Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

1
vote
2answers
19 views

How to hide easy access to my website temporarily?

I am developing a new website and I do not want others, except for my colleagues, to access it easily. I don't want it to be password protected because my colleagues are testing it intensively. Is ...
1
vote
1answer
31 views

Is it safe to hand over the admin rights?

I have a shared web hosting account where I have several different websites running on WordPress. I want to hand over the admin rights for one of my WordPress installs to someone and I am wondering ...
1
vote
0answers
102 views

Can I Remove xmlrpc.php completely?

My site is getting a lot of malicious traffic to domain.com/xmlrpc.php, to the point that the server is not being able to handle it. I tried to disable it via the wp-config.php, by adding this line: ...
1
vote
1answer
91 views

Is there a way to create a URL (new WP page) that can only be accessed from a specific source?

To explain further, here's what I"m looking to do: Create a WP page Use the URL and implement it in a reader service that is hosted (not downloadable) that in order to read (& access the URL) ...
1
vote
1answer
186 views

Using esc_html with HTML purifier and CSSTidy: Overkill?

Currently my text area input (which accepts custom CSS input from a user) in the Wordpress theme options panel are sanitized by esc_html function in Wordpress ...
1
vote
0answers
102 views

How can I secure a WordPress blog using OpenID from a single provider?

We're about to launch an internal blog for the company I work at. Much of the blog will be available to the public, but certain posts will be for employees only. Our intranet/extranet has an OpenID ...
1
vote
0answers
104 views

Disallow file edit not preventing plugin install

I have a little demo site (admin details are listed publicly), and I've configured the wp-config to disallow file edits, so in theory no one can install a theme / plugin. ...
1
vote
1answer
1k views

Disable directory browsing of uploads folder

I'm using Wordpress as a CMS for a simple website. I want to prevent users from being able to browse the directories such as the wp-content/uploads folder or any directories of my theme. My host does ...
1
vote
0answers
358 views

Security - Ajax and Nonce use [closed]

I'm developing a site which posts a number of ajax calls from jquery to PHP and returns data from PhP to jquery. Everything is working, but i'd to know if my approach to handling the calls is ok, in ...
1
vote
1answer
96 views

using rewrites to secure login page

I'm trying to be sneaky with iis to secure a wordpress login page (not my choice to run a windows server, but that's the reality of things). It's worked so far, only the login page itself loads itself ...
1
vote
0answers
67 views

Are un-sanitized theme options more vulnerable to malicious scripts than the theme editor?

I'd like to put text areas in a theme options area to allow users to easily add analytics code, scripts, and css. Is it silly to worry about malicious code being inserted via un-sanitized theme ...
1
vote
0answers
57 views

Network Admin URL is shown to anyone before accessing a blog

I have a multisite setup and I noticed today that my security was not working properly. Each of my blogs has its own url : http://www.example1.com http://www.example2.com … My "main blog" is not ...
1
vote
1answer
29 views

correct tags for validating input types

I have following types of theme options inputs, which I need to validate. $numbers = "#1234"; $email = "abc@example.com"; $simeple_text = "How's going?"; $code = "<script ...
1
vote
1answer
485 views

Is disabling test_form in wp_handle_upload a security concern?

I'm writing a plugin that modifies the default behavior when uploading a file for a post or to the media library. I'm setting $overrides in wp_handle_upload() with a custom $unique_filename_callback. ...
1
vote
2answers
393 views

Is WordPress MultiSite secure & how much can it scale? [closed]

Great info on How to Scale Wordpress and more info on Wordpress Web Hosting. Still, I am left with questions. Creating a project that for the sake of argument we will call a blog network. A user ...
0
votes
5answers
241 views

Prevent Brute Force Attack

I already used Limit Login Attempts wordpress plugin. Are there other ways to prevent brute force attacks? I'm worried because I saw a lot of locked out.
0
votes
1answer
143 views

Admin can enter JavaScript - potential security risk?

WP 3.5/TwentyTwelve/Clean install. I try this when login as admin and editor. I try add reply for first post "Hello World": <script>alert('XSS')</script><script><</script> ...
0
votes
1answer
458 views

What is the best method to close off the backend?

The goal: Completely remove the ability to access the WordPress backend on the production domain. Ex. return a 404 for http://example.com/wp-admin Purpose: I don't want any possibility of WordPress' ...
0
votes
2answers
75 views

Which Versions of WordPress Ship with the Patched TimThumb?

Do you recall when the TimThumb exploit occurred? Which versions of WordPress bundled with this exploit? I need to inform a client that they should be upgrading to at least the version of WP when this ...
0
votes
1answer
31 views

Safe to say WordPress security releases don't have database upgrades

Since all security releases are based on last released codebase + security patch, I think its safe to say WordPress security releases don't have database upgrades, but I figured I will ask my fellow ...
0
votes
4answers
804 views

No option “I would like my site to be private, visible only to users I choose” in Privacy Settings

I am running WordPress 3.3.2 self-hosted. I used to see the option "I would like my site to be private, visible only to users I choose" under Privacy Settings but I no longer see this option. Instead, ...
0
votes
1answer
136 views

Secure Wordpress: Change admin

I'm sorry if this is an extremely stupid question. I've been looking for ways how to secure my WP and a lot of websites suggest to create a new admin user account and delete the old one. Now, if I ...
0
votes
2answers
31 views

Changing the default header name

Is it possible to change the default header.php file to something else for security reasons? It seems header.php is target for malicious attacks. I know all that, we have different named headers, I ...
0
votes
3answers
1k views

How to control who can view certain pages in BuddyPress?

I would like to control who can see a page in BuddyPress and restrict anyone else from accessing it. Something along the lines of the following pseudocode: <?php if ( loggedin_user_ids==1,4,5,7 ) ...
0
votes
2answers
2k views

How to secure WordPress XMLRPC?

XMLRPC is great for remote publishing to WordPress, but there has been many security issues attributed to it. How do it make it more secure? More specifically, only user from the intranet will be ...
0
votes
1answer
511 views

How much should I worry about these messages?

I received about 50 messages today with the similar message: WordPress Firewall has detected and blocked a potential attack! Web Page: ...
0
votes
2answers
591 views

What do spammers gain by signing up as a user?

The majority of new user signups I receive on my Wordpress blog look dodgy, with @someblog.com, @somearticle.com, or @gmail.com addresses. What do they gain by signing up as a new user?
0
votes
1answer
415 views

Does WP show me if I'm logged in from multiple locations?

Does word press show me if I'm logged in in another location? Related: Limiting sessions to one IP at a time
0
votes
2answers
63 views

Is that a malicious code?

Recently I have downloaded a wordpress theme . I use Theme Authenticity Checker (TAC) (http://wordpress.org/plugins/tac/) plugin to find any malicious data . According to it's report the theme ...
0
votes
2answers
97 views

How can I tell who changed the password?

We recently had an employee leave our company. When they left, I changed all their passwords and removed their email access etc. I also changed the password on our Wordpress site for the Admin ...
0
votes
2answers
192 views

Wordfence detects change in wp-admin/includes/upgrade.php

I moved my site from hosting provider A and domain name B to hosting provider X and domain name Y. I had Wordfence in the old site. I just installed it in the new site and ran a scan. Wordfence found ...
0
votes
2answers
38 views

Separate Out Real Users

If I look at /wp-admin/users.php I see all the users, but some have given a bogus email and never used their password. Is there some way to see who has used their password at least once? If not, ...
0
votes
1answer
68 views

Security to delete post by Admin

My code is so simple like when admin delete a post by Wordpress fucntion (PHP) and do action with jQuery <?php include('../../../../../../wp-config.php'); if(current_user_can('edit_posts')){ $id = ...
0
votes
1answer
410 views

Basic password protection without using users and roles

I'm using WooCommerce, and want to be able to password protect products (or preferably whole categories if possible), but without using the Users & Roles functionality build into WP(because I need ...
0
votes
2answers
1k views

Is Timthumb still broken? What security measures should be taken?

A client has requested we use a theme, and that theme has a Timthumb dependency. I know that there has been some serious vulnerabilities in the past, but what is the current state of that plugin? ...
0
votes
2answers
3k views

Protecting HTML5 video

I shall explain my situation as best I can so you can see where i'm coming from. I'm working on a wordpress site for a sports team, there are loads of teams. We want to put coaching sessions on our ...
0
votes
1answer
215 views

Renaming wp-admin without hard-coding it. Is it really possible?

I would like to rename my wp-admin folder due to some security concerns. Is it really possible? The less it looks/is built like default WP, the harder it is to attack known vulnerabilities. Being ...
0
votes
2answers
42 views

What can I do when an outside party hacks into my weblog and changes my display name?

Last night I wrote a mildly controversial blog post about religion on my weblog, and this morning I woke up to find that my display name had been changed to the name of a fanatic religious leader. The ...
0
votes
1answer
15 views

How to give the same error message when the wrong password or wrong username is used?

For security reasons, my WordPress instance should give the same error message when an incorrect password or wrong username is used. How can it be done?
0
votes
1answer
21 views

Specific way to allow Wordpress users to view their current password? And edit it?

I know the built in user manager doesn't allow a user to see what her current pass is, just recover / reset it via email or write in a new one in the admin but I am looking for a plugin or other ...
0
votes
3answers
36 views

Do we need to escape data that we receive from theme options?

I'm creating a Wordpress theme that I'm hoping to sell on Themeforest. Now I know much about escaping user inputted data using functions like esc_html, esc_url and so on and I use them in the comments ...
0
votes
1answer
43 views

Why do Metabox use Nonces?

Why is it advised for admin panel metaboxes to use nonces? Every example I see of creation and saving metabox data there are nonces involved but aren't nonces a bit unnecessary in this case?
0
votes
1answer
71 views

Can a WordPress administrator see other users' passwords?

Of course, an administrator in WordPress can reset other users' passwords (including that of other administrators). However, can a WordPress administrator see other users' passwords? Phrased ...
0
votes
1answer
48 views

Security and Must Use Plugins

From the codex article on Must Use Plugins: Can be enabled simply by uploading file to the mu-plugins directory, without having to log-in This feels like a potential security problem to me. ...
0
votes
3answers
84 views

Why my plugins are updating automatically?

I have a wordpress site with a few plugins. I had to make some custom changes on a plugin (not a best practice), and of course I don't want to update that plugin. But for some reason all my plugins ...
0
votes
1answer
60 views

Why does WordPress change a file's permissions?

If I set the permissions to the CSS file in my theme to 444 and then attempt to edit it in the Appearance Editor, WordPress is not prevented from editing the file and in fact change the permissions to ...
0
votes
1answer
127 views

Wordpress built in custom fields don't validate or sanitize? Is there a way to fix this?

I'm surprised to see that when creating post meta using the default/built in custom fields on the post editor page it allows you to enter tags like: <a>,<script>,etc. I then ...
0
votes
1answer
525 views

Changing admin user id for database

Is it correct or ok to change default admin user id from 1 to any other number as done by better-wp-security plugin for wordpress for better security? what is best way for admin security. Thanks
0
votes
2answers
526 views

Too many login attempts

Since a week or two I keep receiving the following automatic email message sent from my WordPress website, and I'd like to know if it indicates any security hole and if there's anything I can do to ...
0
votes
1answer
113 views

Auto log in hook is requiring a page refresh

I have a simple auto log in hook that looks like the following: function auto_login() { if (!is_user_logged_in()) { //Removed some code for brevity. $user = ...