Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

0
votes
1answer
314 views

wp-content - permissions for files/folders created by apache

My wp-content folder has owner 'User' and group 'www-data'. The permissions are 775 for folders and 664 for files, so the server can write inside folder. But when the server creates folder and files ...
3
votes
3answers
77 views

Strategies for coping with hyperagressive spambots?

A couple of my sites are getting slammed by a hyperagressive distributed spambot. It's just pure link spam. It all comes from one user name, but from a variety of IPs. Akismet is catching the spam, ...
1
vote
1answer
426 views

How can I safely use $_SERVER['REQUEST_URI'] to avoid XSS?

I've seen a lot of warnings about using $_SERVER['REQUEST_URI'] because it can open things up to XSS, but I haven't been able to find anything confirming a safe way to use it. Some people have ...
0
votes
1answer
128 views

WP upload/select image , isn't this a security issue?

If in image upload frame I select a zip http://prntscr.com/6ypjlv, it does not show it in list of files but it is up http://prntscr.com/6ypjvp shouldn't we only be able to upload image types if ...
1
vote
0answers
200 views

Hide username discovery

How do I stop my usernames being leaked? To explain I tested my WordPress site on http://wprecon.com, and found that my admin username (that I have changed) was able to be discovered. User ...
0
votes
2answers
106 views

Wordpress login security

I have put up a logging script on my wp-login page. I noticed that a particular ip address- 193.176.147.7 has been consistently visiting my login page for some days now. The vitis are always in quick ...
1
vote
2answers
259 views

Is it good security advice to install wordpress in subdirectory but link to root?

Is it good to install wordpress in a subdirectory (with a random name), but set "Homepage" address to domain root? (based on Giving WordPress Its Own Directory) Since the wp-content is in the ...
0
votes
1answer
82 views

The safest way to automate WordPress backups

I'm running over 20+ sites on a Linux shared cloud environment. At present, my hosting company performs daily, offsite backups. However, these are only kept for 30 days. This works great, but what ...
2
votes
1answer
158 views

How is password strength calculated?

A password, that contains: at least one capital letter, at least one small letter, at least one number and at least one non-alphanumeric character, is considered moderate to strong (sometimes even ...
9
votes
1answer
8k views

simple solution for restricting access to (some) uploads/downloads

Initial Situation For a site I'm setting up I was looking into the whole field of securing uploads/downloads and restricting access to them based on user roles/capabilities. Of course I have read ...
0
votes
2answers
176 views

How can I create a private site that is inaccessible from the outside?

I need a safe place where I can store data about projects that I am working on. This data includes text and files (pictures, sound and video). I want to create a private "blog" for this purpouse that ...
5
votes
2answers
6k views

Limiting sessions to one IP at a time

On a site with premium user account subscriptions, I'd like to be able to limit logins to one computer at a time. The most straightforward way to accomplish this would be to limit by IP, but I haven't ...
0
votes
2answers
161 views

force login loophole

I want to restrict access to my wordpress site to allow registered users only. I have tried the following plugins: Require-login Authenticator WP-lock All of them have the same problem: After ...
0
votes
1answer
220 views

Completely remove the author url

I've already removed the login, registration, and password reset stuff. i also removed all links to the author url from single, archive, and index. now i want to remove the actual route so that bots ...
1
vote
2answers
77 views

Disabling outbound connectivity on web servers [closed]

Is it a good idea to harden your web server by disabling outbound connectivity on them? I am using RHEL 7 for a WordPress Multisite installation. After disabling outbound connectivity, the dashboard ...
0
votes
2answers
532 views

How to change WordPress user ID?

Is this enough to change the user ID? I'm doing this for security purposes, where the administrator has user ID=1 and I want to keep all posts, pages and content. UPDATE wp_posts SET post_author='...
-1
votes
3answers
137 views

What techniques can a user employ to achieve a password rated “strong” in the WordPress password checker

I have strong passwords enforced for all my clients but I got some complaints recently as some users tried to change their password and gave up trying to achieve a strong rating. I was initially ...
0
votes
1answer
53 views

Updating From Mobile App - Exposing Site to Hacking

I have made a simple Mobile App to update a wordpress site. It starts with a login (to the app) and then with forms, sends data via POST method to a PHP file that then uses wp_insert_post, ...
0
votes
1answer
669 views

200 return code on 'POST /wp-admin/admin-ajax.php' while NOT logged in

I noticed the following log entry: 111.22.3.444 - - [13/Mar/2015:08:31:00 +0100] "POST /wp-admin/admin-ajax.php HTTP/1.1" 200 618 "https://cap5.nl/veiligheidstips-en-voorkom-hacken-van-je-wachtwoord/"...
0
votes
1answer
155 views

Any way to disable /wp-login.php redirecting to the site folder?

We have our WP installs in folders on the server. We created folders called wp-admin and login to thwart hackers. However, incredulously, when you type in /wp-login.php it REDIRECTS to our mysite.com/...
1
vote
1answer
52 views

Failed login attempts

I'm using WordFence for site monitoring and overall security. I'm seeing some failed login attempts from a couple of different locations with username "admin" and "companyname". I'm not familiar with ...
0
votes
1answer
65 views

Finding where a snippet of code is coming from

I recently noticed that a site that I work on is making a call to an outside website on every page load. The following code is showing on every page: <script type="text/javascript" src="http://...
0
votes
1answer
139 views

How can i see/log all requests coming from a registration form (not from the UI)?

I am talking about the REGISTER form PROBLEM: I have some requests that are coming from somewhere else - not from the user interface. I know this, because these requests don't have all the mandatory ...
0
votes
2answers
47 views

How can I force a specific password?

How can I force a specific password for a specific user & not let that user change their password? I have a client that thinks that even if I force strong passwords via this plugin: https://...
-1
votes
1answer
28 views

Website that sells statistics

I'm building a website that will have statistics based on user activity on the website (online votes and views etc). People will have to pay to view those stats. I am utilising wodpress features ...
1
vote
1answer
37 views

Using Contact Forms to Send Private Information [closed]

I am working on a site for a Doctors Office who wants to use a contact form to send information about their patients to other offices....I was going to use contact form 7 but I'm wondering if there is ...
4
votes
0answers
46 views

Should I check for ABSPATH in Themes? [duplicate]

I recently browsed WooCommerce source, and it appears that they're doing this: <?php /** * The template for displaying product content within loops. * * Override this template by copying it to ...
0
votes
0answers
383 views

Collecting Sensitive Data in Wordpress?

I am in need of creating an online application form that collected a users SSN number and am therefore concerned with security. Is this possible to do on WP with existing plugins? My research thus ...
0
votes
1answer
33 views

What highest security brake with wordpress and static files?

I want to build my sites with Wordpress files that can't be modified and dirs where new files can't be added. Static content with permission without possibilities to execute, that will served by ...
0
votes
0answers
13 views

Why are maintenance releases now auto-update? [duplicate]

When the recent 4.1.1 was released, I thought it must be an important security update, as it's going out to all sites automatically. Reading through the changelog, I found it actually doesn't mention ...
0
votes
1answer
302 views

Stop Plugin Enumeration [closed]

Is there any way to stop plugin enumeration? I have tried Acunetix WP Security plugin, It seems to work but Yoast SEO plugin is still enumerating. Any plugins or code modifications are appreciated. ...
1
vote
1answer
75 views

Registration Plugin - Recaptcha integration

Good Day Everyone, I'm currently writing a new plugin for Registration, I intend to actually share that Registration Plugin, but I would like to integrate reCaptcha into it. From what I understood ...
78
votes
12answers
11k views

Verifying that I have fully removed a WordPress hack?

My for-fun WordPress blog at http://fakeplasticrock.com (running WordPress 3.1.1) got hacked -- it was showing an <iframe> on every page like so: <iframe src="http://evilsite.com/go/1">&...
-1
votes
1answer
218 views

Default installation permissions for wp-config.php

Recently I've noticed that many of the wordpress installations we have on our servers where being attacked and ifected by this thing eval(base64_decode("...
0
votes
3answers
4k views

How to secure WordPress XMLRPC?

XMLRPC is great for remote publishing to WordPress, but there has been many security issues attributed to it. How do it make it more secure? More specifically, only user from the intranet will be ...
0
votes
1answer
51 views

Write mysql credentials in plugin

I've to create a custom plugin to print data from a database different from the wordpress one. I'm using wpdb. Is it fine, from a security point, to write database credantials in the plugin files in ...
15
votes
1answer
4k views

If a hacker changed the blog_charset to UTF-7 does that make WordPress vulnerable to further attacks?

I had a client who got hacked recently and I noticed that there were weird characters appearing on her site, like  and Æ. It turns out that the hackers changed the blog_charset to UTF-7 in the ...
0
votes
1answer
103 views

Wordpress Brute Force Prevention

I am using WordFence security plugin for keeping track of login attempts and I regularly check the logs from it. I realize that there are going to be a lot of login attempts with the username 'admin'. ...
1
vote
1answer
108 views

Hack-Proof OR Security in Wordpress — is it real?

For many years I've been using WordPress as a platform for websites, it is convenient to me as a developer and for customers. But recent months, several sites of my clients were hacked and I'm ...
1
vote
1answer
88 views

Is it important to sanitize inputs in a shortcode that will be used in site that only I will post to?

Is there any security risk in not sanitizing shortcodes in a wordpress site if I am the only one who has access to the admin panel?
4
votes
2answers
2k views

wp.getUsersBlogs XMLRPC Brute Force Attack/Vulnerability

After the holiday weekend, one of the larger sites I manage had a brute force attack on it. The attacker was attempting to use the wp.getUsersBlogs function and a list of popular usernames and ...
0
votes
1answer
21 views

Site is continuously accessing by several IPs

I have high traffic wordpress blog, but for last two days i am constantly getting the error "Error establishing a database connection". I have called to my hosting customer care and they are saying ...
3
votes
1answer
2k views

Is it true $wpdb->get_results is faster than WP_Query in most cases?

On my homepage, I have a section where I have to display the last five featured posts, where a featured post is simply a post with a custom field is_featured set to 1. I achieved what I want with two ...
0
votes
0answers
58 views

What is the best way to upload a temporary & sensitive file and then delete it when done

What is the best way to upload a temporary & sensitive file and then delete it when done. I'm writing a plugin (eventually for multisite) that allows users with a certain role to upload a .csv ...
0
votes
0answers
532 views

Why WordPress not logout after I have close my browser?

The default login cookie has expiry time as "session", so suppose when I close my browser, I need to login again when I visit wp-admin. But I've found that serveral time I've closed my browser (kill ...
0
votes
1answer
62 views

Why isn't the login page rate limited by default?

Brute force attacks seem to the be most common vulnerability on WP installs and rate limiting ought to be relatively easy to bake into WP itself as part of the official, default software (without the ...
0
votes
1answer
33 views

How to display post meta data in secure manner

I have have a custom post meta field where I can add a embedding code (a video for example, an iframe). Now I want to retrieve the code from the post meta and display it securely. I can display it ...
1
vote
1answer
295 views

Evaluations of two wordpress security plans against php code injection attack

Senario: I've posted one wordpress php code injection senario on SO before, url:http://stackoverflow.com/questions/26826082/what-is-the-highly-efficient-way-to-remove-a-block-of-string-pattern-in-php-...
2
votes
2answers
843 views

Subscribe to email for security fixes?

Is there any email alert list for security fixes? I'd rather not rely on just an RSS feed.
5
votes
6answers
303 views

Share same domain for wp-admin but for different website

I have site like http://www.foo.com http://www.bar.com And I've a wildcard SSL cert *.example.com, instead of buying two SSL certs for the above two domains, can I re-use my existing wildcard SSL ...