Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

2
votes
1answer
655 views

Is $wpdb->prepare escaping to much? How to use it properly?

Im pretty much confused by $wpdb->prepare. I want to use it to sanitize user input but it turned out that it destroys the query. I cannot imagine that this is how it's intended to work but I can't ...
2
votes
1answer
673 views

Securing my WordPress Files and Directories

I am new to WordPress and securely hosting it on Amazon EC2. My question is, how do I secure my WordPress files and directories properly? My file permissions are set to 644 and my directories are ...
2
votes
1answer
201 views

Protecting against malicious code in Wordpress plugin updates

One of the most popular Wordpress plugins listed on the Wordpress plugins database got malicious code injected into it recently (April 2013): http://blog.sucuri.net/2013/04/wordpress-plugin-social-...
2
votes
2answers
1k views

Renaming wp-content folder dynamically

Is it possible to rename the wp-content folder dynamically? I am building a custom framework to use on themes and it would be nice to set it up where it does everything on its own. I am using this ...
2
votes
1answer
467 views

Extend the list of MIME-types supported by the builtin uploader in 3.3

Goal I want to be able to extend the list of mime-types supported by the builtin uploader in wp 3.3.1 For example when I try to upload an .apk file to our class blog, I get a Sorry, this file type ...
2
votes
1answer
154 views

Where should my plugin POST to?

I'm creating a simple plugin to set a page as a homepage from the list pages (to appear next to edit, preview, trash actions etc), I was just wondering what that the most appropriate/secure place to ...
2
votes
1answer
170 views

How do I bypass Wordpress 404 handling?

How do I skip Wordpress altogether if there's a 404? I've tried adding an ErrorDocument to the .htaccess with no joy. The reason I'm asking is that we use a lot of custom fields and as such our site ...
2
votes
2answers
98 views

Which ways can be used to log in to Wordpress?

FYI: This has been also posted here since I'm fairly new to this website and didn't know that the Wordpress part existed. Sorry for the repost. I'm currently trying to tighten the security for a ...
2
votes
1answer
67 views

Is it safe to enqueue a font style without putting http or https?

I have seen a few WordPress sites and tutorials enqueuing fonts like this. Does this work with http and https sites? Is it safe to do this? I see these exact URL's in the source code when testing ...
2
votes
1answer
99 views

Whats the safest way to output custom JavaScript and Css code entered by the admin in the Theme Settings?

I'm creating a theme in which I've created options for the admin to enter custom Javascript and Css code in the "Theme Settings" page (created using Options API). Now I'm just not sure how to output ...
2
votes
1answer
33 views

Strange Search Queries in Apache Status

I am running a wordpress website with high traffic, my server load gets very high and while checking apache status i found flood of wordpress searches like this /?s=\"khabarnaak\"&id=39790 HTTP/1....
2
votes
1answer
304 views

Enforcing password complexity

We need to enforce password complexity in a wordpress site, we used this article: http://www.webtipblog.com/force-password-complexity-requirements-wordpress/ We created the following in functions....
2
votes
1answer
4k views

Why Better WP security plugin returns 418 I'm a Teapot “error”?

I am working on the Wordpress website and all of a sudden after deploying it on the server, I started seeing a problem where some of the pages on my website return 418 I'm a Teapot as Response status ...
2
votes
2answers
495 views

wordfence scan warning on W3 Total Cache [closed]

I use Wordfence plugin which scans server side plugins with original plugin files to see if anything was modified by hacker/cracker. Today I got a warning and it shows these modifications on /w3-total-...
2
votes
1answer
61 views

About WordPress site security

If I install WordPress on my server, does it mean that Akismet is installed automatically? If so - do I still need to create e-mail verification and captcha tools for improving site security (as I see ...
2
votes
1answer
55 views

What is the most secure way to set up the MySQL user in WPMU?

I am setting up Subdomain based MU on my domain.Everything is hosted by me running on one CentOS/Webmin VPS. Will I be better off setting the MySQL user's domain as localhost, 127.0.0.1 or with a ...
2
votes
1answer
471 views

How to expire all wordpress user passwords instantly?

So I own an article directory website and recently a lot of bots have signed up and started posting spam. (I approve posts prior to publication) I've added a captcha to the user registration page now ...
2
votes
1answer
455 views

Stop wordpress automatically escaping $_POST data

I have a custom front end form which creates a custom post type post and have just discovered WordPress automatically escapes $_POST data in the same way that Magic Quotes does. I have Magic Quotes ...
2
votes
1answer
147 views

Restricting access to content

I'm developing a functionality to let only customers and doctors have access to exam results. But i'm not so sure about the strenght of my code in securing view only to those authorised. I've gotten ...
2
votes
1answer
134 views

Changing Table Prefixes - once done, am I good to go going forward?

In the book Beginning WordPress 3 the author advises that changing the default WP table prefixes can provide some slight security advantage (protects from SQL injection scripts). I found several ...
2
votes
1answer
392 views

How to block a category from one user and enable the category for the rest of the users

I have a site in which all categories are open to anyone, except for 2 categories that are password protected: Students, and Teachers. They are open only to specific users types, as follows: The ...
2
votes
3answers
8k views

How to change “wp-admin” to something else without search-replacing the core?

for example: foobar.com/wp/edit instead of foobar.com/wp/wp-admin How would I do that? I've tried using this in htaccess but it won't work: ##### ABOVE THIS POINT IS ALREADY INSERTED BY WORD PRESS #...
2
votes
1answer
218 views

Is it possible to post with Word 2007 via XML-RPC and limit categories by user?

I'm working on a project for a school district I work at where we want to use Word Press to have employees from all of the buildings post announcements and press releases via Word 2007. We will then ...
2
votes
0answers
13 views

WordPress URL/Folder ReWrite using Htaccess

I am trying to mask certain folder in a WordPress installation using the Htaccess file. I am aware that there are plugins available to do exactly what I want but, I do not want to add even more ...
2
votes
0answers
37 views

How to implement secure frontend image upload? [closed]

I would like to implement an public image upload in my Wordpress Theme with ajax. What's the secure way to do this? I have read many about security problems when allow users to upload files to the ...
2
votes
0answers
62 views

Does Wordpress contain “default” anti-SQL injection code that responds with a 404 error?

I've been through the “seven layers of the candy cane forest” on this one… :) Our plugin receives data via a POST request. On a particular site that has our plugin installed, we observed odd ...
2
votes
2answers
125 views

site get login attempts after htaccess ip restriction

I'm using a security plugin that keep sending me emails: "A lockdown event has occurred due to too many failed login attempts or invalid username: Username: Admin IP Address: 195.154.243.31 IP Range:...
2
votes
0answers
27 views

hSite has no css on mobile [closed]

Our WP site got hacked and we've been working with our hosting to clean all malware etc. However, now the site appears on desktop fine, but on mobile it looks as though all the css is stripped. Here'...
2
votes
1answer
321 views

How does Cross Site Scripting (XSS) work exactly? [closed]

On WordCamp Europe I attended the talk by Brad Williams on Writing Secure WordPress Code and I would like to make sure that I implement these tips in my own code. In his presentation he gives the ...
2
votes
2answers
81 views

How to limit WordPress pages during updates?

I will be doing upgrades to the design and content of my Wordpress site. During this time I only want the homepage to be available. Is there a good way to lock this down (through a plug-in, etc.). I'...
2
votes
1answer
203 views

Which of WordPress's .php files need to be directly accessible via HTTP?

I'm trying to tighten up security on my WordPress installation, and one of the things that seems like it might be a good idea is preventing all of the internal-use .php files from being accessed ...
1
vote
1answer
232 views

Should we use plugins that aren't available from the official WordPress site?

I'm not sure if my question is appropriate here, apologies in advance but I am confused and need some helpful thoughts! We were using this plugin for our site , which has recently been removed from ...
1
vote
4answers
6k views

How to remove “Connection Information” requirement on localhost install of WP on MACOSX

I've just installed XAMPP on Mac OSX and when trying to install a theme or plugin in WP admin, I'm getting this screen. I've never gotten this on my shared hosting account. how to get rid of it on ...
1
vote
2answers
278 views

Is it good security advice to install wordpress in subdirectory but link to root?

Is it good to install wordpress in a subdirectory (with a random name), but set "Homepage" address to domain root? (based on Giving WordPress Its Own Directory) Since the wp-content is in the ...
1
vote
1answer
2k views

What is the best method to close off the backend?

The goal: Completely remove the ability to access the WordPress backend on the production domain. Ex. return a 404 for http://example.com/wp-admin Purpose: I don't want any possibility of WordPress' ...
1
vote
4answers
2k views

No option “I would like my site to be private, visible only to users I choose” in Privacy Settings

I am running WordPress 3.3.2 self-hosted. I used to see the option "I would like my site to be private, visible only to users I choose" under Privacy Settings but I no longer see this option. Instead, ...
1
vote
3answers
2k views

Why do I need to check if wp_nonce_field() exists before using it

i dont really understand why the check if the nonce function exists before running it ... if ( function_exists('wp_nonce_field') ) wp_nonce_field('gmp_nonce_check'); i understand its for ...
1
vote
3answers
1k views

Best way to eliminate xmlrpc.php?

What is a best way to eliminate xmlrpc.php file from WordPress when you don't need it?
1
vote
2answers
5k views

Password protect a specific category page/post

I have searched high and low for this but nothing is sticking out at me. I am looking to password protect posts and/or pages based on a certain category. The reason for this is that I am creating a "...
1
vote
2answers
882 views

wp_nonce_field displaying twice

I have wp_nonce_field in my code but it's creating two instances to the html code for some reason, one where I'd expect it and another at the start of the entry. Is this correct or am I doing ...
1
vote
1answer
93 views

Why was my blog post inserted lot's of ad links by others?

I found that my blog posts are inserted lot's of ad links, I'm using WordPress 2.9.2, is there a known security vulnerability in it? A screenshot : I post some codes on my blog, the ad links are ...
1
vote
2answers
130 views

Weird problems after recovery from security breach

The shared server that I used for hosting my WordPress website was hacked recently, and many of the index.php files, plugin files and uploads were deleted, with my MySQL databases untouched. But after ...
1
vote
2answers
44 views

Is default functions like update_post_meta safe to use user inputs?

Is default functions like update_post_meta() safe to use user inputs? e.g. update_post_meta(76, 'my_key', $_GET['value']) Or should I use $_GET['value'] = sanitize_text_field($_GET['value']); ...
1
vote
2answers
143 views

How to check plugins for malicious code?

Our new hosting company ran a security check on our installation and I was very surprised to hear that a premium plugin we had purchased (Easy Media Gallery Pro) contained malicious code. (It may ...
1
vote
2answers
77 views

Disabling outbound connectivity on web servers [closed]

Is it a good idea to harden your web server by disabling outbound connectivity on them? I am using RHEL 7 for a WordPress Multisite installation. After disabling outbound connectivity, the dashboard ...
1
vote
1answer
109 views

Hack-Proof OR Security in Wordpress — is it real?

For many years I've been using WordPress as a platform for websites, it is convenient to me as a developer and for customers. But recent months, several sites of my clients were hacked and I'm ...
1
vote
2answers
190 views

Moving wordpress out of the public directory

Is there a way to move wordpress out of the public html directory? The PHP files responsible for generating html output should be hosted but the php files responsible for database connections and ...
1
vote
1answer
70 views

Security checking in meta_box save is reluctant?

For example, in this tutorial, the code suggested when saving meta box data is /* Verify the nonce before proceeding. */ if ( !isset( $_POST['smashing_post_class_nonce'] ) || !wp_verify_nonce( $_POST[...
1
vote
1answer
687 views

Moving wp-config.php up 2 levels

Is it possible to change a setting so that wp-config.php could be moved up two directory levels (instead of the default 1 level)? This would allow the core WP files to be moved from public_html to a ...
1
vote
1answer
6k views

Websites defaced by uploading script using theme editor

We've had several Wordpress sites defaced, all of them having the same pattern (at least the raw access log says so). From the logs it appears they directly login to Wordpress then go to theme editor >...