Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

0
votes
2answers
106 views

Config file with no Keys..?

I'm working on a site for someone that doesn't have any keys in the wp-config file. Isn't this a serious issue? I know I can generate these but I wonder if this will have any side-effects..also, is ...
2
votes
1answer
749 views

Is wp_nonce_field vulnerable if you know the action name?

Is wp_nonce_field vulnerable if you know the action name? I am actually adding a hidden field with name = the name of the action name in my form so that my plugin can identify it. I want to know if ...
0
votes
1answer
187 views

Troll the hackers by redirecting them

My website is getting somewhat popular, and with the it's increasing popularity there's an increase in the hackers. Last night I visited my security logs and found that everyday approximately 10 ...
2
votes
1answer
359 views

Is $wpdb->prepare escaping to much? How to use it properly?

Im pretty much confused by $wpdb->prepare. I want to use it to sanitize user input but it turned out that it destroys the query. I cannot imagine that this is how it's intended to work but I can't ...
10
votes
1answer
187 views

Why does WordPress need my private ssh key to update?

Configuring WordPress to update within the application (i.e. WordPress) is ideal for me because of its convenience. Nonetheless, I'm troubled by the requirements. The requested fields that show up ...
4
votes
2answers
211 views

Is WP vulnerable when updating plugins or themes?

Once, I had a problem that somehow someone managed to change files of my website without FTP or SSH credentials. Probably he got in through WP (probably it wasn't a 'he', but an 'it', a bot), we said ...
12
votes
4answers
26k views

Is there any way to rename or hide wp-login.php?

Any way to change the wp-login.php url? It seems insecure that everyone that's ever used Wordpress could easily see if your site is using it, and get right to the login page. There used to be a ...
4
votes
2answers
296 views

Make password invalid once logged out of password-protected page

In a WP-based site I have a custom form which I need to hide from the general public and give access to only a select few who would then get a password from me, enter it and access the form and submit ...
0
votes
0answers
356 views

Can I make an ajax response cross-domain?

I am trying to make a single ajax response cross-domain. Is that possible? I tried something like this, but that did not work: function my_call_callback() { header("Access-Control-Allow-Origin: ...
3
votes
1answer
82 views

Secure my “add_settings_field” translation?

I am using "add_settings_field" and want to provide translation for it , but my problem is security. So is __('My Checbox:' , 'domain') secure enough for translation? If not what can I do about it? I ...
0
votes
0answers
83 views

Wordpress exploited theme is causing high io load on server

I used a Wordpress theme for a while that was causing high IO-load on my server. That was because there was some kind of exploits made/available for the theme: ...
1
vote
2answers
182 views

How to hide easy access to my website temporarily?

I am developing a new website and I do not want others, except for my colleagues, to access it easily. I don't want it to be password protected because my colleagues are testing it intensively. Is ...
0
votes
1answer
70 views

Storing FTP details in wp-config.php

I'd like to hear about the security concerns for storing FTP details in wp-config.php on a shared server. It doesn't 'feel' safe to me. I'm using ManageWP to control sites on a shared server and have ...
2
votes
3answers
431 views

How brute-forcer knows that the password is cracked for target username?

There are very many brute-force attacks (mostly for 'admin' username) on WordPress sites. All these attacks are made automatically via post requests. The question 1: how brute-forcer knows that the ...
0
votes
1answer
91 views

Specific way to allow Wordpress users to view their current password? And edit it?

I know the built in user manager doesn't allow a user to see what her current pass is, just recover / reset it via email or write in a new one in the admin but I am looking for a plugin or other ...
2
votes
2answers
4k views

Tips for finding SPAM links injected into the_content

I'm working on a client's site and I noticed that posts have a hidden <div> filled to SPAM links to dick pills, etc. Hoping to get lucky, I searched for some of the keywords in the database ...
1
vote
1answer
8k views

Receiving “This content cannot be displayed in a frame” error on login page

I am using a new domain for my WordPress directory in different server. When I click the meta links such "Login" or "register", I get this page: This content cannot be displayed in a frame To ...
0
votes
0answers
11 views

Configuration File Safety [duplicate]

I'm new to PHP and WordPress and I've a few questions to ask about database and configuration file security. I hope you answer them. When I try to reach some wp sites config file by typing ...
0
votes
0answers
124 views

Why are xmlrpc.php and wp-cron.php being called so often?

I'm running a Wordpress website and I have found from the server logs that xmlrpc.php and wp-cron.php are being requested (POST requests, of course) very frequently--including some suspicious ips that ...
3
votes
2answers
4k views

Password protect some uploaded files, so only logged-in users can view them

I would like to protect some uploaded files, so that they are not publicly accessible (they are not accessible without a login). I'm uploading some PDF files, and I'd like to mark some of them as ...
1
vote
1answer
7k views

Change WP-Login or WP-Admin

Can I change the name of the wp-login or wp-admin file so that I can go to a different filename in order to login. I am trying to prevent hackers from finding my login and wp-login has become a very ...
0
votes
1answer
40 views

Is it necessary to use a WordPress nonce when allowing users to download public data?

I am using jQuery .load() to load the next page of WordPress posts after a button is clicked. The next page of posts is public data (no access restrictions on it whatsoever). Should I use a WordPress ...
1
vote
0answers
203 views

Renaming admin user on multisite install by MySQL

As part of a general tightening of security, I want to change the name of the admin user on my multisite install to something less commonly used. This user is admin on all five sites in the network ...
1
vote
2answers
78 views

How to protect wp-admin through .htaccess?

I'd like to protect the /wp-admin/ directory at the server level. This means two logins. One through the server and another through WordPress. I believe this can be handled through .htaccess. Does ...
0
votes
1answer
134 views

Hide wp-login.php but not the widget

I have a website which is still under nascent construction stage: http://42charts.com . Lately I find that couple of users are registering themselves in my site. It seems like a bot as the mails IDs ...
1
vote
1answer
118 views

using rewrites to secure login page

I'm trying to be sneaky with iis to secure a wordpress login page (not my choice to run a windows server, but that's the reality of things). It's worked so far, only the login page itself loads itself ...
67
votes
8answers
23k views

Is moving wp-config outside the web root really beneficial?

One of the most common security best practices these days seems to be moving wp-config.php one directory higher than the vhost's document root. I've never really found a good explanation for that, but ...
4
votes
3answers
9k views

How does admin-ajax.php work?

we are having some issues with an external developer. i am not a wp person so i turn to the masses to help out. we want to limit access to the wp-admin site to internal access only (via vpn). simply ...
0
votes
2answers
3k views

Password protect a specific category page/post

I have searched high and low for this but nothing is sticking out at me. I am looking to password protect posts and/or pages based on a certain category. The reason for this is that I am creating a ...
0
votes
1answer
74 views

Able to go to WordPress admin even after deleting auth cookies from request headers

I discovered that if I remove my auth cookies from my browser's request header, I am still able to view a page. Steps: Log into my WordPress installation Go to the wp-admin page In Chrome, use the ...
4
votes
3answers
361 views

Disabled plugins are the security holes - rumor or reality?

I've read many WordPress Security blog articles, where the Security Experts're recommending some special matters to take care when somebody is concern about his/her WordPress site's security. Among ...
0
votes
1answer
85 views

User meta and public function security

I am using stripe to setup a system of buying credits, which can be used on my wordpress site. I save credits using wordpress user meta, and I increment those credits after a successful transaction ...
0
votes
1answer
83 views

Remove hacked code - out of ideas! [closed]

I've been working on a project which keeps getting some PHP inserted into the config.php file and it's causing a lot of issues with SEO. I'll paste in a sample of it (it's quite long) after this ...
1
vote
2answers
613 views

How can I make uploaded images in the editor load with HTTPS?

I have the admin section of my site using HTTPS. This works pretty well except that the images inside the TinyMCE editor (the post and page rich text editor) load with http instead of https and so I ...
1
vote
2answers
109 views

Moving wordpress out of the public directory

Is there a way to move wordpress out of the public html directory? The PHP files responsible for generating html output should be hosted but the php files responsible for database connections and ...
2
votes
1answer
189 views

Which of WordPress's .php files need to be directly accessible via HTTP?

I'm trying to tighten up security on my WordPress installation, and one of the things that seems like it might be a good idea is preventing all of the internal-use .php files from being accessed ...
0
votes
2answers
1k views

Uploading .webm format on WordPress results in security guidline breach and fail

I cannot upload the .webm video format on WordPress. This is after adding: AddType video/webm .webm into both: my .htaccess file (on the root folder of the WordPress installation) the mime type ...
4
votes
3answers
786 views

Secure WordPress paid plug-in

I want to create a WordPress plug-in but also want to ensure that the plugin can only be used after it has been activated with a serial key that should be unique for each domain. What is the best way ...
0
votes
0answers
16 views

Alternative ways to make ajax requests in wordpress [duplicate]

I'm currently having a problem with working with AJAX. Well not really a problem since I can pretty much do what I want to do. The only problem is my boss saying that the admin-ajax.php file is an ...
-1
votes
1answer
25 views

is this code properly secured

The input will be an address. This is what I gather from looking at the Codex. See here: codex $wpdb->insert($address_table, array('address' => $address),array('%s'));
0
votes
0answers
15 views

Security: How to disallow viewing/browsing by author? [duplicate]

I've already inserted htaccess code to disallow searching for users by numeric id. However, one can still manually input a user name to view/browse by author, e.g. http://mywpsite.com/author/peter/ ...
-1
votes
3answers
4k views

nginx + wordpress: Best practices for configuring it to be secure, reliable, and fast? [closed]

BACKGROUND: Running everything up on Linode. Having followed the "Getting Started," "Securing Your Server," "LEMP Server on Ubuntu 12.04," and the "Manage Web Content with WordPress" guides I was ...
4
votes
5answers
7k views

Is there a way to force ssl on certain pages

I want to force a secure connection on some of my pages (ones with forms), but I don't want the whole site to work with ssl (slows it down) Is there a way to configure specific pages to require ssl?
0
votes
1answer
49 views

Restrict Content for only Contributors via .htaccess

I have been using this code to restrict content download from wp-content/uploads for only logged in users: RewriteEngine On RewriteBase / # Add these lines right after the preceding two ...
1
vote
1answer
32 views

Is it safe to hand over the admin rights?

I have a shared web hosting account where I have several different websites running on WordPress. I want to hand over the admin rights for one of my WordPress installs to someone and I am wondering ...
0
votes
0answers
253 views

Malware/Permission bug removal?

I'm facing a hell of a problem on a client's WP theme. Whenever I try to 'Activate' it, it gives me the following errors on a blank page: Warning: ...
0
votes
0answers
52 views

Allowing access to certain Wordpress created pages or posts with htaccess / htpasswd

Trying to figure out how to give access to a certain page, lets say http://mypage.com/page and not letting people access the main index via http://mypage.com. Or just simply disallow access to ...
0
votes
0answers
20 views

Permission of uploads folder [duplicate]

My Wordpress site was hacked today. When I investigated, I noticed that there were some malicious files under wp-content/uploads/ folder. I had set the permission of uploads folder to 777 for ...
0
votes
1answer
244 views

security concerns if using html data-* attribute for l10n?

I need to pass a localized multidimensional javascript object to a page. The object is constructed using php and represents some wp-theme settings. I cant find a way to utilize wp_localize_script for ...
2
votes
1answer
173 views

How does Cross Site Scripting (XSS) work exactly? [closed]

On WordCamp Europe I attended the talk by Brad Williams on Writing Secure WordPress Code and I would like to make sure that I implement these tips in my own code. In his presentation he gives the ...