Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

0
votes
0answers
68 views

Encrypt Email Addresses at Rest

Some enterprise clients require that all email addresses be encrypted at rest (i.e., the actual values stored in the database must be encrypted). I've put together something that seems to do the ...
0
votes
0answers
11 views

Security threats if wp-config got exposed to the outsiders? [duplicate]

Usually, people setup so that the username/password can only access db from localhost. In case of php interpreter malfunction and the configuration wp-config got exposed to visitors, what harms could ...
2
votes
1answer
244 views

Confusion on WP Nonce usage in my Plugin

I created a small plugin where users can set multiple featured image by clicking Add New link from the meta box and remove them as well. The user can use Set featured image link to select featured ...
10
votes
1answer
158 views

Why does WordPress need my private ssh key to update?

Configuring WordPress to update within the application (i.e. WordPress) is ideal for me because of its convenience. Nonetheless, I'm troubled by the requirements. The requested fields that show up ...
-2
votes
1answer
567 views

Step by Step Instructions for Making Media/Uploads Private to Only Logged-In Users

all. I found this site via a Google search that led me to this topic: How to Protect Uploads, if User is not Logged In? It looks like that solution would work for my situation (including hakre's ...
0
votes
0answers
49 views

Allowing access to certain Wordpress created pages or posts with htaccess / htpasswd

Trying to figure out how to give access to a certain page, lets say http://mypage.com/page and not letting people access the main index via http://mypage.com. Or just simply disallow access to ...
1
vote
1answer
128 views

wp_insert_comment and security

I am using wp_insert_comment to offer an in-house better ajax conditional comments interface. i got it all working great. my only question is. What security measures should i take to make sure i ...
0
votes
1answer
89 views

Unwanted Links and Spam Wordpress Pages and Posts

In webmaster tools I have a number of crawling errors of the Google spider. for example http://mydomain.com/my-page/de/roulette.html They say they cannot crawl to this page.. but what kind of page ...
0
votes
0answers
54 views

checking the form submit in right order

With help from experts on this site, I have been able to put together a plugin that allows to choose and submit categories from the front-end. Further, in order to make it a bit more secure I have ...
0
votes
1answer
107 views

How do I determine if the user who registered is not spam?

I've recently set up a forum on my site with the bbpress-plugin. Now a user has registered on the site but the email-adress looks suspicious to me. How can I determine if the user is real? Is there a ...
0
votes
1answer
65 views

Hiding Media Source Links

I inserted an image onto my page from my WordPress media (Add Media -> Media Library -> Link To = None). However, when I right click on the page to view the source, I noticed the address to my media. ...
0
votes
0answers
78 views

Form That Submits Content Securely

I have built a WP site for a client. One of the pages has a form which my client's customers will use to submit material to my client, and one of the required fields is a file upload. My client ...
-2
votes
2answers
86 views

hardened wordpress linux install

Are there any best practices for wordpress hardened install on Linux? I have recently had a WAMP server get malware attacked via word press so I want to harden the server up using read only apache ...
0
votes
1answer
28 views

Secret keys in SCM

I have a WordPress installation in a Git repository and I'm wondering, if it's safe to have the 8 "secret keys" stored in there, or if I should insert them during deploy.
0
votes
2answers
67 views

Is that a malicious code?

Recently I have downloaded a wordpress theme . I use Theme Authenticity Checker (TAC) (http://wordpress.org/plugins/tac/) plugin to find any malicious data . According to it's report the theme ...
2
votes
2answers
86 views

Best Way to Enable Two Step Authentication

I'm looking for a bit of guidance on setting up a two step authentication system in WordPress. I've looked at a few of the main plugins and they seem to fall in to two camps: Add an extra field to ...
0
votes
1answer
32 views

Safe to say WordPress security releases don't have database upgrades

Since all security releases are based on last released codebase + security patch, I think its safe to say WordPress security releases don't have database upgrades, but I figured I will ask my fellow ...
0
votes
1answer
207 views

Selectively Disabling PHP via .htaccess in Root Directory

I'm reading up on securing WordPress and one of the commonly suggested techniques is to use an .htaccess file to disallow PHP execution in wp-content and wp-includes. I then read about another hack ...
0
votes
1answer
44 views

Why do Metabox use Nonces?

Why is it advised for admin panel metaboxes to use nonces? Every example I see of creation and saving metabox data there are nonces involved but aren't nonces a bit unnecessary in this case?
3
votes
1answer
123 views

Do Cookies Need to be Sanatized Before Being Saved?

I recently wrote a plugin and now I'm backtracking a bit to sanitize any and all user input. I know that I should sanitize anything that comes from $_GET or $_POST as a user can insert malicious ...
1
vote
0answers
170 views

Can I Remove xmlrpc.php completely?

My site is getting a lot of malicious traffic to domain.com/xmlrpc.php, to the point that the server is not being able to handle it. I tried to disable it via the wp-config.php, by adding this line: ...
12
votes
2answers
604 views

I found this in a plugin. What does it do? is it dangerous?

I found this in a plugin. What does it do? is it dangerous? add_action('admin_enqueue_scripts', 'pw_load_scripts'); if (!function_exists('wp__head'){ function wp__head() { ...
0
votes
2answers
32 views

Changing the default header name

Is it possible to change the default header.php file to something else for security reasons? It seems header.php is target for malicious attacks. I know all that, we have different named headers, I ...
0
votes
1answer
51 views

My website is getting too many dierect home arechives and this is increasing my bounce rate

My website is getting nearly 800 direct home archives daily, as a result the bounce rate of my website has increased. Usually i get only around 30 home archives a day These hits are not from Google, ...
1
vote
1answer
285 views

Securing my WordPress Files and Directories

I am new to WordPress and securely hosting it on Amazon EC2. My question is, how do I secure my WordPress files and directories properly? My file permissions are set to 644 and my directories are ...
0
votes
1answer
81 views

Can a WordPress administrator see other users' passwords?

Of course, an administrator in WordPress can reset other users' passwords (including that of other administrators). However, can a WordPress administrator see other users' passwords? Phrased ...
1
vote
1answer
110 views

Is there a way to create a URL (new WP page) that can only be accessed from a specific source?

To explain further, here's what I"m looking to do: Create a WP page Use the URL and implement it in a reader service that is hosted (not downloadable) that in order to read (& access the URL) ...
0
votes
0answers
34 views

False URL for shopping cart

OK. Re wording my question I have a digital product on a wordpress site Using a shopping cart I'm charging .99 cents for people to look at a video (going to charity) The cart directs them to a page ...
0
votes
1answer
57 views

Security and Must Use Plugins

From the codex article on Must Use Plugins: Can be enabled simply by uploading file to the mu-plugins directory, without having to log-in This feels like a potential security problem to me. ...
5
votes
1answer
96 views

Close a wordpress blog - keep site as it is but prevent hacks

Last summer I created a travelling-blog on my webspace to document my journey. Now the journey is over and I won't put any new posts in this blog. I also don't whish to have any new comments. How can ...
0
votes
1answer
470 views

How to rename the WordPress wp-login.php running on IIS6?

My Windows 2003 VPS recently hang due to bots hammering my WordPress login php non-stop for hours (determined from IIS6 logs). This caused MySQL to use up all the allocated 1G RAM. After resetting ...
0
votes
0answers
28 views

Malware installation during plugin update?

I update my wordpress blog daily (current version: WordPress 3.5.2). Today I installed an update of "Search everything". After that, my webspace was infected by malware. Interestingly, my blog is ...
3
votes
1answer
168 views

WordPress Capabilities: edit_user vs edit_users

The official documentation only mentions edit_users, but in the source I found many places are using edit_user, what is the difference? Are there any conventions for singular and plural capabilities? ...
1
vote
1answer
61 views

Security checking in meta_box save is reluctant?

For example, in this tutorial, the code suggested when saving meta box data is /* Verify the nonce before proceeding. */ if ( !isset( $_POST['smashing_post_class_nonce'] ) || !wp_verify_nonce( ...
2
votes
4answers
172 views

Will WordPress username displayed somewhere in the site?

I am considering enforcing all my users to use email as their login name. But I am afraid that the username is being used somewhere that is publicly accessible, e.g. author pages, such as that it will ...
0
votes
5answers
305 views

Prevent Brute Force Attack

I already used Limit Login Attempts wordpress plugin. Are there other ways to prevent brute force attacks? I'm worried because I saw a lot of locked out.
2
votes
1answer
2k views

Why Better WP security plugin returns 418 I'm a Teapot “error”?

I am working on the Wordpress website and all of a sudden after deploying it on the server, I started seeing a problem where some of the pages on my website return 418 I'm a Teapot as Response status ...
0
votes
1answer
99 views

Form Post results in 404 Not Found [duplicate]

I am creating a POST-able form on the front-end of Wordpress (via a shortcode). If I submit this form without any input, the form submits fine. But as soon as I enter an data in the fields and POST ...
2
votes
2answers
3k views

Password protect some uploaded files, so only logged-in users can view them

I would like to protect some uploaded files, so that they are not publicly accessible (they are not accessible without a login). I'm uploading some PDF files, and I'd like to mark some of them as ...
1
vote
2answers
251 views

Is Wordpress vulnerable to “comment posting forgery”?

I recently scanned my Wordpress site using 6scan's security scanning service. It reported a high severity vulnerability: "Wordpress comment posting forgery". Technical details from 6scan: The ...
1
vote
2answers
38 views

Secure Pages Best Practice

I am in process of writing a plugin that has front-end shortcodes that display a user's information/data. If the user is not logged in, I need to redirect to a front-end login page/form. What would ...
5
votes
1answer
3k views

simple solution for restricting access to (some) uploads/downloads

Initial Situation For a site I'm setting up I was looking into the whole field of securing uploads/downloads and restricting access to them based on user roles/capabilities. Of course I have read ...
2
votes
3answers
103 views

How can I easily verify a core or plugin update has not broken anything?

I'm looking for ways to make updating WordPress less frightening for me. I created around 30 company websites based in WP in my career and I feel somewhat responsible for them in regards to security. ...
0
votes
2answers
228 views

WP Cron doesn't save <iframe> or <object> in post body

I am using wp_cron to auto grab posts from a remote website and save them in my wp db. NOTICE! I am executing my code from my plugin, not from my template functions.php or somewhere else. I have my ...
0
votes
0answers
360 views

Core files changed - site hacked?

Got a WordFence alert last night for one of our WordPress sites, saying that some WordPress core files had been changed: WordPress core file modified: wp-content/plugins/akismet/admin.php WordPress ...
1
vote
2answers
72 views

How to protect wp-admin through .htaccess?

I'd like to protect the /wp-admin/ directory at the server level. This means two logins. One through the server and another through WordPress. I believe this can be handled through .htaccess. Does ...
0
votes
3answers
90 views

Why my plugins are updating automatically?

I have a wordpress site with a few plugins. I had to make some custom changes on a plugin (not a best practice), and of course I don't want to update that plugin. But for some reason all my plugins ...
0
votes
2answers
115 views

How can I tell who changed the password?

We recently had an employee leave our company. When they left, I changed all their passwords and removed their email access etc. I also changed the password on our Wordpress site for the Admin ...
0
votes
0answers
28 views

Is [admin / admin] acceptable for all local websites?

Are there security issues with using the same credentials [admin / admin] for all client websites on a working, local server ?
0
votes
1answer
92 views

Trying to understand nature of hacking

Today we saw suddenly two files created in root folder in one of our wordpress websites - file name owp.php and gmail.html On investigating the access logs following entries were found which seem to ...