Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

2
votes
4answers
207 views

Will WordPress username displayed somewhere in the site?

I am considering enforcing all my users to use email as their login name. But I am afraid that the username is being used somewhere that is publicly accessible, e.g. author pages, such as that it will ...
2
votes
1answer
1k views

When to use esc_html and when to use sanitize_text_field?

It seems that they do almost same type of job. So... When should I use esc_html() instead of sanitize_text_field()?
2
votes
2answers
90 views

Can someone (Support of my themeprovider) get access to my server If I send them my admin login?

I have bought a WP theme from a huge provider (themeforest). But it has a lot of bugs. The support asked me to send my WP Admin Login/Password. What risk does this have? I know the supportstaff will ...
2
votes
5answers
990 views

Upgrading Wordpress 4.0 asks for FTP password

I was able to upgrade Wordpress 4.0 on my local machine, and I also just updated some plugins on the production machine, but when I try to update Wordpress 4.0 on the production machine, it is asking ...
2
votes
1answer
676 views

Is wp_nonce_field vulnerable if you know the action name?

Is wp_nonce_field vulnerable if you know the action name? I am actually adding a hidden field with name = the name of the action name in my form so that my plugin can identify it. I want to know if ...
2
votes
3answers
107 views

How can I easily verify a core or plugin update has not broken anything?

I'm looking for ways to make updating WordPress less frightening for me. I created around 30 company websites based in WP in my career and I feel somewhat responsible for them in regards to security. ...
2
votes
3answers
1k views

How to properly validate data from $_GET or $_REQUEST using WordPress functions?

I am working on a plugin that requires on-the-fly manipulation of content output. This is solely dependent on the current $_GET variable or $_REQUEST variable. Depending on what the variable is set ...
2
votes
1answer
242 views

Wordpress Malware Problem help! [duplicate]

Possible Duplicate: Wordpress Trojan issue help! I accessed the wordpress website I am building and received a warning about a trojan from my anti virus software. I have now checked the ...
2
votes
1answer
970 views

What is the relationship between cURL, WordPress and cacert.pem?

I've run into a problem concerning wp_remote_get() and the underlying cURL call. On some WordPress installations I see the following SSL error: httprequest_failed: SSL certificate problem, verify ...
2
votes
1answer
340 views

Confusion on WP Nonce usage in my Plugin

I created a small plugin where users can set multiple featured image by clicking Add New link from the meta box and remove them as well. The user can use Set featured image link to select featured ...
2
votes
2answers
106 views

Best Way to Enable Two Step Authentication

I'm looking for a bit of guidance on setting up a two step authentication system in WordPress. I've looked at a few of the main plugins and they seem to fall in to two camps: Add an extra field to ...
2
votes
1answer
706 views

Generate Wordpress salt

I am in need of a function that automatically generates and returns salts for Wordpress wp-config.php (Don't link me to their API, I'm looking for offline solution). Does Wordpress core has this ...
2
votes
2answers
1k views

Correct Approach for Validating Custom Field Input

I have a custom post type with several custom fields. I am looking to do some validation on these fields because they will be used downstream by other services. So, it is important that it can't be ...
2
votes
2answers
530 views

Subscribe to email for security fixes?

Is there any email alert list for security fixes? I'd rather not rely on just an RSS feed.
2
votes
1answer
131 views

Security around save_post hook

There are a lot of examples using the save_post hook, that include adding and verifying a nonce, and checking the user has appropriate permissions before you continue. Is this necessary? When ...
2
votes
1answer
154 views

WordPress salts set in config and database

I have come across the following code in a new clients existing website in wp-config.php define('AUTH_KEY', 'put your unique phrase here'); define('SECURE_AUTH_KEY', 'put your unique phrase ...
2
votes
1answer
332 views

Is $wpdb->prepare escaping to much? How to use it properly?

Im pretty much confused by $wpdb->prepare. I want to use it to sanitize user input but it turned out that it destroys the query. I cannot imagine that this is how it's intended to work but I can't ...
2
votes
2answers
4k views

Tips for finding SPAM links injected into the_content

I'm working on a client's site and I noticed that posts have a hidden <div> filled to SPAM links to dick pills, etc. Hoping to get lucky, I searched for some of the keywords in the database ...
2
votes
1answer
191 views

Protecting against malicious code in Wordpress plugin updates

One of the most popular Wordpress plugins listed on the Wordpress plugins database got malicious code injected into it recently (April 2013): ...
2
votes
2answers
1k views

Renaming wp-content folder dynamically

Is it possible to rename the wp-content folder dynamically? I am building a custom framework to use on themes and it would be nice to set it up where it does everything on its own. I am using this ...
2
votes
1answer
411 views

Extend the list of MIME-types supported by the builtin uploader in 3.3

Goal I want to be able to extend the list of mime-types supported by the builtin uploader in wp 3.3.1 For example when I try to upload an .apk file to our class blog, I get a Sorry, this file type ...
2
votes
1answer
104 views

Where should my plugin POST to?

I'm creating a simple plugin to set a page as a homepage from the list pages (to appear next to edit, preview, trash actions etc), I was just wondering what that the most appropriate/secure place to ...
2
votes
1answer
151 views

Enforcing password complexity

We need to enforce password complexity in a wordpress site, we used this article: http://www.webtipblog.com/force-password-complexity-requirements-wordpress/ We created the following in ...
2
votes
1answer
3k views

Why Better WP security plugin returns 418 I'm a Teapot “error”?

I am working on the Wordpress website and all of a sudden after deploying it on the server, I started seeing a problem where some of the pages on my website return 418 I'm a Teapot as Response status ...
2
votes
2answers
369 views

wordfence scan warning on W3 Total Cache [closed]

I use Wordfence plugin which scans server side plugins with original plugin files to see if anything was modified by hacker/cracker. Today I got a warning and it shows these modifications on ...
2
votes
1answer
54 views

What is the most secure way to set up the MySQL user in WPMU?

I am setting up Subdomain based MU on my domain.Everything is hosted by me running on one CentOS/Webmin VPS. Will I be better off setting the MySQL user's domain as localhost, 127.0.0.1 or with a ...
2
votes
1answer
1k views

how can i embed wordpress backend in iframe

I have 2 websites http://www.aaa.com and http://www.bbb.com and need it show the same. now i put iframe in index.html and upload to aaa.com. it's ok for frontend but it's doesn't work for backend, ...
2
votes
1answer
299 views

Stop wordpress automatically escaping $_POST data

I have a custom front end form which creates a custom post type post and have just discovered WordPress automatically escapes $_POST data in the same way that Magic Quotes does. I have Magic Quotes ...
2
votes
1answer
133 views

Restricting access to content

I'm developing a functionality to let only customers and doctors have access to exam results. But i'm not so sure about the strenght of my code in securing view only to those authorised. I've gotten ...
2
votes
1answer
129 views

Changing Table Prefixes - once done, am I good to go going forward?

In the book Beginning WordPress 3 the author advises that changing the default WP table prefixes can provide some slight security advantage (protects from SQL injection scripts). I found several ...
2
votes
1answer
375 views

How to block a category from one user and enable the category for the rest of the users

I have a site in which all categories are open to anyone, except for 2 categories that are password protected: Students, and Teachers. They are open only to specific users types, as follows: The ...
2
votes
3answers
7k views

How to change “wp-admin” to something else without search-replacing the core?

for example: foobar.com/wp/edit instead of foobar.com/wp/wp-admin How would I do that? I've tried using this in htaccess but it won't work: ##### ABOVE THIS POINT IS ALREADY INSERTED BY WORD PRESS ...
2
votes
1answer
217 views

Is it possible to post with Word 2007 via XML-RPC and limit categories by user?

I'm working on a project for a school district I work at where we want to use Word Press to have employees from all of the buildings post announcements and press releases via Word 2007. We will then ...
2
votes
0answers
18 views

hSite has no css on mobile [closed]

Our WP site got hacked and we've been working with our hosting to clean all malware etc. However, now the site appears on desktop fine, but on mobile it looks as though all the css is stripped. ...
2
votes
0answers
480 views

How to get WordPress to save upload file beyond web root

I am using nginx on a multisite install. I am trying to get WordPress to save uploads to a folder beyond the webroot : /home/mydomain/file_secure as opposed to ...
2
votes
1answer
168 views

How does Cross Site Scripting (XSS) work exactly? [closed]

On WordCamp Europe I attended the talk by Brad Williams on Writing Secure WordPress Code and I would like to make sure that I implement these tips in my own code. In his presentation he gives the ...
2
votes
0answers
350 views

comment_post_ID 0 (cannot remove from dashboard)

Ran across something a bit odd that I haven't seen before. A client has a pretty active blog and uses Akismet (paid) to protect against spam. At least once a day, they're reporting a spam comment that ...
2
votes
2answers
79 views

How to limit WordPress pages during updates?

I will be doing upgrades to the design and content of my Wordpress site. During this time I only want the homepage to be available. Is there a good way to lock this down (through a plug-in, etc.). ...
2
votes
1answer
184 views

Which of WordPress's .php files need to be directly accessible via HTTP?

I'm trying to tighten up security on my WordPress installation, and one of the things that seems like it might be a good idea is preventing all of the internal-use .php files from being accessed ...
2
votes
2answers
1k views

Has anyone experience w/ WordPress (MultiSite) hidden users (possibly hacked)?

I have 2 WordPress MultiSite installs (on different accounts, but under the same HostGator reseller a/c) and both seem to have been compromised. I say "compromised" because the user_logins have been ...
1
vote
1answer
964 views

What is the best method to close off the backend?

The goal: Completely remove the ability to access the WordPress backend on the production domain. Ex. return a 404 for http://example.com/wp-admin Purpose: I don't want any possibility of WordPress' ...
1
vote
3answers
111 views

Why users disable the WordPress update?

Users install plugins which disable update reminders. Plugins: disable WordPress Core Updates disable WordPress Plugin Updates disable WordPress Theme Updates Look at the counter of plugins ...
1
vote
4answers
4k views

How to remove “Connection Information” requirement on localhost install of WP on MACOSX

I've just installed XAMPP on Mac OSX and when trying to install a theme or plugin in WP admin, I'm getting this screen. I've never gotten this on my shared hosting account. how to get rid of it on ...
1
vote
4answers
1k views

No option “I would like my site to be private, visible only to users I choose” in Privacy Settings

I am running WordPress 3.3.2 self-hosted. I used to see the option "I would like my site to be private, visible only to users I choose" under Privacy Settings but I no longer see this option. Instead, ...
1
vote
3answers
2k views

Why do I need to check if wp_nonce_field() exists before using it

i dont really understand why the check if the nonce function exists before running it ... if ( function_exists('wp_nonce_field') ) wp_nonce_field('gmp_nonce_check'); i understand its for ...
1
vote
1answer
8k views

Receiving “This content cannot be displayed in a frame” error on login page

I am using a new domain for my WordPress directory in different server. When I click the meta links such "Login" or "register", I get this page: This content cannot be displayed in a frame To ...
1
vote
2answers
723 views

wp_nonce_field displaying twice

I have wp_nonce_field in my code but it's creating two instances to the html code for some reason, one where I'd expect it and another at the start of the entry. Is this correct or am I doing ...
1
vote
1answer
93 views

Why was my blog post inserted lot's of ad links by others?

I found that my blog posts are inserted lot's of ad links, I'm using WordPress 2.9.2, is there a known security vulnerability in it? A screenshot : I post some codes on my blog, the ad links are ...
1
vote
2answers
125 views

Weird problems after recovery from security breach

The shared server that I used for hosting my WordPress website was hacked recently, and many of the index.php files, plugin files and uploads were deleted, with my MySQL databases untouched. But after ...
1
vote
2answers
46 views

Disabling outbound connectivity on web servers [closed]

Is it a good idea to harden your web server by disabling outbound connectivity on them? I am using RHEL 7 for a WordPress Multisite installation. After disabling outbound connectivity, the dashboard ...