Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

4
votes
0answers
46 views

Should I check for ABSPATH in Themes? [duplicate]

I recently browsed WooCommerce source, and it appears that they're doing this: <?php /** * The template for displaying product content within loops. * * Override this template by copying it to ...
0
votes
0answers
412 views

Collecting Sensitive Data in Wordpress?

I am in need of creating an online application form that collected a users SSN number and am therefore concerned with security. Is this possible to do on WP with existing plugins? My research thus ...
0
votes
1answer
33 views

What highest security brake with wordpress and static files?

I want to build my sites with Wordpress files that can't be modified and dirs where new files can't be added. Static content with permission without possibilities to execute, that will served by ...
0
votes
1answer
145 views

How can i see/log all requests coming from a registration form (not from the UI)?

I am talking about the REGISTER form PROBLEM: I have some requests that are coming from somewhere else - not from the user interface. I know this, because these requests don't have all the mandatory ...
0
votes
0answers
13 views

Why are maintenance releases now auto-update? [duplicate]

When the recent 4.1.1 was released, I thought it must be an important security update, as it's going out to all sites automatically. Reading through the changelog, I found it actually doesn't mention ...
0
votes
2answers
1k views

How to sanitize select box values in post meta?

I have added a select box in the Post meta. Here is the code, and it works fine. My question is, do I need to sanitize the values before updating the post meta? If yes, how it should be done? This is ...
0
votes
1answer
318 views

Stop Plugin Enumeration [closed]

Is there any way to stop plugin enumeration? I have tried Acunetix WP Security plugin, It seems to work but Yoast SEO plugin is still enumerating. Any plugins or code modifications are appreciated. ...
1
vote
1answer
76 views

Registration Plugin - Recaptcha integration

Good Day Everyone, I'm currently writing a new plugin for Registration, I intend to actually share that Registration Plugin, but I would like to integrate reCaptcha into it. From what I understood ...
0
votes
1answer
53 views

Write mysql credentials in plugin

I've to create a custom plugin to print data from a database different from the wordpress one. I'm using wpdb. Is it fine, from a security point, to write database credantials in the plugin files in ...
0
votes
1answer
103 views

Wordpress Brute Force Prevention

I am using WordFence security plugin for keeping track of login attempts and I regularly check the logs from it. I realize that there are going to be a lot of login attempts with the username 'admin'. ...
1
vote
1answer
109 views

Hack-Proof OR Security in Wordpress — is it real?

For many years I've been using WordPress as a platform for websites, it is convenient to me as a developer and for customers. But recent months, several sites of my clients were hacked and I'm ...
1
vote
1answer
91 views

Is it important to sanitize inputs in a shortcode that will be used in site that only I will post to?

Is there any security risk in not sanitizing shortcodes in a wordpress site if I am the only one who has access to the admin panel?
0
votes
1answer
21 views

Site is continuously accessing by several IPs

I have high traffic wordpress blog, but for last two days i am constantly getting the error "Error establishing a database connection". I have called to my hosting customer care and they are saying ...
0
votes
3answers
790 views

FORCE_SSL_ADMIN not working

Any ideas why define('FORCE_SSL_ADMIN', true); wouldn't work? I'm not getting any errors at all, but a http request to example.com/wp-admin isn't redirecting to https
0
votes
0answers
59 views

What is the best way to upload a temporary & sensitive file and then delete it when done

What is the best way to upload a temporary & sensitive file and then delete it when done. I'm writing a plugin (eventually for multisite) that allows users with a certain role to upload a .csv ...
0
votes
0answers
539 views

Why WordPress not logout after I have close my browser?

The default login cookie has expiry time as "session", so suppose when I close my browser, I need to login again when I visit wp-admin. But I've found that serveral time I've closed my browser (kill ...
0
votes
1answer
1k views

How do I properly update the Wordpress database password?

A site that I manage was recently compromised and I am going through the steps to harden and re-secure the site. I would like to change the MySql database password and want to make sure I do not take ...
0
votes
1answer
63 views

Why isn't the login page rate limited by default?

Brute force attacks seem to the be most common vulnerability on WP installs and rate limiting ought to be relatively easy to bake into WP itself as part of the official, default software (without the ...
0
votes
1answer
33 views

How to display post meta data in secure manner

I have have a custom post meta field where I can add a embedding code (a video for example, an iframe). Now I want to retrieve the code from the post meta and display it securely. I can display it ...
1
vote
1answer
298 views

Evaluations of two wordpress security plans against php code injection attack

Senario: I've posted one wordpress php code injection senario on SO before, url:http://stackoverflow.com/questions/26826082/what-is-the-highly-efficient-way-to-remove-a-block-of-string-pattern-in-php-...
1
vote
1answer
238 views

Moving away from MD5: Where to declare the custom global $wp_hasher?

I want to move away from using MD5 for hashing passwords in the database. The plan is to declare a custom global $wp_hasher as hinted at in the docs for wp hash password(): Unless the global $...
0
votes
1answer
77 views

Custom RPC end-point security best pratice?

I trying to figure out how a custom entry point can be secured without loading the entire WP-stack. The built-in AJAX entry point is pretty slow and actually unusable on sites with lots of plugins. So ...
0
votes
2answers
352 views

How to create a private login page for admin.?

Can I create a login page, which could be entered all registered visitors, but were not allowed entrance to the administrator, even if he has entered the correct username and password? For admin I ...
0
votes
1answer
138 views

How can I save a password securely as a settings field

I have a plugin that requires the user to enter a password (to access an external site) into a form field on the plugin settings page. Right now this is just saved as plain text, but I need to make it ...
0
votes
1answer
252 views

wp_create_nonce function doesn't work inside a plugin?

I am writing a WordPress plugin which is creating a form in one of its functions. It looks like this (very simplyfied): class MyPlugin { public function createForm() { $nonce = ...
1
vote
1answer
103 views

Is it safe to allow non-admin users access to media uploader

Hi fellow Wordpress users :) I wanted to ask is it safe to allow non-admin users access to WordPress media uploader. Can they inject a virus while uploading media? How is WP system fighting against ...
0
votes
1answer
448 views

Should I use wp_nonce_field on my contact form?

I have created a self submitting contact form template and it works nicely, however when I was browsing the web in search for tutorials (for creating contact forms) I have noticed that some people ...
0
votes
2answers
2k views

How to secure or disable the RSS feeds?

I'm trying to set up WordPress as a CMS. As such, I want to disable the feeds since it's mostly a secured site. I've gone through all the Settings pages but found no setting to tweak or disable the ...
0
votes
1answer
156 views

Any way to disable /wp-login.php redirecting to the site folder?

We have our WP installs in folders on the server. We created folders called wp-admin and login to thwart hackers. However, incredulously, when you type in /wp-login.php it REDIRECTS to our mysite.com/...
2
votes
5answers
4k views

Upgrading Wordpress 4.0 asks for FTP password

I was able to upgrade Wordpress 4.0 on my local machine, and I also just updated some plugins on the production machine, but when I try to update Wordpress 4.0 on the production machine, it is asking ...
4
votes
1answer
1k views

Securing wp-admin folder - Purpose? Importance?

I am trying to understand how to secure a WordPress site. One security task I do not understand is...How important is it to protect the "wp-admin folder"? For example, I would consider limit login ...
1
vote
1answer
678 views

is_email() VS sanitize_email()

If I'm allowing a user to enter an email address to be saved into the database, should I use is_email() or sanitize_email()? Ex. update_user_meta( $user_id, $social_site, sanitize_email( $_POST[$...
3
votes
1answer
355 views

Security error WP 4.0 + WP phpBB Bridge [closed]

so today I updated to 4.0 (glad I had backup). Everything was working fine until I tried to publish a post. There I got Are you sure you want to do this. Also had Cheatin' Uh under appearance->...
-1
votes
2answers
1k views

Change Login URL Without Plugin

I want to change the login url of my Wordpress install away from /wp-admin.php I am aiming to do so and am looking at changing the .htaccess file to add in: RewriteRule ^login$ http://yourdomain.com/...
10
votes
3answers
5k views

What could a hacker do with my wp-config.php

I am trying to secure my wordpress blog. I read some posts on the web that I should change my table_prefix and hide my wp-config.php. However, I do not get it? What could an attacker do with my wp-...
0
votes
1answer
36 views

Should I change the default file and folder permissions?

After reading the Hardening WordPress article I realise a good permission scheme is essential to the security of my WordPress installation. The article suggests a possible permissions scheme but my ...
1
vote
0answers
206 views

How do I get around “Sorry, this file type is not permitted for security reasons”?

I was wondering how I could allow .tiff files to be uploaded in my wordpress site. I get the message "Sorry this file type is not permitted for security reasons". This question has been asked in ...
8
votes
2answers
2k views

Why are passwords exportable as plain text in WordPress?

On my WordPress 3.9.2 installation can I extract the users plain text passwords by going to Users, select all users, and choosing Bulk Actions Export. When I look in the mySQL database with ...
5
votes
6answers
305 views

Share same domain for wp-admin but for different website

I have site like http://www.foo.com http://www.bar.com And I've a wildcard SSL cert *.example.com, instead of buying two SSL certs for the above two domains, can I re-use my existing wildcard SSL ...
0
votes
3answers
48 views

How can I restrict access to specific parts of a page, not just the page itself?

I looked at WP's site and didn't see a role I could use. I can create my own, but how do I limit the content on the page itself? Some private and some public information can be on the same page. I ...
0
votes
2answers
974 views

Is it necessary to use esc_url with template tags such as get_permalink?

I have been reading that sanitizing data output is important in theme / plugin development for wordpress. Is it necessary to use functions such as esc_url with template tags like get_permalink, or ...
4
votes
1answer
113 views

Why do I get accidental comments without (the required) email address?

Somebody translated one of my tutorials here (with my permission). All fine but I got comments that seem unintended on two of my tutorials that the translation links to. Now the weird thing is that ...
0
votes
2answers
113 views

Is there a way to remove the option to modify the Slug in post.php

I am trying to remove the option to edit the Permalink. I know how to hide it with CSS and I have. But a hacker could simply just go to Inspect Element and change display: none; to display: block; ...
1
vote
0answers
93 views

How to allow internal links using wp_kses filtration

I'm working on front end submission and of course I want to secure data by filtering before inserting to database. The form contains repeatable fields group data which I want filter by wp_kses ...
1
vote
2answers
46 views

Would it be dangerous to send all the wp_options to javascript file?

I've noticed that wordpress allows me to send the wordpress options to javascript via wp_localize_script: wp_localize_script( $this->plugin_slug . '-plugin-script', 'wp_options', ...
2
votes
1answer
214 views

Security around save_post hook

There are a lot of examples using the save_post hook, that include adding and verifying a nonce, and checking the user has appropriate permissions before you continue. Is this necessary? When ...
4
votes
1answer
382 views

Run WordPress frontend and backend in different domains

I want to run my WP frontend as www.example.com and my backend (i.e. wp-admin) as user1.example.org, is it possible? The reason is I want to host lot of sites in a single server which has only 1 IP ...
2
votes
0answers
492 views

How to escape custom css?

I'm creating a WordPress theme in which I've allowed users to add some custom css from the Theme Options. This css code then directly gets echoed out in the head section of the page, with the ...
4
votes
2answers
2k views

wp.getUsersBlogs XMLRPC Brute Force Attack/Vulnerability

After the holiday weekend, one of the larger sites I manage had a brute force attack on it. The attacker was attempting to use the wp.getUsersBlogs function and a list of popular usernames and ...
2
votes
1answer
580 views

WordPress salts set in config and database

I have come across the following code in a new clients existing website in wp-config.php define('AUTH_KEY', 'put your unique phrase here'); define('SECURE_AUTH_KEY', 'put your unique phrase ...