Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

14
votes
2answers
483 views

In Which Contexts are Plugins Responsible for Data Validation/Sanitization?

I want to make sure all of the data in my plugins/themes is handled securely before entering the database and before being output to the browser. My problem is that there are situations where the API ...
0
votes
1answer
544 views

Do I need to sanitize Wordpress search query?

I submit search data to custom page searchi.php <?php // $search_variables = $_GET['s']. '+' .$_GET['cat']; //This sends http post to url without curl header("Status: 301 Moved ...
4
votes
1answer
306 views

How to protect uploads in multisite if user is not logged in?

I am trying to set up a multisite intranet (using subdomains) where content on each sub-site is only accessible to users logged into their respective site. The problem I am having is trying to ...
10
votes
1answer
2k views

Worthwhile to restrict direct access of theme files?

I've run across the following snippet in themes from time to time: if ( ! defined('ABSPATH')) exit('restricted access'); It's at the beginning of some (all?) PHP files in a theme and it's supposed ...
0
votes
2answers
447 views

Any known bugs that could cause disappearance of the wp_users table?

I administer a number of WordPress-powered web sites. One of these sites is new, and has been running untouched since it was set up a month ago. Today, I tried to log in, but was unable to do so - ...
0
votes
3answers
2k views

How to control who can view certain pages in BuddyPress?

I would like to control who can see a page in BuddyPress and restrict anyone else from accessing it. Something along the lines of the following pseudocode: <?php if ( loggedin_user_ids==1,4,5,7 ) ...
5
votes
5answers
2k views

How to hide admin account in BuddyPress? (for security reasons)

I have been working with WordPress for the past 3-4 years, but I am new to BuddyPress. I would like to hide the admin account completely from BuddyPress for security reasons. For example with a ...
2
votes
2answers
78 views

How to limit WordPress pages during updates?

I will be doing upgrades to the design and content of my Wordpress site. During this time I only want the homepage to be available. Is there a good way to lock this down (through a plug-in, etc.). ...
1
vote
1answer
3k views

Websites defaced by uploading script using theme editor

We've had several Wordpress sites defaced, all of them having the same pattern (at least the raw access log says so). From the logs it appears they directly login to Wordpress then go to theme editor ...
1
vote
1answer
30 views

correct tags for validating input types

I have following types of theme options inputs, which I need to validate. $numbers = "#1234"; $email = "abc@example.com"; $simeple_text = "How's going?"; $code = "<script ...
2
votes
1answer
493 views

Generate Wordpress salt

I am in need of a function that automatically generates and returns salts for Wordpress wp-config.php (Don't link me to their API, I'm looking for offline solution). Does Wordpress core has this ...
0
votes
1answer
54 views

Is there any pre-existing plugin to track and block IPs with suspicious activity on my site?

The image below shows a recent (failed) attempt to crack my Wordpress install. It's easy for me to look at that and see what they were doing, but is there a plugin that exists that monitors this data ...
54
votes
8answers
15k views

Is moving wp-config outside the web root really beneficial?

One of the most common security best practices these days seems to be moving wp-config.php one directory higher than the vhost's document root. I've never really found a good explanation for that, but ...
0
votes
1answer
84 views

Basic File/Post restriction plugin

I am looking for a plugin that allows me to restrict access for a individual post/page to a specific role or individual. It also needs to restrict files attached to that post. I have tried several ...
1
vote
2answers
419 views

Is WordPress MultiSite secure & how much can it scale? [closed]

Great info on How to Scale Wordpress and more info on Wordpress Web Hosting. Still, I am left with questions. Creating a project that for the sake of argument we will call a blog network. A user ...
0
votes
1answer
631 views

Something is unescaping all html entities before output to browser [closed]

I have a nasty problem. In my wordpress site something unescapes all html entities before sending data to the browser. It happens for all of the following cases: echo "&quot;XSS" print_r( ...
2
votes
2answers
82 views

Can someone (Support of my themeprovider) get access to my server If I send them my admin login?

I have bought a WP theme from a huge provider (themeforest). But it has a lot of bugs. The support asked me to send my WP Admin Login/Password. What risk does this have? I know the supportstaff will ...
1
vote
2answers
1k views

<?php echo $title ?> vs <?php echo esc_html( $title ); ?> Wordpress Security

Reading this great article Data Validation and Sanitization in Wordpress I've noticed that in my blog, in header.php, I used <?php echo $title ?> in a pair of codes. According to the above ...
3
votes
2answers
194 views

Brute force attack?

I'm seeing this quite often: No OS, same Browser, weird hostname -- they're definitely not real users. Can I do anything to take precautions before they do something? Thanks!
-1
votes
1answer
328 views

suspicious boolean.php file in wp web root [closed]

Today I noticed in my web root a suspicious php file: boolian.php and serveral .html files with random names, all containing trojans. I remember yesterday I just uploaded and activated few themes I ...
0
votes
1answer
113 views

Secure way to use name_save_pre?

I created a custom post where I need to change the post name regarding to the custom field and taxonomy values. This is how I did it: add_filter('name_save_pre', 'save_name'); function ...
3
votes
1answer
2k views

How to make media upload private? [duplicate]

Possible Duplicate: How to Protect Uploads, if User is not Logged In? I know how to mark a Page or Post as visible only to members, using the Member Access plugin. This way, the public ...
0
votes
2answers
3k views

Password protect a specific category page/post

I have searched high and low for this but nothing is sticking out at me. I am looking to password protect posts and/or pages based on a certain category. The reason for this is that I am creating a ...
0
votes
2answers
1k views

Is Timthumb still broken? What security measures should be taken?

A client has requested we use a theme, and that theme has a Timthumb dependency. I know that there has been some serious vulnerabilities in the past, but what is the current state of that plugin? ...
0
votes
2answers
76 views

Which Versions of WordPress Ship with the Patched TimThumb?

Do you recall when the TimThumb exploit occurred? Which versions of WordPress bundled with this exploit? I need to inform a client that they should be upgrading to at least the version of WP when this ...
9
votes
2answers
1k views

Should I escape wordpress functions like the_title, the_excerpt, the_content

I had look at the code but I couldnt see any escaping on funcions like the_title the_content the_excerptetc. I might not be reading it right. Do I need to escape these functions in theme development ...
0
votes
4answers
977 views

No option “I would like my site to be private, visible only to users I choose” in Privacy Settings

I am running WordPress 3.3.2 self-hosted. I used to see the option "I would like my site to be private, visible only to users I choose" under Privacy Settings but I no longer see this option. Instead, ...
3
votes
2answers
608 views

Secure Validation of wp_editor in Theme Options

So I just found this great WPSE thread about security for themes/plugins. It answered most of my questions but it was created before the new wp_editor() function was built. I have two TinyMCE editors ...
2
votes
3answers
105 views

Why users disable the WordPress update?

Users install plugins which disable update reminders. Plugins: disable WordPress Core Updates disable WordPress Plugin Updates disable WordPress Theme Updates Look at the counter of plugins ...
0
votes
1answer
106 views

Security updates to 3.3.2

I know all security updates are important but given that how important on a scale from 1 to 10 is it to upgrade from 3.1.3 to 3.3.2. I have some sites that need to be upgraded but the host has me ...
1
vote
3answers
530 views

Simple Online Payment for Event Registration

I am looking for a simple (and secure) way to accept payment for event registration. I am managing a Wordpress website for a organization that hosts events throughout the year. A handful of these ...
1
vote
1answer
327 views

How to expire all wordpress user passwords instantly?

So I own an article directory website and recently a lot of bots have signed up and started posting spam. (I approve posts prior to publication) I've added a captcha to the user registration page now ...
2
votes
1answer
690 views

how can i embed wordpress backend in iframe

I have 2 websites http://www.aaa.com and http://www.bbb.com and need it show the same. now i put iframe in index.html and upload to aaa.com. it's ok for frontend but it's doesn't work for backend, ...
1
vote
1answer
92 views

Why do people use “admin” username by default? [closed]

WordPress users use "admin" username by default to login to admin panel because WordPress suggest this username at the end off install. But "admin" username is the most common username to brute-force ...
10
votes
1answer
1k views

wp_verify_nonce vs check_admin_referer

What is the difference, which one should I use? I know that wp_verify_nonce checks the time limit, and check_admin_referer I think calls wp_verify_nonce as well as checking for an admin url segment, ...
7
votes
5answers
3k views

Can I Prevent Enumeration of Usernames?

Can I prevent enumeration of usernames on my wordpress site? I can see users at the moment using the WPScan tool.
1
vote
2answers
145 views

esc_html__ security : what for in this example?

how does esc_html__ (the 2nd one) protect the $message variable from being hacked ? what's the point to use this protection here (the second one with a plain text)? <?php function unknown(){ ...
0
votes
1answer
1k views

Problem with permissions in wp-content/plugins

I have a WP installation on my local machine and trying to get my hands dirty with plugins. I wish to clone a project from github which has this plugin code. However, i dont have the permissions ...
1
vote
2answers
532 views

wp_nonce_field displaying twice

I have wp_nonce_field in my code but it's creating two instances to the html code for some reason, one where I'd expect it and another at the start of the entry. Is this correct or am I doing ...
0
votes
1answer
172 views

Spam in Wordpress root folder

Two questions in one. A php file was recently introduced in the root directory of my Wordpress installation (a domain installation). It didn't disturb my website but was apparently using the domain ...
3
votes
1answer
843 views

What is the difference between strip_tags and wp_filter_nohtml_kses?

What is the difference between strip_tags and wp_filter_nohtml_kses. I tried to figure wp_filter_nohtml_kses from the source but it looks like it does something a bit more complex than strip all html ...
0
votes
1answer
152 views

Contact Form Security

Building my own contact form in Wordpress. Any there any security steps I need to consider other than the typical email etc validation and maybe a captcha. I am not sending any data to the database.
0
votes
2answers
103 views

Side effects of disallowing *.php requests in production environment?

For security in the production environment a company I work with has removed the whole wp-admin/ directory, and is about to disallow all *.php file calls with a 403 Forbidden HTTP error. Are there ...
6
votes
1answer
616 views

What is the difference between esc_html and wp_filter_nohtml_kses?

What is the exact difference between esc_html and wp_filter_nohtml_kses. Everywhere I look says that both strip all the html, the only difference I can see is to do with exactly how they do this. Does ...
3
votes
1answer
795 views

Encrypt emails?

We need to maintain HIPPA compliance for forms on our website that are currently mailed to an internal email address. While the user/customers provides the info over HTTPS, we still want to make sure ...
1
vote
1answer
229 views

The 'https_local_ssl_verify' filter

I have run into some WordPress code which does POST requests to API sites and in the POST parameters for the SSL property it has $params = array( 'body' => $_POST, 'sslverify' => ...
2
votes
1answer
168 views

Which of WordPress's .php files need to be directly accessible via HTTP?

I'm trying to tighten up security on my WordPress installation, and one of the things that seems like it might be a good idea is preventing all of the internal-use .php files from being accessed ...
4
votes
3answers
126 views

Regular security checks - what steps should be included?

There are heaps of tutorials explaining how to secure a WordPress installation, but I couldn't find any that listed out steps for weekly or monthly security checks. What are some steps that you ...
2
votes
1answer
240 views

Wordpress Malware Problem help! [duplicate]

Possible Duplicate: Wordpress Trojan issue help! I accessed the wordpress website I am building and received a warning about a trojan from my anti virus software. I have now checked the ...
5
votes
1answer
247 views

multi page password protection

Is it possible to have the "password protected page" feature of WordPress apply to more than one page? I have dozens of pages which I wish to protect with the same password, but I don't want people to ...