Strengthening themes, plugins and core installation to prevent intrusion.
0
votes
1answer
90 views
Allowing Users to Register Themselves and Post : Does WordPerss Handle these Problems?
If one allows visitors of a WordPress blog to register themselves and post to the blog without moderation(i.e. without submit for review), malicious visitors may try to
1)Post a large number of posts ...
4
votes
1answer
109 views
Will my Wordpress site become vulnerable to Cross-Site Scripting (XSS) if I allow img tags in the comments area?
I'm planning to follow this tutorial in order to allow my subscribers to add images to comments (actually a custom post type called "Replies").
Wordpress filters <img> tags by default (except ...
7
votes
3answers
500 views
Will there be security updates for 3.1 once 3.2 is released?
I am currently running WordPress 3.1.2 on PHP 5.1.6. The minimum requirement for WordPress 3.2 is going to be PHP 5.2.4 or greater. If I keep running WordPress 3.1.2 and there is a security issue will ...
3
votes
4answers
557 views
ensure user can only be logged in on one computer at a time?
how can i make sure a user can only be logged in on one computer at a time? I want to make a wordpress site that could potentially have paid accounts for content in the future. Is there anything built ...
1
vote
1answer
255 views
Detect session/cookie variable in wordpress to prevent access to documents
<?php
@session_start();
If (!array_key_exists(‘authed’, $_SESSION))
{
include ‘not_authed.inc’;
exit();
}
// go about your business.
?>
and i'm trying to add that to this:
...
3
votes
2answers
2k views
Can upload doc and pdf but not ppt - not permitted for security reasons
"Insert search engine here" was pretty useless for this one - I've had a look through wp-includes/functions.php, wp-admin/includes/file.php etc. but not found a reason for the behaviour I'm getting.
...
5
votes
3answers
563 views
WordPress Ajax Data Security
I am aware of nonces to check for intentions but can't make any sense if I can use them to restrict for database reads somehow? I mean, I am fetching records from the database using AJAX but I don't ...
2
votes
4answers
527 views
What are the pros and cons of using a custom front-end to retrieve content from a Wordpress back-end
I've been building wordpress sites for a few years now and have noticed a few things that bother me.
1. It's fairly slow (awful blanket statement, I apologize)
My initial desire to create a ...
14
votes
13answers
1k views
What Are Security Best Practices for WordPress Plugins and Themes? [closed]
As suggested in this question, I am adding this topic as a new question, for community discussion/voting regarding best-practices for Plugin/Theme security.
Here is the starting checklist, based on ...
11
votes
3answers
316 views
What are the common security flaws I need to look for? [closed]
As a wannabe WP plugin developper, what are the main security flaws/holes I should look for?
I'm about to create a new plugin with a configuration panel (ie input fields and stuff). What should I be ...
3
votes
2answers
649 views
Is there a security risk giving someone temporary access to my blog's code?
My blog is painfully slow for the last few days, and I would like to pay someone (anyone?) 15 BitCoins to optimize it for me (I would do it myself, but I'm not sure I have the time right now).
It's ...
-1
votes
3answers
2k views
How to remove “Connection Information” requirement on localhost install of WP on MACOSX
I've just installed XAMPP on Mac OSX and when trying to install a theme or plugin in WP admin, I'm getting this screen. I've never gotten this on my shared hosting account. how to get rid of it on ...
1
vote
1answer
568 views
Securing wp-config leads to sensitive information leak on wp-settings
I read the following tutorial, which mentions moving your config file out of an HTTP-accessible folder.
http://codex.wordpress.org/Hardening_WordPress#Securing_wp-config.php
I did this, and it works ...
1
vote
1answer
419 views
Is disabling test_form in wp_handle_upload a security concern?
I'm writing a plugin that modifies the default behavior when uploading a file for a post or to the media library. I'm setting $overrides in wp_handle_upload() with a custom $unique_filename_callback.
...
2
votes
2answers
789 views
Has anyone experience w/ WordPress (MultiSite) hidden users (possibly hacked)?
I have 2 WordPress MultiSite installs (on different accounts, but under the same HostGator reseller a/c) and both seem to have been compromised. I say "compromised" because the user_logins have been ...
2
votes
1answer
212 views
Is it possible to post with Word 2007 via XML-RPC and limit categories by user?
I'm working on a project for a school district I work at where we want to use Word Press to have employees from all of the buildings post announcements and press releases via Word 2007. We will then ...
1
vote
1answer
425 views
How Could I sanitize the receive data from this code
<form id="tellastory" method="post" action="">
<label for="fullname">Full Name </label>
<input id="fullname" name="fullname" type="text" maxlength="255" value=""/>
...
-3
votes
3answers
155 views
Should WordPress Add Options to Enhance Security or Leave it to plugin developers?
Based on the passion engendered with the responses to this question. It appears that the answer is a resounding "Nothing!" or "leave it to plugin developers to handle, WP is already secure enough"...
...
0
votes
3answers
358 views
WP Insert Post If user refreshes override new post
WP Insert Post is a very simple and easy to use function. Currently I have it set up on event triggered by whether a user is logged in during a booking to ratify their booking in its own page. My ...
2
votes
2answers
767 views
Correct Approach for Validating Custom Field Input
I have a custom post type with several custom fields. I am looking to do some validation on these fields because they will be used downstream by other services. So, it is important that it can't be ...
0
votes
1answer
145 views
security concerns if using html data-* attribute for l10n?
I need to pass a localized multidimensional javascript object to a page. The object is constructed using php and represents some wp-theme settings. I cant find a way to utilize wp_localize_script for ...
1
vote
2answers
4k views
What are the recommended database permissions for WordPress?
I just got WP running on my own server. I am not trying to lock things down more. What permissions should the db user have to my WP db?
0
votes
1answer
161 views
Secure Server after configuration
Recently I purchased a VPS from intovps.com, And first time I configured a fully unmanaged VPS through ssh comands.
My website is working into it, properly.
Now I just want to know how to secure it?
...
4
votes
2answers
463 views
How Attackers write script into my php files?
I have a blog created with wordpress, now i have a problem. Attackers writes javascript codes into my files.
Let's assume i have holes in my plugin scripts, but how can they write into php files?
...
1
vote
1answer
163 views
Subscribe to email for security fixes?
Is there any email alert list for security fixes?
I'd rather not rely on just an RSS feed.
-1
votes
1answer
274 views
How to protect wp-admin from third party access?
How can the wordpress administration panel and the login page wp-login.php be hidden such that only the website administrator can access it? Can the URL be rewritten through some mod_rewrite rule ...
3
votes
5answers
424 views
1
vote
1answer
158 views
Using HTACCESS for Secret Access
I saw this post yesterday http://digwp.com/2011/01/simpler-login-url/ where a 'custom' word is used to direct the user from url.com/admin to url.com/wp-login.php and I'm asking (also did so in the ...
2
votes
4answers
15k views
Is there any way to rename or hide wp-login.php?
Any way to change the wp-login.php url? It seems insecure that everyone that's ever used Wordpress could easily see if your site is using it, and get right to the login page.
There used to be a ...
3
votes
2answers
390 views
Setting WP Admin passwords to expire
I'm aware it's not a feature of Wordpress, but I was wondering if there was a way or a plug-in (haven't found one from searching) that allows me to force a user to change their password after a ...
6
votes
2answers
445 views
How can I lock down an old wordpress install I don't intend to update?
I am starting a new wordpress blog, and no longer updating an old one.
The old one still gets 400-500 hits a day, so I would like to keep it up for archival purposes, as people still link to its ...
1
vote
2answers
138 views
What may be causing failure of auto-install features in Wordpress (v3.0.3)?
What may be causing the installation errors I continue to get when trying to auto update anything in Wordpress? I've been manually upgrading everything for quite some time, and I've tried all sorts ...
1
vote
2answers
811 views
Best practices for securing a Buddypress installation?
A client of mine runs a Buddypress-based site (BP 1.2.6 on WP 3.0.2). We'd like to give users the ability to publish blogs of their own, but we don't want them to be able to execute PHP code (we make ...
6
votes
2answers
1k views
Prevent access or auto-delete readme.html, license.txt, wp-config-sample.php
Just a quick question that might help a tad bit with security. I noticed that the readme.html file has the version number listed. It reappears after each upgrade and so do the licence.txt, and ...
1
vote
2answers
113 views
Upgraded to latest version - 3.0.3 and Now I get a “sufficient permissions to access this page” error
The issue appeared immediately after upgrade. The only part of the application impacted is the sub-menu items under settings where it relates to a plug-in. The core application settings work, just ...
0
votes
3answers
343 views
Spam injected in w3 total cache page cache
I'm trying to fix a site which has been injected with external spam. After inspection I found out that the external content (so far just html advertising different kinds of drugs, no scripts) was in ...
3
votes
2answers
71 views
Any reason to be concerned by a wave of “zombie” blog signups?
I maintain a blog for a friend of mine. It's basically an aggregater of videos from other embeddable video sites, and provides a way for users to comment on those videos. Not really high-value ...
0
votes
1answer
293 views
404 errors when updating options in admin dashboard
Whenever I try to update my Permalink settings or use the Theme Editor to modify some file, I am redirected to a 404 page. This also happens when I update the All-In-One SEO Pack plugin's settings. ...
4
votes
1answer
1k views
Limiting sessions to one IP at a time
On a site with premium user account subscriptions, I'd like to be able to limit logins to one computer at a time. The most straightforward way to accomplish this would be to limit by IP, but I haven't ...
1
vote
2answers
119 views
Weird problems after recovery from security breach
The shared server that I used for hosting my WordPress website was hacked recently, and many of the index.php files, plugin files and uploads were deleted, with my MySQL databases untouched. But after ...
3
votes
2answers
700 views
Can I force a password change?
When I create a new user, I would like to force that user to change their password on first log in, can this be done?
3
votes
3answers
842 views
Options for restricting access to wp-admin
So i've installed a plug-in which allows me to enable two-factor authentication for my users. The problem is that to enable the plug-in i have to log in as that user and enable it via their profile ...
0
votes
1answer
86 views
Privilege escalation bugs in 2.9?
Are there any known privilege escalation bugs in WP 2.9 to be careful for?
0
votes
1answer
253 views
Does WP show me if I'm logged in from multiple locations?
Does word press show me if I'm logged in in another location?
Related: Limiting sessions to one IP at a time
0
votes
0answers
83 views
Wordpress and login security?
Can and does Wordpress tell me if I am logged in on another machine?
Does it store login IP addresses?
10
votes
2answers
3k views
Getting a List of Currently Available Roles on a WordPress Site?
When writing WordPress plugins there is often a need to set up options for which roles on the site have access to certain functionality or content. To do this a plugin dev needs to fetch the list of ...
1
vote
1answer
443 views
whats the difference between esc_* functions
i read professional wordpress and
esc_html function is used for
scrubbing data that contains HTML.
This function encodes special
characters into their HTML entities
esc_attr function ...
1
vote
3answers
1k views
Why do I need to check if wp_nonce_field() exists before using it
i dont really understand why the check if the nonce function exists before running it ...
if ( function_exists('wp_nonce_field') )
wp_nonce_field('gmp_nonce_check');
i understand its for ...
52
votes
7answers
12k views
Steps to Take to Hide the Fact a Site is Using WordPress?
I have a website for which we are trying to be discreet about the fact that we are using WordPress. What steps can we take to make it less obvious?
8
votes
4answers
642 views
What's the easiest way to stop WP from ever logging me out
After a certain amount of time WP logs out all users and forces them to log back in again. For development environments on my local machine this is obnoxious and absolutely unnecessary.
Is there an ...
