Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

1
vote
1answer
510 views

Moving wp-config.php up 2 levels

Is it possible to change a setting so that wp-config.php could be moved up two directory levels (instead of the default 1 level)? This would allow the core WP files to be moved from public_html to a ...
0
votes
1answer
139 views

Data Validation, dynamically generated fields (select for example)

Working to secure my plugin, I'm not sure what (if anything) to do about output such as dynamically generated select fields. For example, I have a country code select generated on the backend via PHP ...
0
votes
1answer
138 views

Is it safe use wp_editor in public contact form

I'm going to make a contact form for my site, and i want to use WYSIWYG editor (wp_editor) in my form message field. Here is my question, is that safe use wp_editor in public though disable media ...
5
votes
3answers
916 views

Moving wp-config.php: Can this be done after site launch?

For additional security, the suggestion is made to move the wp-config.php up one level. Can this be done after the site has already been launched? Any potential issues in doing this? Are there an ...
0
votes
1answer
104 views

force login loophole

I want to restrict access to my wordpress site to allow registered users only. I have tried the following plugins: Require-login Authenticator WP-lock All of them have the same problem: After ...
3
votes
1answer
608 views

When to use esc_url, esc_html, esc_attr, and friends?

Discovered esc_url today while customizing an _s theme. I understand what the function does (sanitizes the URL inside), but what I'm unsure of is the scope of its use. It makes sense to me that if ...
0
votes
3answers
212 views

How to stop direct HTTP POST to a PHP script?

I have a form on my site, created using Contact Form 7 with Captcha. Contents of the form when POSTed are being sent to a PHP script, the "action" attribute of the form is set to ...
-2
votes
2answers
934 views

Is there a secure way for the public to submit images, videos, and documents using WordPress?

I want the public to submit images, photo simulations, models, video, animation, illustrated narration, papers and other publications and multimedia. images - 30" x 42" 300 dpi . pdf format file size. ...
0
votes
2answers
913 views

Too many login attempts

Since a week or two I keep receiving the following automatic email message sent from my WordPress website, and I'd like to know if it indicates any security hole and if there's anything I can do to ...
1
vote
1answer
232 views

Using esc_html with HTML purifier and CSSTidy: Overkill?

Currently my text area input (which accepts custom CSS input from a user) in the Wordpress theme options panel are sanitized by esc_html function in Wordpress ...
0
votes
2answers
39 views

Separate Out Real Users

If I look at /wp-admin/users.php I see all the users, but some have given a bogus email and never used their password. Is there some way to see who has used their password at least once? If not, ...
2
votes
0answers
144 views

Disallow file edit not preventing plugin install

I have a little demo site (admin details are listed publicly), and I've configured the wp-config to disallow file edits, so in theory no one can install a theme / plugin. ...
8
votes
2answers
310 views

Securing Admin Accounts - Username Discovery

We've had Limit Login Attempts installed for some weeks now, and the number of brute force attempts occurring on wp-admin/wp-login is pretty amazing. At first the attempts were all with the username ...
0
votes
1answer
147 views

Auto log in hook is requiring a page refresh

I have a simple auto log in hook that looks like the following: function auto_login() { if (!is_user_logged_in()) { //Removed some code for brevity. $user = ...
0
votes
1answer
73 views

Security to delete post by Admin

My code is so simple like when admin delete a post by Wordpress fucntion (PHP) and do action with jQuery <?php include('../../../../../../wp-config.php'); if(current_user_can('edit_posts')){ $id = ...
2
votes
2answers
309 views

wordfence scan warning on W3 Total Cache [closed]

I use Wordfence plugin which scans server side plugins with original plugin files to see if anything was modified by hacker/cracker. Today I got a warning and it shows these modifications on ...
5
votes
2answers
895 views

File and directory permissions

I installed latest WordPress 3.5 in my CentOS server. When I tried accessing http://example.com/wp-includes/, I received a listing of the directory: (Index of wp-includes). I added the following code ...
0
votes
1answer
1k views

Problem with permissions in wp-content/plugins

I have a WP installation on my local machine and trying to get my hands dirty with plugins. I wish to clone a project from github which has this plugin code. However, i dont have the permissions ...
1
vote
1answer
391 views

Wordpress Security - How to block alternative Wordpress access

I own a self-hosted Wordpress 3.5 blog. I'm working on its security and I'm trying to prevent non-writers from accessing anything admin-ish they shouldn't. Recently I tried Better Wordpress Security, ...
-1
votes
1answer
178 views

Default installation permissions for wp-config.php

Recently I've noticed that many of the wordpress installations we have on our servers where being attacked and ifected by this thing ...
-2
votes
2answers
118 views

Is this a WordPress security bug?

<?php if ( ! is_admin() ) return; echo 'You should not see this if you\'re not logged in!'; ?> If you put this in a mu-plugin, and go to your admin, e.g., example.com/wp-admin/ while you are ...
8
votes
1answer
548 views

From a security standpoint, should bloginfo() or get_bloginfo() be escaped?

I've been reviewing a lot of information about WP theme and plugin security and understand the concept that you should escape attributes and HTML values in themes and plugins. I've seen bloginfo() and ...
0
votes
2answers
198 views

How to prevent plugins from sniffing/stealing other plugins' options?

Many plugins require configuration with sensitive data such as API keys, passwords, etc. When implementing these plugins, this sensitive data is stored using functions such as update_option() and ...
0
votes
1answer
50 views

Is this plugin safe to run?

This is an extract of code from a wordpress plugin. Is it safe to run despite the variables not being filtered? Also does the wpdb class filter to prevent any injection? list($email_id, $user_id, ...
0
votes
1answer
145 views

Admin can enter JavaScript - potential security risk?

WP 3.5/TwentyTwelve/Clean install. I try this when login as admin and editor. I try add reply for first post "Hello World": <script>alert('XSS')</script><script><</script> ...
0
votes
1answer
628 views

Basic password protection without using users and roles

I'm using WooCommerce, and want to be able to password protect products (or preferably whole categories if possible), but without using the Users & Roles functionality build into WP(because I need ...
0
votes
2answers
189 views

File permissions for wp-minify plugin

I am worried on installing Wp-Minify plugin. But it needs 777 permission for the cache directory located inside wp-uploads directory. Isn't it a security issue?
0
votes
1answer
106 views

security issue in wordpress?

I have installed wordpress in www.mysite.com/user and now suppose if someone is familiare with wordpress he/she can easily access my stuffs through www.mysite.com/user/members ...
3
votes
1answer
245 views

Nonces can be reused multiple times? Bug / Security issue?

I've read that nonces are meant to be for one time use only, and after an ajax request, you should issue a new nonce so with the next ajax request, a new nonce would be sent to the server. However, I ...
1
vote
1answer
2k views

Disable directory browsing of uploads folder

I'm using Wordpress as a CMS for a simple website. I want to prevent users from being able to browse the directories such as the wp-content/uploads folder or any directories of my theme. My host does ...
3
votes
1answer
1k views

Masking logout URL

The primary goal is to hide that the site is driven by wordpress. I've got the login part all locked up, but the logout URL still has those blasted wp delineators that give away it's a wordpress site. ...
1
vote
0answers
462 views

Security - Ajax and Nonce use [closed]

I'm developing a site which posts a number of ajax calls from jquery to PHP and returns data from PhP to jquery. Everything is working, but i'd to know if my approach to handling the calls is ok, in ...
0
votes
1answer
1k views

wp_insert_post disable HTML filter

I have input value "<iframe>....</iframe>" (param 'post_content'). When i execute wp_insert_post, function cut off my tag. How to disable HTML filter in wp_insert_post ?
1
vote
3answers
2k views

Why do I need to check if wp_nonce_field() exists before using it

i dont really understand why the check if the nonce function exists before running it ... if ( function_exists('wp_nonce_field') ) wp_nonce_field('gmp_nonce_check'); i understand its for ...
1
vote
1answer
49 views

About WordPress site security

If I install WordPress on my server, does it mean that Akismet is installed automatically? If so - do I still need to create e-mail verification and captcha tools for improving site security (as I see ...
-1
votes
3answers
861 views

Wordpress Hacks/Defacing [closed]

Im trying to figure out how Wordpress sites become defaced/hacked. I know development very well. I know how to secure code, etc. But I am finding recently, that tons of Wordpress sites are becoming ...
4
votes
1answer
335 views

How to protect uploads in multisite if user is not logged in?

I am trying to set up a multisite intranet (using subdomains) where content on each sub-site is only accessible to users logged into their respective site. The problem I am having is trying to ...
2
votes
0answers
320 views

comment_post_ID 0 (cannot remove from dashboard)

Ran across something a bit odd that I haven't seen before. A client has a pretty active blog and uses Akismet (paid) to protect against spam. At least once a day, they're reporting a spam comment that ...
10
votes
2answers
252 views

How Can I Securely Implement a Password-less Login Feature?

Just posted a new plugin: No More Passwords I currently have it tagged beta because logging into a platform is a sensitive issue and I don't want to release something that may have security holes. So ...
5
votes
3answers
1k views

Filter any HTTP request URI?

I want to filter any HTTP request URI done through the HTTP API. Use cases: The WordPress update check goes to http://api.wordpress.org/core/version-check/1.6/, but ...
2
votes
2answers
861 views

Renaming wp-content folder dynamically

Is it possible to rename the wp-content folder dynamically? I am building a custom framework to use on themes and it would be nice to set it up where it does everything on its own. I am using this ...
6
votes
2answers
2k views

Prevent access or auto-delete readme.html, license.txt, wp-config-sample.php

Just a quick question that might help a tad bit with security. I noticed that the readme.html file has the version number listed. It reappears after each upgrade and so do the licence.txt, and ...
0
votes
1answer
62 views

How 'secure' are loops?

I am using loops as means of displaying personal meta and customer information on the frontend. For example, I have a page which displays a user's 'profile' information to edit. Their profile is ...
6
votes
1answer
77 views

Is it safe to store a user setting you don't want the user to ever modify as a user option?

I have added some custom user options to the profile page on my site, and most are all OK for the user to modify themselves. These options live in their own section. The users have read access and ...
13
votes
2answers
7k views

Getting a List of Currently Available Roles on a WordPress Site?

When writing WordPress plugins there is often a need to set up options for which roles on the site have access to certain functionality or content. To do this a plugin dev needs to fetch the list of ...
2
votes
1answer
838 views

how can i embed wordpress backend in iframe

I have 2 websites http://www.aaa.com and http://www.bbb.com and need it show the same. now i put iframe in index.html and upload to aaa.com. it's ok for frontend but it's doesn't work for backend, ...
2
votes
1answer
54 views

What is the most secure way to set up the MySQL user in WPMU?

I am setting up Subdomain based MU on my domain.Everything is hosted by me running on one CentOS/Webmin VPS. Will I be better off setting the MySQL user's domain as localhost, 127.0.0.1 or with a ...
0
votes
1answer
69 views

Wordpress custom admin functions security

i have a case in my admin panel where i need to call my own function that resides in my own php file, with a GET request. This function is actually removing entries from the database. So, i would ...
0
votes
1answer
149 views

Secure Wordpress: Change admin

I'm sorry if this is an extremely stupid question. I've been looking for ways how to secure my WP and a lot of websites suggest to create a new admin user account and delete the old one. Now, if I ...
1
vote
0answers
74 views

Are un-sanitized theme options more vulnerable to malicious scripts than the theme editor?

I'd like to put text areas in a theme options area to allow users to easily add analytics code, scripts, and css. Is it silly to worry about malicious code being inserted via un-sanitized theme ...