Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

0
votes
1answer
97 views

security issue in wordpress?

I have installed wordpress in www.mysite.com/user and now suppose if someone is familiare with wordpress he/she can easily access my stuffs through www.mysite.com/user/members ...
0
votes
1answer
953 views

wp_insert_post disable HTML filter

I have input value "<iframe>....</iframe>" (param 'post_content'). When i execute wp_insert_post, function cut off my tag. How to disable HTML filter in wp_insert_post ?
0
votes
1answer
67 views

Wordpress custom admin functions security

i have a case in my admin panel where i need to call my own function that resides in my own php file, with a GET request. This function is actually removing entries from the database. So, i would ...
0
votes
1answer
469 views

Do I need to sanitize Wordpress search query?

I submit search data to custom page searchi.php <?php // $search_variables = $_GET['s']. '+' .$_GET['cat']; //This sends http post to url without curl header("Status: 301 Moved ...
0
votes
1answer
3k views

Websites defaced by uploading script using theme editor

We've had several Wordpress sites defaced, all of them having the same pattern (at least the raw access log says so). From the logs it appears they directly login to Wordpress then go to theme editor ...
0
votes
1answer
52 views

Is there any pre-existing plugin to track and block IPs with suspicious activity on my site?

The image below shows a recent (failed) attempt to crack my Wordpress install. It's easy for me to look at that and see what they were doing, but is there a plugin that exists that monitors this data ...
0
votes
2answers
2k views

Password protect a specific category page/post

I have searched high and low for this but nothing is sticking out at me. I am looking to password protect posts and/or pages based on a certain category. The reason for this is that I am creating a ...
0
votes
1answer
104 views

Security updates to 3.3.2

I know all security updates are important but given that how important on a scale from 1 to 10 is it to upgrade from 3.1.3 to 3.3.2. I have some sites that need to be upgraded but the host has me ...
0
votes
2answers
103 views

Side effects of disallowing *.php requests in production environment?

For security in the production environment a company I work with has removed the whole wp-admin/ directory, and is about to disallow all *.php file calls with a 403 Forbidden HTTP error. Are there ...
0
votes
2answers
164 views

How to prevent plugins from sniffing/stealing other plugins' options?

Many plugins require configuration with sensitive data such as API keys, passwords, etc. When implementing these plugins, this sensitive data is stored using functions such as update_option() and ...
0
votes
1answer
268 views

Does using a custom query_var create a security hole?

Say I put the following code in functions.php function add_my_query_vars($qvars) { $qvars[] = "new_var"; return $qvars; } add_filter('query_vars', 'add_my_query_vars'); If somebody requests ...
0
votes
2answers
250 views

On new server, site got hacked, permissions a bit strange? Please help

I moved to a new server recently, a week later a site got hacked, all they did was change the index.php file of the current enabled theme, no big deal. I did have a few security precautions in place, ...
0
votes
2answers
282 views

How can I password protect a WordPress site without requiring users to log in?

I don't want people to have to log in, I just want to prompt them with a question and if they can answer it, they can access the site. All the solutions and plugins that I've found seem to be overkill ...
0
votes
2answers
1k views

Embed Wordpress Admin in an iframe

I am trying to embed the admin "new post" wordpress page into an iframe: `<iframe height="500px" frameborder="0" width="740px" src="my_wordpress_domain/wp-admin/post-new.php"/>` For some ...
0
votes
3answers
387 views

Spam injected in w3 total cache page cache

I'm trying to fix a site which has been injected with external spam. After inspection I found out that the external content (so far just html advertising different kinds of drugs, no scripts) was in ...
0
votes
1answer
93 views

Privilege escalation bugs in 2.9?

Are there any known privilege escalation bugs in WP 2.9 to be careful for?
0
votes
1answer
22 views

Secure my “add_settings_field” translation?

I am using "add_settings_field" and want to provide translation for it , but my problem is security. So is __('My Checbox:' , 'domain') secure enough for translation? If not what can I do about it? I ...
0
votes
1answer
31 views

Storing FTP details in wp-config.php

I'd like to hear about the security concerns for storing FTP details in wp-config.php on a shared server. It doesn't 'feel' safe to me. I'm using ManageWP to control sites on a shared server and have ...
0
votes
2answers
155 views

Tips for finding SPAM links injected into the_content

I'm working on a client's site and I noticed that posts have a hidden <div> filled to SPAM links to dick pills, etc. Hoping to get lucky, I searched for some of the keywords in the database ...
0
votes
1answer
42 views

Remove hacked code - out of ideas! [closed]

I've been working on a project which keeps getting some PHP inserted into the config.php file and it's causing a lot of issues with SEO. I'll paste in a sample of it (it's quite long) after this ...
0
votes
1answer
68 views

How do I determine if the user who registered is not spam?

I've recently set up a forum on my site with the bbpress-plugin. Now a user has registered on the site but the email-adress looks suspicious to me. How can I determine if the user is real? Is there a ...
0
votes
1answer
51 views

Hiding Media Source Links

I inserted an image onto my page from my WordPress media (Add Media -> Media Library -> Link To = None). However, when I right click on the page to view the source, I noticed the address to my media. ...
0
votes
1answer
27 views

Secret keys in SCM

I have a WordPress installation in a Git repository and I'm wondering, if it's safe to have the 8 "secret keys" stored in there, or if I should insert them during deploy.
0
votes
1answer
94 views

Selectively Disabling PHP via .htaccess in Root Directory

I'm reading up on securing WordPress and one of the commonly suggested techniques is to use an .htaccess file to disallow PHP execution in wp-content and wp-includes. I then read about another hack ...
0
votes
1answer
51 views

My website is getting too many dierect home arechives and this is increasing my bounce rate

My website is getting nearly 800 direct home archives daily, as a result the bounce rate of my website has increased. Usually i get only around 30 home archives a day These hits are not from Google, ...
0
votes
1answer
70 views

Form Post results in 404 Not Found [duplicate]

I am creating a POST-able form on the front-end of Wordpress (via a shortcode). If I submit this form without any input, the form submits fine. But as soon as I enter an data in the fields and POST ...
0
votes
1answer
48 views

How do I allow certain users to make a certain type of post?

Here's a brief summary of how my site is setup: I have a relatively simple Intranet site. Right now I am utilizing posts as a means to provide news to users. I am also using pages. I only want ...
0
votes
3answers
180 views

How to stop direct HTTP POST to a PHP script?

I have a form on my site, created using Contact Form 7 with Captcha. Contents of the form when POSTed are being sent to a PHP script, the "action" attribute of the form is set to ...
0
votes
1answer
341 views

Wordpress Security - How to block alternative Wordpress access

I own a self-hosted Wordpress 3.5 blog. I'm working on its security and I'm trying to prevent non-writers from accessing anything admin-ish they shouldn't. Recently I tried Better Wordpress Security, ...
0
votes
1answer
47 views

Is this plugin safe to run?

This is an extract of code from a wordpress plugin. Is it safe to run despite the variables not being filtered? Also does the wpdb class filter to prevent any injection? list($email_id, $user_id, ...
0
votes
2answers
410 views

Any known bugs that could cause disappearance of the wp_users table?

I administer a number of WordPress-powered web sites. One of these sites is new, and has been running untouched since it was set up a month ago. Today, I tried to log in, but was unable to do so - ...
0
votes
1answer
500 views

Something is unescaping all html entities before output to browser [closed]

I have a nasty problem. In my wordpress site something unescapes all html entities before sending data to the browser. It happens for all of the following cases: echo "&quot;XSS" print_r( ...
0
votes
1answer
98 views

Secure way to use name_save_pre?

I created a custom post where I need to change the post name regarding to the custom field and taxonomy values. This is how I did it: add_filter('name_save_pre', 'save_name'); function ...
0
votes
1answer
89 views

Why do people use “admin” username by default? [closed]

WordPress users use "admin" username by default to login to admin panel because WordPress suggest this username at the end off install. But "admin" username is the most common username to brute-force ...
0
votes
1answer
161 views

Spam in Wordpress root folder

Two questions in one. A php file was recently introduced in the root directory of my Wordpress installation (a domain installation). It didn't disturb my website but was apparently using the domain ...
0
votes
1answer
134 views

Contact Form Security

Building my own contact form in Wordpress. Any there any security steps I need to consider other than the typical email etc validation and maybe a captcha. I am not sending any data to the database.
0
votes
2answers
191 views

Is Wordpress secure enough for a multi-user article directory?

One of my friends is going to launch a small article directory (ex: http://ezinearticles.com/) using WP. The site will be hosted on a shared hosting in the beginning and will be moved to a dedicated ...
0
votes
2answers
126 views

Has anyone developed a anti-spam plugin to simply allow users to BLOCK whatever they wish to, but one that will also go easy on IP addresses?

I'm new here xD I'm thinking of developing a plugin to allow users to block ANY spammy traces (IPs, Email addresses, Website URLs, phone numbers, phrases, etc etc) from those evil spammers. BUT, ...
0
votes
2answers
39 views

I need to find which is the file that checks the DB for correct login (username, password)

I let users to register in my page, however I want to improve the password security that is saved in the DB. For this I need to find out which is the file that makes the query where pass=pass and ...
0
votes
1answer
412 views

Is the Block Bad Queries Plugin Still Relevant?

The Block Bad Queries Plugin hasn't been updated recently. Is WordPress still subject to these types of malicious attacks or has it been hardened sufficiently to make the plugin obsolete? Is there an ...
0
votes
1answer
134 views

Using password protection to load different page elements?

I have a page that is password protected, and I wish to removed some parts of the theme, and add others. Can I do that? Is there a check I can do in the theme files to see if a user has entered the ...
0
votes
2answers
791 views

Securing Contact Form 7

I have a client who's website I created with Wordpress. It has a contact form created with contact form 7. This client is a subsidiary of a larger organization who's IT department runs scans on their ...
0
votes
1answer
122 views

User generated content and security

I'm gonna create a new site. I want to make the site as user generate able content site. Basically this is my site's function. Users signup in my wordpress site, Submit content from wp-admin panel, ...
0
votes
2answers
1k views

Uploading .webm format on WordPress results in security guidline breach and fail

I cannot upload the .webm video format on WordPress. This is after adding: AddType video/webm .webm into both: my .htaccess file (on the root folder of the WordPress installation) the mime type ...
0
votes
1answer
210 views

Is there a way to hide WordPress behind a web visible directory?

Is there a way to hide WordPress behind a web visible directory for extra security using a symlink?
0
votes
1answer
103 views

Allowing Users to Register Themselves and Post : Does WordPerss Handle these Problems?

If one allows visitors of a WordPress blog to register themselves and post to the blog without moderation(i.e. without submit for review), malicious visitors may try to 1)Post a large number of posts ...
0
votes
3answers
389 views

WP Insert Post If user refreshes override new post

WP Insert Post is a very simple and easy to use function. Currently I have it set up on event triggered by whether a user is logged in during a booking to ratify their booking in its own page. My ...
0
votes
1answer
189 views

security concerns if using html data-* attribute for l10n?

I need to pass a localized multidimensional javascript object to a page. The object is constructed using php and represents some wp-theme settings. I cant find a way to utilize wp_localize_script for ...
0
votes
1answer
163 views

Secure Server after configuration

Recently I purchased a VPS from intovps.com, And first time I configured a fully unmanaged VPS through ssh comands. My website is working into it, properly. Now I just want to know how to secure it? ...
0
votes
1answer
367 views

404 errors when updating options in admin dashboard

Whenever I try to update my Permalink settings or use the Theme Editor to modify some file, I am redirected to a 404 page. This also happens when I update the All-In-One SEO Pack plugin's settings. ...