The security tag has no wiki summary.
0
votes
2answers
41 views
What can I do when an outside party hacks into my weblog and changes my display name?
Last night I wrote a mildly controversial blog post about religion on my weblog, and this morning I woke up to find that my display name had been changed to the name of a fanatic religious leader. The ...
0
votes
3answers
55 views
Why my plugins are updating automatically?
I have a wordpress site with a few plugins. I had to make some custom changes on a plugin (not a best practice), and of course I don't want to update that plugin.
But for some reason all my plugins ...
0
votes
1answer
38 views
Why does WordPress change a file's permissions?
If I set the permissions to the CSS file in my theme to 444 and then attempt to edit it in the Appearance Editor, WordPress is not prevented from editing the file and in fact change the permissions to ...
0
votes
1answer
41 views
Wordpress built in custom fields don't validate or sanitize? Is there a way to fix this?
I'm surprised to see that when creating post meta using the default/built in custom fields on the post editor page it allows you to enter tags like:
<a>,<script>,etc.
I then ...
0
votes
1answer
55 views
Wordfence detects change in wp-admin/includes/upgrade.php
I moved my site from hosting provider A and domain name B to hosting provider X and domain name Y. I had Wordfence in the old site. I just installed it in the new site and ran a scan. Wordfence found ...
0
votes
1answer
74 views
Changing admin user id for database
Is it correct or ok to change default admin user id from 1 to any other number as done by better-wp-security plugin for wordpress for better security? what is best way for admin security.
Thanks
0
votes
2answers
141 views
Too many login attempts
Since a week or two I keep receiving the following automatic email message sent from my WordPress website, and I'd like to know if it indicates any security hole and if there's anything I can do to ...
0
votes
1answer
54 views
Auto log in hook is requiring a page refresh
I have a simple auto log in hook that looks like the following:
function auto_login() {
if (!is_user_logged_in()) {
//Removed some code for brevity.
$user = ...
0
votes
1answer
84 views
security issue in wordpress?
I have installed wordpress in www.mysite.com/user and now suppose if someone is familiare with wordpress he/she can easily access my stuffs through www.mysite.com/user/members
...
0
votes
1answer
248 views
wp_insert_post disable HTML filter
I have input value "<iframe>....</iframe>" (param 'post_content'). When i execute wp_insert_post, function cut off my tag.
How to disable HTML filter in wp_insert_post ?
0
votes
1answer
52 views
Wordpress custom admin functions security
i have a case in my admin panel where i need to call my own function that resides in my own php file, with a GET request. This function is actually removing entries from the database.
So, i would ...
0
votes
1answer
240 views
Do I need to sanitize Wordpress search query?
I submit search data to custom page searchi.php
<?php
//
$search_variables = $_GET['s']. '+' .$_GET['cat'];
//This sends http post to url without curl
header("Status: 301 Moved ...
0
votes
1answer
2k views
Websites defaced by uploading script using theme editor
We've had several Wordpress sites defaced, all of them having the same pattern (at least the raw access log says so). From the logs it appears they directly login to Wordpress then go to theme editor ...
0
votes
1answer
46 views
Is there any pre-existing plugin to track and block IPs with suspicious activity on my site?
The image below shows a recent (failed) attempt to crack my Wordpress install. It's easy for me to look at that and see what they were doing, but is there a plugin that exists that monitors this data ...
0
votes
1answer
85 views
Security updates to 3.3.2
I know all security updates are important but given that how important on a scale from 1 to 10 is it to upgrade from 3.1.3 to 3.3.2.
I have some sites that need to be upgraded but the host has me ...
0
votes
2answers
95 views
Side effects of disallowing *.php requests in production environment?
For security in the production environment a company I work with has removed the whole wp-admin/ directory, and is about to disallow all *.php file calls with a 403 Forbidden HTTP error.
Are there ...
0
votes
2answers
133 views
How to prevent plugins from sniffing/stealing other plugins' options?
Many plugins require configuration with sensitive data such as API keys, passwords, etc. When implementing these plugins, this sensitive data is stored using functions such as update_option() and ...
0
votes
1answer
207 views
Does using a custom query_var create a security hole?
Say I put the following code in functions.php
function add_my_query_vars($qvars) {
$qvars[] = "new_var";
return $qvars;
}
add_filter('query_vars', 'add_my_query_vars');
If somebody requests ...
0
votes
2answers
207 views
On new server, site got hacked, permissions a bit strange? Please help
I moved to a new server recently, a week later a site got hacked, all they did was change the index.php file of the current enabled theme, no big deal. I did have a few security precautions in place, ...
0
votes
2answers
240 views
How can I password protect a WordPress site without requiring users to log in?
I don't want people to have to log in, I just want to prompt them with a question and if they can answer it, they can access the site. All the solutions and plugins that I've found seem to be overkill ...
0
votes
2answers
877 views
Embed Wordpress Admin in an iframe
I am trying to embed the admin "new post" wordpress page into an iframe:
`<iframe height="500px" frameborder="0" width="740px" src="my_wordpress_domain/wp-admin/post-new.php"/>`
For some ...
0
votes
3answers
341 views
Spam injected in w3 total cache page cache
I'm trying to fix a site which has been injected with external spam. After inspection I found out that the external content (so far just html advertising different kinds of drugs, no scripts) was in ...
0
votes
1answer
86 views
Privilege escalation bugs in 2.9?
Are there any known privilege escalation bugs in WP 2.9 to be careful for?
0
votes
1answer
41 views
How do I allow certain users to make a certain type of post?
Here's a brief summary of how my site is setup:
I have a relatively simple Intranet site. Right now I am utilizing posts as a means to provide news to users. I am also using pages. I only want ...
0
votes
3answers
101 views
How to stop direct HTTP POST to a PHP script?
I have a form on my site, created using Contact Form 7 with Captcha. Contents of the form when POSTed are being sent to a PHP script, the "action" attribute of the form is set to ...
0
votes
1answer
173 views
Wordpress Security - How to block alternative Wordpress access
I own a self-hosted Wordpress 3.5 blog. I'm working on its security and I'm trying to prevent non-writers from accessing anything admin-ish they shouldn't.
Recently I tried Better Wordpress Security, ...
0
votes
1answer
45 views
Is this plugin safe to run?
This is an extract of code from a wordpress plugin. Is it safe to run despite the variables not being filtered? Also does the wpdb class filter to prevent any injection?
list($email_id, $user_id, ...
0
votes
2answers
192 views
Any known bugs that could cause disappearance of the wp_users table?
I administer a number of WordPress-powered web sites.
One of these sites is new, and has been running untouched since it was set up a month ago. Today, I tried to log in, but was unable to do so - ...
0
votes
1answer
258 views
Something is unescaping all html entities before output to browser [closed]
I have a nasty problem. In my wordpress site something unescapes all html entities before sending data to the browser. It happens for all of the following cases:
echo ""XSS"
print_r( ...
0
votes
1answer
67 views
Secure way to use name_save_pre?
I created a custom post where I need to change the post name regarding to the custom field and taxonomy values. This is how I did it:
add_filter('name_save_pre', 'save_name');
function ...
0
votes
1answer
1k views
Password protect a specific category page/post
I have searched high and low for this but nothing is sticking out at me. I am looking to password protect posts and/or pages based on a certain category.
The reason for this is that I am creating a ...
0
votes
1answer
76 views
Why do people use “admin” username by default? [closed]
WordPress users use "admin" username by default to login to admin panel because WordPress suggest this username at the end off install.
But "admin" username is the most common username to brute-force ...
0
votes
1answer
128 views
Spam in Wordpress root folder
Two questions in one. A php file was recently introduced in the root directory of my Wordpress installation (a domain installation). It didn't disturb my website but was apparently using the domain ...
0
votes
1answer
92 views
Contact Form Security
Building my own contact form in Wordpress. Any there any security steps I need to consider other than the typical email etc validation and maybe a captcha. I am not sending any data to the database.
0
votes
2answers
170 views
Is Wordpress secure enough for a multi-user article directory?
One of my friends is going to launch a small article directory (ex: http://ezinearticles.com/) using WP. The site will be hosted on a shared hosting in the beginning and will be moved to a dedicated ...
0
votes
2answers
106 views
Has anyone developed a anti-spam plugin to simply allow users to BLOCK whatever they wish to, but one that will also go easy on IP addresses?
I'm new here xD
I'm thinking of developing a plugin to allow users to block ANY spammy traces (IPs, Email addresses, Website URLs, phone numbers, phrases, etc etc) from those evil spammers.
BUT, ...
0
votes
2answers
36 views
I need to find which is the file that checks the DB for correct login (username, password)
I let users to register in my page, however I want to improve the password security that is saved in the DB.
For this I need to find out which is the file that makes the query
where pass=pass and ...
0
votes
1answer
323 views
Is the Block Bad Queries Plugin Still Relevant?
The Block Bad Queries Plugin hasn't been updated recently. Is WordPress still subject to these types of malicious attacks or has it been hardened sufficiently to make the plugin obsolete? Is there an ...
0
votes
1answer
112 views
Using password protection to load different page elements?
I have a page that is password protected, and I wish to removed some parts of the theme, and add others. Can I do that? Is there a check I can do in the theme files to see if a user has entered the ...
0
votes
1answer
111 views
User generated content and security
I'm gonna create a new site. I want to make the site as user generate able content site.
Basically this is my site's function. Users signup in my wordpress site, Submit content from wp-admin panel, ...
0
votes
2answers
988 views
Uploading .webm format on Wordpress results in security guidline breach and fail
I cannot upload the .webm video format on Wordpress.
This is after adding:
AddType video/webm .webm
into both:
my .htaccess file (on the root folder of the wordpress installation)
the mime type ...
0
votes
1answer
199 views
Is there a way to hide WordPress behind a web visible directory?
Is there a way to hide WordPress behind a web visible directory for extra security using a symlink?
0
votes
1answer
90 views
Allowing Users to Register Themselves and Post : Does WordPerss Handle these Problems?
If one allows visitors of a WordPress blog to register themselves and post to the blog without moderation(i.e. without submit for review), malicious visitors may try to
1)Post a large number of posts ...
0
votes
3answers
358 views
WP Insert Post If user refreshes override new post
WP Insert Post is a very simple and easy to use function. Currently I have it set up on event triggered by whether a user is logged in during a booking to ratify their booking in its own page. My ...
0
votes
1answer
145 views
security concerns if using html data-* attribute for l10n?
I need to pass a localized multidimensional javascript object to a page. The object is constructed using php and represents some wp-theme settings. I cant find a way to utilize wp_localize_script for ...
0
votes
1answer
160 views
Secure Server after configuration
Recently I purchased a VPS from intovps.com, And first time I configured a fully unmanaged VPS through ssh comands.
My website is working into it, properly.
Now I just want to know how to secure it?
...
0
votes
1answer
289 views
404 errors when updating options in admin dashboard
Whenever I try to update my Permalink settings or use the Theme Editor to modify some file, I am redirected to a 404 page. This also happens when I update the All-In-One SEO Pack plugin's settings. ...
0
votes
0answers
18 views
Core files changed - site hacked?
Got a WordFence alert last night for one of our WordPress sites, saying that some WordPress core files had been changed:
WordPress core file modified: wp-content/plugins/akismet/admin.php
WordPress ...
0
votes
1answer
35 views
How to protect wp-admin through .htaccess?
I'd like to protect the /wp-admin/ directory at the server level. This means two logins. One through the server and another through WordPress.
I believe this can be handled through .htaccess. Does ...
0
votes
0answers
65 views
Why does My WordPress site keep getting hacked? [closed]
Why does My WordPress site keep getting hacked?
I have made all of the changes I can according to WordPress's hardening documentation.
Each time, the administrative password is reset. How can that ...
