Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

0
votes
1answer
97 views

force login loophole

I want to restrict access to my wordpress site to allow registered users only. I have tried the following plugins: Require-login Authenticator WP-lock All of them have the same problem: After ...
3
votes
1answer
404 views

When to use esc_url, esc_html, esc_attr, and friends?

Discovered esc_url today while customizing an _s theme. I understand what the function does (sanitizes the URL inside), but what I'm unsure of is the scope of its use. It makes sense to me that if ...
0
votes
3answers
180 views

How to stop direct HTTP POST to a PHP script?

I have a form on my site, created using Contact Form 7 with Captcha. Contents of the form when POSTed are being sent to a PHP script, the "action" attribute of the form is set to ...
-2
votes
2answers
524 views

Is there a secure way for the public to submit images, videos, and documents using WordPress?

I want the public to submit images, photo simulations, models, video, animation, illustrated narration, papers and other publications and multimedia. images - 30" x 42" 300 dpi . pdf format file size. ...
0
votes
2answers
526 views

Too many login attempts

Since a week or two I keep receiving the following automatic email message sent from my WordPress website, and I'd like to know if it indicates any security hole and if there's anything I can do to ...
2
votes
2answers
6k views

How to change “wp-admin” to something else without search-replacing the core?

for example: foobar.com/wp/edit instead of foobar.com/wp/wp-admin How would I do that? I've tried using this in htaccess but it won't work: ##### ABOVE THIS POINT IS ALREADY INSERTED BY WORD PRESS ...
1
vote
1answer
185 views

Using esc_html with HTML purifier and CSSTidy: Overkill?

Currently my text area input (which accepts custom CSS input from a user) in the Wordpress theme options panel are sanitized by esc_html function in Wordpress ...
0
votes
2answers
38 views

Separate Out Real Users

If I look at /wp-admin/users.php I see all the users, but some have given a bogus email and never used their password. Is there some way to see who has used their password at least once? If not, ...
1
vote
0answers
104 views

Disallow file edit not preventing plugin install

I have a little demo site (admin details are listed publicly), and I've configured the wp-config to disallow file edits, so in theory no one can install a theme / plugin. ...
1
vote
0answers
102 views

How can I secure a WordPress blog using OpenID from a single provider?

We're about to launch an internal blog for the company I work at. Much of the blog will be available to the public, but certain posts will be for employees only. Our intranet/extranet has an OpenID ...
7
votes
2answers
275 views

Securing Admin Accounts - Username Discovery

We've had Limit Login Attempts installed for some weeks now, and the number of brute force attempts occurring on wp-admin/wp-login is pretty amazing. At first the attempts were all with the username ...
0
votes
1answer
113 views

Auto log in hook is requiring a page refresh

I have a simple auto log in hook that looks like the following: function auto_login() { if (!is_user_logged_in()) { //Removed some code for brevity. $user = ...
0
votes
1answer
68 views

Security to delete post by Admin

My code is so simple like when admin delete a post by Wordpress fucntion (PHP) and do action with jQuery <?php include('../../../../../../wp-config.php'); if(current_user_can('edit_posts')){ $id = ...
2
votes
2answers
193 views

wordfence scan warning on W3 Total Cache

I use Wordfence plugin which scans server side plugins with original plugin files to see if anything was modified by hacker/cracker. Today I got a warning and it shows these modifications on ...
5
votes
2answers
743 views

File and directory permissions

I installed latest WordPress 3.5 in my CentOS server. When I tried accessing http://example.com/wp-includes/, I received a listing of the directory: (Index of wp-includes). I added the following code ...
0
votes
1answer
1k views

Problem with permissions in wp-content/plugins

I have a WP installation on my local machine and trying to get my hands dirty with plugins. I wish to clone a project from github which has this plugin code. However, i dont have the permissions ...
0
votes
1answer
341 views

Wordpress Security - How to block alternative Wordpress access

I own a self-hosted Wordpress 3.5 blog. I'm working on its security and I'm trying to prevent non-writers from accessing anything admin-ish they shouldn't. Recently I tried Better Wordpress Security, ...
-1
votes
1answer
166 views

Default installation permissions for wp-config.php

Recently I've noticed that many of the wordpress installations we have on our servers where being attacked and ifected by this thing ...
-2
votes
2answers
108 views

Is this a WordPress security bug?

<?php if ( ! is_admin() ) return; echo 'You should not see this if you\'re not logged in!'; ?> If you put this in a mu-plugin, and go to your admin, e.g., example.com/wp-admin/ while you are ...
7
votes
1answer
370 views

From a security standpoint, should bloginfo() or get_bloginfo() be escaped?

I've been reviewing a lot of information about WP theme and plugin security and understand the concept that you should escape attributes and HTML values in themes and plugins. I've seen bloginfo() and ...
0
votes
2answers
165 views

How to prevent plugins from sniffing/stealing other plugins' options?

Many plugins require configuration with sensitive data such as API keys, passwords, etc. When implementing these plugins, this sensitive data is stored using functions such as update_option() and ...
0
votes
1answer
47 views

Is this plugin safe to run?

This is an extract of code from a wordpress plugin. Is it safe to run despite the variables not being filtered? Also does the wpdb class filter to prevent any injection? list($email_id, $user_id, ...
0
votes
1answer
143 views

Admin can enter JavaScript - potential security risk?

WP 3.5/TwentyTwelve/Clean install. I try this when login as admin and editor. I try add reply for first post "Hello World": <script>alert('XSS')</script><script><</script> ...
0
votes
1answer
410 views

Basic password protection without using users and roles

I'm using WooCommerce, and want to be able to password protect products (or preferably whole categories if possible), but without using the Users & Roles functionality build into WP(because I need ...
0
votes
2answers
162 views

File permissions for wp-minify plugin

I am worried on installing Wp-Minify plugin. But it needs 777 permission for the cache directory located inside wp-uploads directory. Isn't it a security issue?
0
votes
1answer
97 views

security issue in wordpress?

I have installed wordpress in www.mysite.com/user and now suppose if someone is familiare with wordpress he/she can easily access my stuffs through www.mysite.com/user/members ...
2
votes
1answer
179 views

Nonces can be reused multiple times? Bug / Security issue?

I've read that nonces are meant to be for one time use only, and after an ajax request, you should issue a new nonce so with the next ajax request, a new nonce would be sent to the server. However, I ...
0
votes
2answers
3k views

Protecting HTML5 video

I shall explain my situation as best I can so you can see where i'm coming from. I'm working on a wordpress site for a sports team, there are loads of teams. We want to put coaching sessions on our ...
1
vote
1answer
1k views

Disable directory browsing of uploads folder

I'm using Wordpress as a CMS for a simple website. I want to prevent users from being able to browse the directories such as the wp-content/uploads folder or any directories of my theme. My host does ...
3
votes
1answer
716 views

Masking logout URL

The primary goal is to hide that the site is driven by wordpress. I've got the login part all locked up, but the logout URL still has those blasted wp delineators that give away it's a wordpress site. ...
1
vote
0answers
358 views

Security - Ajax and Nonce use [closed]

I'm developing a site which posts a number of ajax calls from jquery to PHP and returns data from PhP to jquery. Everything is working, but i'd to know if my approach to handling the calls is ok, in ...
0
votes
1answer
957 views

wp_insert_post disable HTML filter

I have input value "<iframe>....</iframe>" (param 'post_content'). When i execute wp_insert_post, function cut off my tag. How to disable HTML filter in wp_insert_post ?
1
vote
3answers
1k views

Why do I need to check if wp_nonce_field() exists before using it

i dont really understand why the check if the nonce function exists before running it ... if ( function_exists('wp_nonce_field') ) wp_nonce_field('gmp_nonce_check'); i understand its for ...
1
vote
1answer
44 views

About WordPress site security

If I install WordPress on my server, does it mean that Akismet is installed automatically? If so - do I still need to create e-mail verification and captcha tools for improving site security (as I see ...
-1
votes
3answers
778 views

Wordpress Hacks/Defacing [closed]

Im trying to figure out how Wordpress sites become defaced/hacked. I know development very well. I know how to secure code, etc. But I am finding recently, that tons of Wordpress sites are becoming ...
4
votes
1answer
274 views

How to protect uploads in multisite if user is not logged in?

I am trying to set up a multisite intranet (using subdomains) where content on each sub-site is only accessible to users logged into their respective site. The problem I am having is trying to ...
2
votes
0answers
276 views

comment_post_ID 0 (cannot remove from dashboard)

Ran across something a bit odd that I haven't seen before. A client has a pretty active blog and uses Akismet (paid) to protect against spam. At least once a day, they're reporting a spam comment that ...
10
votes
2answers
211 views

How Can I Securely Implement a Password-less Login Feature?

Just posted a new plugin: No More Passwords I currently have it tagged beta because logging into a platform is a sensitive issue and I don't want to release something that may have security holes. So ...
5
votes
3answers
941 views

Filter any HTTP request URI?

I want to filter any HTTP request URI done through the HTTP API. Use cases: The WordPress update check goes to http://api.wordpress.org/core/version-check/1.6/, but ...
2
votes
2answers
736 views

Renaming wp-content folder dynamically

Is it possible to rename the wp-content folder dynamically? I am building a custom framework to use on themes and it would be nice to set it up where it does everything on its own. I am using this ...
6
votes
2answers
2k views

Prevent access or auto-delete readme.html, license.txt, wp-config-sample.php

Just a quick question that might help a tad bit with security. I noticed that the readme.html file has the version number listed. It reappears after each upgrade and so do the licence.txt, and ...
0
votes
1answer
458 views

What is the best method to close off the backend?

The goal: Completely remove the ability to access the WordPress backend on the production domain. Ex. return a 404 for http://example.com/wp-admin Purpose: I don't want any possibility of WordPress' ...
0
votes
1answer
61 views

How 'secure' are loops?

I am using loops as means of displaying personal meta and customer information on the frontend. For example, I have a page which displays a user's 'profile' information to edit. Their profile is ...
6
votes
1answer
73 views

Is it safe to store a user setting you don't want the user to ever modify as a user option?

I have added some custom user options to the profile page on my site, and most are all OK for the user to modify themselves. These options live in their own section. The users have read access and ...
13
votes
2answers
5k views

Getting a List of Currently Available Roles on a WordPress Site?

When writing WordPress plugins there is often a need to set up options for which roles on the site have access to certain functionality or content. To do this a plugin dev needs to fetch the list of ...
2
votes
1answer
529 views

how can i embed wordpress backend in iframe

I have 2 websites http://www.aaa.com and http://www.bbb.com and need it show the same. now i put iframe in index.html and upload to aaa.com. it's ok for frontend but it's doesn't work for backend, ...
2
votes
1answer
53 views

What is the most secure way to set up the MySQL user in WPMU?

I am setting up Subdomain based MU on my domain.Everything is hosted by me running on one CentOS/Webmin VPS. Will I be better off setting the MySQL user's domain as localhost, 127.0.0.1 or with a ...
0
votes
1answer
67 views

Wordpress custom admin functions security

i have a case in my admin panel where i need to call my own function that resides in my own php file, with a GET request. This function is actually removing entries from the database. So, i would ...
0
votes
1answer
136 views

Secure Wordpress: Change admin

I'm sorry if this is an extremely stupid question. I've been looking for ways how to secure my WP and a lot of websites suggest to create a new admin user account and delete the old one. Now, if I ...
1
vote
0answers
67 views

Are un-sanitized theme options more vulnerable to malicious scripts than the theme editor?

I'd like to put text areas in a theme options area to allow users to easily add analytics code, scripts, and css. Is it silly to worry about malicious code being inserted via un-sanitized theme ...