Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

3
votes
4answers
1k views

ensure user can only be logged in on one computer at a time?

how can i make sure a user can only be logged in on one computer at a time? I want to make a wordpress site that could potentially have paid accounts for content in the future. Is there anything built ...
3
votes
2answers
790 views

Can I force a password change?

When I create a new user, I would like to force that user to change their password on first log in, can this be done?
3
votes
1answer
323 views

Security error WP 4.0 + WP phpBB Bridge [closed]

so today I updated to 4.0 (glad I had backup). Everything was working fine until I tried to publish a post. There I got Are you sure you want to do this. Also had Cheatin' Uh under ...
3
votes
3answers
213 views

How to Block Access to Standard Login Flow and Comment Flow

I've set up custom flows on my Wordpress blog for login, signup, and commenting. I would like to password protect the standard login flow so only I can use it, and block access entirely to the ...
3
votes
1answer
248 views

WordPress Capabilities: edit_user vs edit_users

The official documentation only mentions edit_users, but in the source I found many places are using edit_user, what is the difference? Are there any conventions for singular and plural capabilities? ...
3
votes
1answer
3k views

How to make media upload private? [duplicate]

Possible Duplicate: How to Protect Uploads, if User is not Logged In? I know how to mark a Page or Post as visible only to members, using the Member Access plugin. This way, the public ...
3
votes
3answers
73 views

Strategies for coping with hyperagressive spambots?

A couple of my sites are getting slammed by a hyperagressive distributed spambot. It's just pure link spam. It all comes from one user name, but from a variety of IPs. Akismet is catching the spam, ...
3
votes
0answers
340 views

Disallow file edit not preventing plugin install

I have a little demo site (admin details are listed publicly), and I've configured the wp-config.php to disallow file edits, so in theory no one can install a theme / plugin. define( ...
2
votes
3answers
460 views

How brute-forcer knows that the password is cracked for target username?

There are very many brute-force attacks (mostly for 'admin' username) on WordPress sites. All these attacks are made automatically via post requests. The question 1: how brute-forcer knows that the ...
2
votes
3answers
113 views

Why users disable the WordPress update?

Users install plugins which disable update reminders. Plugins: disable WordPress Core Updates disable WordPress Plugin Updates disable WordPress Theme Updates Look at the counter of plugins ...
2
votes
4answers
128 views

How to properly secure my Wordpress installation?

I'm currently on my own server (fredericpilon.com) with my own website. Wordpress being kind of a big shot of CMS, it may be targeted by hacks. Any tips and tricks on how to properly secure my ...
2
votes
2answers
95 views

Is security a problem in Wordpress?

I am going to start a big corporate website for his car shop which is supposed be more secured. Is Wordpress okay to start a secured and reliable website? As far as i heard, Wordpress hackers ...
2
votes
4answers
228 views

Will WordPress username displayed somewhere in the site?

I am considering enforcing all my users to use email as their login name. But I am afraid that the username is being used somewhere that is publicly accessible, e.g. author pages, such as that it will ...
2
votes
2answers
94 views

Can someone (Support of my themeprovider) get access to my server If I send them my admin login?

I have bought a WP theme from a huge provider (themeforest). But it has a lot of bugs. The support asked me to send my WP Admin Login/Password. What risk does this have? I know the supportstaff will ...
2
votes
1answer
53 views

How is password strength calculated?

A password, that contains: at least one capital letter, at least one small letter, at least one number and at least one non-alphanumeric character, is considered moderate to strong (sometimes even ...
2
votes
5answers
2k views

Upgrading Wordpress 4.0 asks for FTP password

I was able to upgrade Wordpress 4.0 on my local machine, and I also just updated some plugins on the production machine, but when I try to update Wordpress 4.0 on the production machine, it is asking ...
2
votes
1answer
962 views

Is wp_nonce_field vulnerable if you know the action name?

Is wp_nonce_field vulnerable if you know the action name? I am actually adding a hidden field with name = the name of the action name in my form so that my plugin can identify it. I want to know if ...
2
votes
3answers
2k views

How to properly validate data from $_GET or $_REQUEST using WordPress functions?

I am working on a plugin that requires on-the-fly manipulation of content output. This is solely dependent on the current $_GET variable or $_REQUEST variable. Depending on what the variable is set ...
2
votes
1answer
244 views

Wordpress Malware Problem help! [duplicate]

Possible Duplicate: Wordpress Trojan issue help! I accessed the wordpress website I am building and received a warning about a trojan from my anti virus software. I have now checked the ...
2
votes
1answer
1k views

What is the relationship between cURL, WordPress and cacert.pem?

I've run into a problem concerning wp_remote_get() and the underlying cURL call. On some WordPress installations I see the following SSL error: httprequest_failed: SSL certificate problem, verify ...
2
votes
1answer
372 views

Confusion on WP Nonce usage in my Plugin

I created a small plugin where users can set multiple featured image by clicking Add New link from the meta box and remove them as well. The user can use Set featured image link to select featured ...
2
votes
2answers
108 views

Best Way to Enable Two Step Authentication

I'm looking for a bit of guidance on setting up a two step authentication system in WordPress. I've looked at a few of the main plugins and they seem to fall in to two camps: Add an extra field to ...
2
votes
2answers
655 views

Subscribe to email for security fixes?

Is there any email alert list for security fixes? I'd rather not rely on just an RSS feed.
2
votes
1answer
161 views

Security around save_post hook

There are a lot of examples using the save_post hook, that include adding and verifying a nonce, and checking the user has appropriate permissions before you continue. Is this necessary? When ...
2
votes
1answer
268 views

WordPress salts set in config and database

I have come across the following code in a new clients existing website in wp-config.php define('AUTH_KEY', 'put your unique phrase here'); define('SECURE_AUTH_KEY', 'put your unique phrase ...
2
votes
1answer
426 views

Is $wpdb->prepare escaping to much? How to use it properly?

Im pretty much confused by $wpdb->prepare. I want to use it to sanitize user input but it turned out that it destroys the query. I cannot imagine that this is how it's intended to work but I can't ...
2
votes
2answers
6k views

Tips for finding SPAM links injected into the_content

I'm working on a client's site and I noticed that posts have a hidden <div> filled to SPAM links to dick pills, etc. Hoping to get lucky, I searched for some of the keywords in the database ...
2
votes
1answer
489 views

Securing my WordPress Files and Directories

I am new to WordPress and securely hosting it on Amazon EC2. My question is, how do I secure my WordPress files and directories properly? My file permissions are set to 644 and my directories are ...
2
votes
1answer
195 views

Protecting against malicious code in Wordpress plugin updates

One of the most popular Wordpress plugins listed on the Wordpress plugins database got malicious code injected into it recently (April 2013): ...
2
votes
2answers
1k views

Renaming wp-content folder dynamically

Is it possible to rename the wp-content folder dynamically? I am building a custom framework to use on themes and it would be nice to set it up where it does everything on its own. I am using this ...
2
votes
1answer
426 views

Extend the list of MIME-types supported by the builtin uploader in 3.3

Goal I want to be able to extend the list of mime-types supported by the builtin uploader in wp 3.3.1 For example when I try to upload an .apk file to our class blog, I get a Sorry, this file type ...
2
votes
1answer
120 views

Where should my plugin POST to?

I'm creating a simple plugin to set a page as a homepage from the list pages (to appear next to edit, preview, trash actions etc), I was just wondering what that the most appropriate/secure place to ...
2
votes
1answer
40 views

Whats the safest way to output custom JavaScript and Css code entered by the admin in the Theme Settings?

I'm creating a theme in which I've created options for the admin to enter custom Javascript and Css code in the "Theme Settings" page (created using Options API). Now I'm just not sure how to output ...
2
votes
1answer
192 views

Enforcing password complexity

We need to enforce password complexity in a wordpress site, we used this article: http://www.webtipblog.com/force-password-complexity-requirements-wordpress/ We created the following in ...
2
votes
1answer
3k views

Why Better WP security plugin returns 418 I'm a Teapot “error”?

I am working on the Wordpress website and all of a sudden after deploying it on the server, I started seeing a problem where some of the pages on my website return 418 I'm a Teapot as Response status ...
2
votes
2answers
405 views

wordfence scan warning on W3 Total Cache [closed]

I use Wordfence plugin which scans server side plugins with original plugin files to see if anything was modified by hacker/cracker. Today I got a warning and it shows these modifications on ...
2
votes
1answer
54 views

What is the most secure way to set up the MySQL user in WPMU?

I am setting up Subdomain based MU on my domain.Everything is hosted by me running on one CentOS/Webmin VPS. Will I be better off setting the MySQL user's domain as localhost, 127.0.0.1 or with a ...
2
votes
1answer
1k views

how can i embed wordpress backend in iframe

I have 2 websites http://www.aaa.com and http://www.bbb.com and need it show the same. now i put iframe in index.html and upload to aaa.com. it's ok for frontend but it's doesn't work for backend, ...
2
votes
1answer
342 views

Stop wordpress automatically escaping $_POST data

I have a custom front end form which creates a custom post type post and have just discovered WordPress automatically escapes $_POST data in the same way that Magic Quotes does. I have Magic Quotes ...
2
votes
1answer
139 views

Restricting access to content

I'm developing a functionality to let only customers and doctors have access to exam results. But i'm not so sure about the strenght of my code in securing view only to those authorised. I've gotten ...
2
votes
1answer
133 views

Changing Table Prefixes - once done, am I good to go going forward?

In the book Beginning WordPress 3 the author advises that changing the default WP table prefixes can provide some slight security advantage (protects from SQL injection scripts). I found several ...
2
votes
1answer
383 views

How to block a category from one user and enable the category for the rest of the users

I have a site in which all categories are open to anyone, except for 2 categories that are password protected: Students, and Teachers. They are open only to specific users types, as follows: The ...
2
votes
3answers
7k views

How to change “wp-admin” to something else without search-replacing the core?

for example: foobar.com/wp/edit instead of foobar.com/wp/wp-admin How would I do that? I've tried using this in htaccess but it won't work: ##### ABOVE THIS POINT IS ALREADY INSERTED BY WORD PRESS ...
2
votes
1answer
217 views

Is it possible to post with Word 2007 via XML-RPC and limit categories by user?

I'm working on a project for a school district I work at where we want to use Word Press to have employees from all of the buildings post announcements and press releases via Word 2007. We will then ...
2
votes
1answer
47 views

Is it safe to enqueue a font style without putting http or https?

I have seen a few WordPress sites and tutorials enqueuing fonts like this. Does this work with http and https sites? Is it safe to do this? I see these exact URL's in the source code when testing ...
2
votes
1answer
25 views

Strange Search Queries in Apache Status

I am running a wordpress website with high traffic, my server load gets very high and while checking apache status i found flood of wordpress searches like this /?s=\"khabarnaak\"&id=39790 ...
2
votes
0answers
22 views

hSite has no css on mobile [closed]

Our WP site got hacked and we've been working with our hosting to clean all malware etc. However, now the site appears on desktop fine, but on mobile it looks as though all the css is stripped. ...
2
votes
0answers
620 views

How to get WordPress to save upload file beyond web root

I am using nginx on a multisite install. I am trying to get WordPress to save uploads to a folder beyond the webroot : /home/mydomain/file_secure as opposed to ...
2
votes
1answer
202 views

How does Cross Site Scripting (XSS) work exactly? [closed]

On WordCamp Europe I attended the talk by Brad Williams on Writing Secure WordPress Code and I would like to make sure that I implement these tips in my own code. In his presentation he gives the ...
2
votes
0answers
359 views

comment_post_ID 0 (cannot remove from dashboard)

Ran across something a bit odd that I haven't seen before. A client has a pretty active blog and uses Akismet (paid) to protect against spam. At least once a day, they're reporting a spam comment that ...