still stands. WordPress install will (probably) not be updated. ...
-1
votes
1answer
2k views
How to secure WordPress XMLRPC?
XMLRPC is great for remote publishing to WordPress, but there has been many security issues attributed to it. How do it make it more secure?
More specifically, only user from the intranet will be ...
9
votes
2answers
159 views
How Can I Securely Implement a Password-less Login Feature?
Just posted a new plugin: No More Passwords
I currently have it tagged beta because logging into a platform is a sensitive issue and I don't want to release something that may have security holes. So ...
2
votes
1answer
255 views
Extend the list of MIME-types supported by the builtin uploader in 3.3
Goal
I want to be able to extend the list of mime-types supported by the builtin uploader in wp 3.3.1
For example when I try to upload an .apk file to our class blog, I get a
Sorry, this file type ...
0
votes
2answers
170 views
Is Wordpress secure enough for a multi-user article directory?
One of my friends is going to launch a small article directory (ex: http://ezinearticles.com/) using WP. The site will be hosted on a shared hosting in the beginning and will be moved to a dedicated ...
3
votes
2answers
1k views
How do I create a WP user outside of Wordpress and auto login?
I've built a directory of members on a non-WP site (using php and mysql). Each member can log in and update their details using a username and password.
I want to be able to get this to automatically ...
0
votes
2answers
133 views
How to prevent plugins from sniffing/stealing other plugins' options?
Many plugins require configuration with sensitive data such as API keys, passwords, etc. When implementing these plugins, this sensitive data is stored using functions such as update_option() and ...
0
votes
1answer
207 views
Does using a custom query_var create a security hole?
Say I put the following code in functions.php
function add_my_query_vars($qvars) {
$qvars[] = "new_var";
return $qvars;
}
add_filter('query_vars', 'add_my_query_vars');
If somebody requests ...
0
votes
2answers
207 views
On new server, site got hacked, permissions a bit strange? Please help
I moved to a new server recently, a week later a site got hacked, all they did was change the index.php file of the current enabled theme, no big deal. I did have a few security precautions in place, ...
0
votes
1answer
189 views
Renaming wp-admin without hard-coding it. Is it really possible?
I would like to rename my wp-admin folder due to some security concerns. Is it really possible?
The less it looks/is built like default WP, the harder it is to attack known vulnerabilities. Being ...
0
votes
2answers
240 views
How can I password protect a WordPress site without requiring users to log in?
I don't want people to have to log in, I just want to prompt them with a question and if they can answer it, they can access the site. All the solutions and plugins that I've found seem to be overkill ...
0
votes
2answers
106 views
Has anyone developed a anti-spam plugin to simply allow users to BLOCK whatever they wish to, but one that will also go easy on IP addresses?
I'm new here xD
I'm thinking of developing a plugin to allow users to block ANY spammy traces (IPs, Email addresses, Website URLs, phone numbers, phrases, etc etc) from those evil spammers.
BUT, ...
12
votes
2answers
4k views
How to Protect Uploads, if User is not Logged In?
I use wordpress for a private site where users upload files.
I use the "Private WordPress" to prevent access in to the site if the user is not logged in.
I would like to do the same to the files ...
