The security tag has no wiki summary.
0
votes
1answer
322 views
Is the Block Bad Queries Plugin Still Relevant?
The Block Bad Queries Plugin hasn't been updated recently. Is WordPress still subject to these types of malicious attacks or has it been hardened sufficiently to make the plugin obsolete? Is there an ...
0
votes
1answer
112 views
Using password protection to load different page elements?
I have a page that is password protected, and I wish to removed some parts of the theme, and add others. Can I do that? Is there a check I can do in the theme files to see if a user has entered the ...
0
votes
1answer
111 views
User generated content and security
I'm gonna create a new site. I want to make the site as user generate able content site.
Basically this is my site's function. Users signup in my wordpress site, Submit content from wp-admin panel, ...
0
votes
2answers
979 views
Uploading .webm format on Wordpress results in security guidline breach and fail
I cannot upload the .webm video format on Wordpress.
This is after adding:
AddType video/webm .webm
into both:
my .htaccess file (on the root folder of the wordpress installation)
the mime type ...
0
votes
1answer
90 views
Allowing Users to Register Themselves and Post : Does WordPerss Handle these Problems?
If one allows visitors of a WordPress blog to register themselves and post to the blog without moderation(i.e. without submit for review), malicious visitors may try to
1)Post a large number of posts ...
2
votes
1answer
549 views
What is the relationship between cURL, WordPress and cacert.pem?
I've run into a problem concerning wp_remote_get() and the underlying cURL call. On some WordPress installations I see the following SSL error:
httprequest_failed: SSL certificate problem, verify ...
1
vote
1answer
284 views
How to block a category from one user and enable the category for the rest of the users
I have a site in which all categories are open to anyone, except for 2 categories that are password protected: Students, and Teachers. They are open only to specific users types, as follows:
The ...
3
votes
2answers
695 views
Can I force a password change?
When I create a new user, I would like to force that user to change their password on first log in, can this be done?
4
votes
1answer
170 views
What is the most secure way to store post meta data in WP?
Sony's recent security "holes" showed how unsafe it can be to store data unencrypted. As some of you may know, I 'm working on re-releasing the free CRM theme Driftwood.
What is the most secure way ...
-1
votes
1answer
131 views
Will my Wordpress site become vulnerable after adding this functions which allows more HTML tags for subscribers?
I was thinking of adding the following lines of code to my functions.php file:
/**
* Change the default list of allowed html tags
*/
add_action('init', 'edittag', 10);
function edittag() {
...
0
votes
1answer
199 views
Is there a way to hide WordPress behind a web visible directory?
Is there a way to hide WordPress behind a web visible directory for extra security using a symlink?
5
votes
1answer
216 views
Which KSES should be used and when?
The WP source shows that wp_filter_kses and wp_filter_post_kses are passed data that's "expected to be escaped with slashes."
On the other hand, wp_kses_data is passed data that's "expected to not be ...
2
votes
4answers
520 views
What are the pros and cons of using a custom front-end to retrieve content from a Wordpress back-end
I've been building wordpress sites for a few years now and have noticed a few things that bother me.
1. It's fairly slow (awful blanket statement, I apologize)
My initial desire to create a ...
1
vote
1answer
89 views
Why was my blog post inserted lot's of ad links by others?
I found that my blog posts are inserted lot's of ad links, I'm using WordPress 2.9.2, is there a known security vulnerability in it?
A screenshot : I post some codes on my blog, the ad links are ...
3
votes
1answer
108 views
Will my Wordpress site become vulnerable to Cross-Site Scripting (XSS) if I allow img tags in the comments area?
I'm planning to follow this tutorial in order to allow my subscribers to add images to comments (actually a custom post type called "Replies").
Wordpress filters <img> tags by default (except ...
7
votes
3answers
493 views
Will there be security updates for 3.1 once 3.2 is released?
I am currently running WordPress 3.1.2 on PHP 5.1.6. The minimum requirement for WordPress 3.2 is going to be PHP 5.2.4 or greater. If I keep running WordPress 3.1.2 and there is a security issue will ...
3
votes
3answers
831 views
Options for restricting access to wp-admin
So i've installed a plug-in which allows me to enable two-factor authentication for my users. The problem is that to enable the plug-in i have to log in as that user and enable it via their profile ...
2
votes
2answers
759 views
Correct Approach for Validating Custom Field Input
I have a custom post type with several custom fields. I am looking to do some validation on these fields because they will be used downstream by other services. So, it is important that it can't be ...
3
votes
2answers
616 views
Is there a security risk giving someone temporary access to my blog's code?
My blog is painfully slow for the last few days, and I would like to pay someone (anyone?) 15 BitCoins to optimize it for me (I would do it myself, but I'm not sure I have the time right now).
It's ...
1
vote
1answer
546 views
Securing wp-config leads to sensitive information leak on wp-settings
I read the following tutorial, which mentions moving your config file out of an HTTP-accessible folder.
http://codex.wordpress.org/Hardening_WordPress#Securing_wp-config.php
I did this, and it works ...
1
vote
1answer
417 views
Is disabling test_form in wp_handle_upload a security concern?
I'm writing a plugin that modifies the default behavior when uploading a file for a post or to the media library. I'm setting $overrides in wp_handle_upload() with a custom $unique_filename_callback.
...
4
votes
2answers
266 views
What is the ideal setup to address security concerns?
I'm aware of the requirements WP has for certain directories and files to be writable. I'm also aware that making permissions too loose can open security holes. Finally, I know that the user that ...
1
vote
1answer
418 views
How Could I sanitize the receive data from this code
<form id="tellastory" method="post" action="">
<label for="fullname">Full Name </label>
<input id="fullname" name="fullname" type="text" maxlength="255" value=""/>
...
-3
votes
3answers
154 views
Should WordPress Add Options to Enhance Security or Leave it to plugin developers?
Based on the passion engendered with the responses to this question. It appears that the answer is a resounding "Nothing!" or "leave it to plugin developers to handle, WP is already secure enough"...
...
1
vote
1answer
158 views
Using HTACCESS for Secret Access
I saw this post yesterday http://digwp.com/2011/01/simpler-login-url/ where a 'custom' word is used to direct the user from url.com/admin to url.com/wp-login.php and I'm asking (also did so in the ...
0
votes
3answers
357 views
WP Insert Post If user refreshes override new post
WP Insert Post is a very simple and easy to use function. Currently I have it set up on event triggered by whether a user is logged in during a booking to ratify their booking in its own page. My ...
0
votes
1answer
145 views
security concerns if using html data-* attribute for l10n?
I need to pass a localized multidimensional javascript object to a page. The object is constructed using php and represents some wp-theme settings. I cant find a way to utilize wp_localize_script for ...
1
vote
2answers
4k views
What are the recommended database permissions for WordPress?
I just got WP running on my own server. I am not trying to lock things down more. What permissions should the db user have to my WP db?
4
votes
1answer
1k views
Limiting sessions to one IP at a time
On a site with premium user account subscriptions, I'd like to be able to limit logins to one computer at a time. The most straightforward way to accomplish this would be to limit by IP, but I haven't ...
0
votes
0answers
81 views
Wordpress and login security?
Can and does Wordpress tell me if I am logged in on another machine?
Does it store login IP addresses?
0
votes
1answer
160 views
Secure Server after configuration
Recently I purchased a VPS from intovps.com, And first time I configured a fully unmanaged VPS through ssh comands.
My website is working into it, properly.
Now I just want to know how to secure it?
...
4
votes
2answers
450 views
How Attackers write script into my php files?
I have a blog created with wordpress, now i have a problem. Attackers writes javascript codes into my files.
Let's assume i have holes in my plugin scripts, but how can they write into php files?
...
8
votes
4answers
620 views
What's the easiest way to stop WP from ever logging me out
After a certain amount of time WP logs out all users and forces them to log back in again. For development environments on my local machine this is obnoxious and absolutely unnecessary.
Is there an ...
1
vote
1answer
154 views
Subscribe to email for security fixes?
Is there any email alert list for security fixes?
I'd rather not rely on just an RSS feed.
6
votes
2answers
440 views
How can I lock down an old wordpress install I don't intend to update?
I am starting a new wordpress blog, and no longer updating an old one.
The old one still gets 400-500 hits a day, so I would like to keep it up for archival purposes, as people still link to its ...
1
vote
2answers
138 views
What may be causing failure of auto-install features in Wordpress (v3.0.3)?
What may be causing the installation errors I continue to get when trying to auto update anything in Wordpress? I've been manually upgrading everything for quite some time, and I've tried all sorts ...
1
vote
2answers
800 views
Best practices for securing a Buddypress installation?
A client of mine runs a Buddypress-based site (BP 1.2.6 on WP 3.0.2). We'd like to give users the ability to publish blogs of their own, but we don't want them to be able to execute PHP code (we make ...
1
vote
2answers
113 views
Upgraded to latest version - 3.0.3 and Now I get a “sufficient permissions to access this page” error
The issue appeared immediately after upgrade. The only part of the application impacted is the sub-menu items under settings where it relates to a plug-in. The core application settings work, just ...
3
votes
2answers
70 views
Any reason to be concerned by a wave of “zombie” blog signups?
I maintain a blog for a friend of mine. It's basically an aggregater of videos from other embeddable video sites, and provides a way for users to comment on those videos. Not really high-value ...
0
votes
1answer
288 views
404 errors when updating options in admin dashboard
Whenever I try to update my Permalink settings or use the Theme Editor to modify some file, I am redirected to a 404 page. This also happens when I update the All-In-One SEO Pack plugin's settings. ...
1
vote
2answers
119 views
Weird problems after recovery from security breach
The shared server that I used for hosting my WordPress website was hacked recently, and many of the index.php files, plugin files and uploads were deleted, with my MySQL databases untouched. But after ...
0
votes
1answer
86 views
Privilege escalation bugs in 2.9?
Are there any known privilege escalation bugs in WP 2.9 to be careful for?
1
vote
1answer
427 views
whats the difference between esc_* functions
i read professional wordpress and
esc_html function is used for
scrubbing data that contains HTML.
This function encodes special
characters into their HTML entities
esc_attr function ...
3
votes
3answers
534 views
Secure WordPress paid plug-in
I want to create a WordPress plug-in but also want to ensure that the plugin can only be used after it has been activated with a serial key that should be unique for each domain.
What is the best way ...
5
votes
4answers
1k views
Security and .htaccess
About a month ago I started a WordPress blog on a hosted server related to a hobby. So, I am new to this at present.
Since I'm concerned about security, one thing I did was to install the plugin WP ...
