Strengthening themes, plugins and core installation to prevent intrusion.
0
votes
1answer
145 views
security concerns if using html data-* attribute for l10n?
I need to pass a localized multidimensional javascript object to a page. The object is constructed using php and represents some wp-theme settings. I cant find a way to utilize wp_localize_script for ...
0
votes
1answer
161 views
Secure Server after configuration
Recently I purchased a VPS from intovps.com, And first time I configured a fully unmanaged VPS through ssh comands.
My website is working into it, properly.
Now I just want to know how to secure it?
...
0
votes
1answer
293 views
404 errors when updating options in admin dashboard
Whenever I try to update my Permalink settings or use the Theme Editor to modify some file, I am redirected to a 404 page. This also happens when I update the All-In-One SEO Pack plugin's settings. ...
0
votes
0answers
45 views
Protect uploaded files in Wordpress 3.5 multisite
I have a multisite which I use for sharing private information (and files like pdf etc).
Each client has its own 'site' example.com/client1, example.com/client2 etc
I already set permissions to ...
0
votes
2answers
49 views
Password protect some uploaded files, so only logged-in users can view them
I would like to protect some uploaded files, so that they are not publicly accessible (they are not accessible without a login). I'm uploading some PDF files, and I'd like to mark some of them as ...
0
votes
2answers
38 views
WP Cron doesn't save <iframe> or <object> in post body
I am using wp_cron to auto grab posts from a remote website and save them in my wp db.
NOTICE! I am executing my code from my plugin, not from my template functions.php or somewhere else. I have my ...
0
votes
0answers
34 views
Core files changed - site hacked?
Got a WordFence alert last night for one of our WordPress sites, saying that some WordPress core files had been changed:
WordPress core file modified: wp-content/plugins/akismet/admin.php
WordPress ...
0
votes
1answer
47 views
How to protect wp-admin through .htaccess?
I'd like to protect the /wp-admin/ directory at the server level. This means two logins. One through the server and another through WordPress.
I believe this can be handled through .htaccess. Does ...
0
votes
0answers
91 views
Why does My WordPress site keep getting hacked? [closed]
Why does My WordPress site keep getting hacked?
I have made all of the changes I can according to WordPress's hardening documentation.
Each time, the administrative password is reset. How can that ...
0
votes
0answers
25 views
Is [admin / admin] acceptable for all local websites?
Are there security issues with using the same credentials [admin / admin] for all client websites on a working, local server ?
0
votes
0answers
15 views
Brute force attack - how to tell if site has been compromised? [duplicate]
What is the best way to check if a site has been compromised? I'm assuming an attacked site won't show any "symptoms", correct? I've checked a few FTP directories and haven't seen anything, what else ...
0
votes
0answers
111 views
wp-count.php injection [closed]
My site was infected by wp-count.php and wp-apps.php files.
It's been a year since this topic has been raised everywhere, but no solution so far? Is this really a WordPress vulnerability issue or a ...
0
votes
1answer
54 views
Trying to understand nature of hacking
Today we saw suddenly two files created in root folder in one of our wordpress websites - file name owp.php and gmail.html
On investigating the access logs following entries were found which seem to ...
0
votes
0answers
11 views
Security permissions on controls added under Page Option
I am a total wordpress n00b, and am having issues understanding how the page security is applied.
I have a page where I want to secure the content, so, in the page editor, I have ticked certain ...
0
votes
0answers
24 views
Page missing: tiger-m@te
I recently took a site live, installed WP Better Security, and noticed immediately that this site was facing a lot of hacking attempts.
About a day later I realized that one of the pages refuses to ...
0
votes
1answer
61 views
If I use an alternative login (e.g. CAS or other SSO) plugin, is my site protected from the recent brute force login attempts?
I've been hearing about the recent increase in brute-force WordPress login attempts due to a massive botnet attack. Everything I've read so far indicates that the attack works by just trying different ...
0
votes
0answers
88 views
Prevent PHP execution via htaccess but disables thesis theme?
So I'm trying to secure my wordpress site because it's been infected multiple times with malware. One of the suggested steps is to basically prevent php execution in the wp-content directory via ...
0
votes
0answers
54 views
Insecure content loading on a secured site, how to force https?
I have a seemingly odd issue where when logged in as an admin on a site I can load all content and assets just fine. When I logout to view the site entirely as a user would see it, the html content ...
0
votes
1answer
66 views
Data Validation, dynamically generated fields (select for example)
Working to secure my plugin, I'm not sure what (if anything) to do about output such as dynamically generated select fields. For example, I have a country code select generated on the backend via PHP ...
0
votes
1answer
75 views
Is it safe use wp_editor in public contact form
I'm going to make a contact form for my site, and i want to use WYSIWYG editor (wp_editor) in my form message field.
Here is my question, is that safe use wp_editor in public though disable media ...
0
votes
1answer
65 views
force login loophole
I want to restrict access to my wordpress site to allow registered users only. I have tried the following plugins:
Require-login
Authenticator
WP-lock
All of them have the same problem: After ...
0
votes
2answers
83 views
File permissions for wp-minify plugin
I am worried on installing Wp-Minify plugin. But it needs 777 permission for the cache directory located inside wp-uploads directory. Isn't it a security issue?
0
votes
1answer
47 views
When not to use Wordpress? [closed]
I have a project that I would like to do in WP, but can't really decide if it's the correct CMS or not.
Among the thing it is suppose to do is and I'm struggling with are:
Create Report/Publication ...
0
votes
0answers
33 views
How to make wordpress as a provate membership site? [closed]
can you help me how to create a stockiest/dealer website.
This site is not for public, is will be a membership site for reseller.
Reseller can see stock of products.
Administrator can change ...
0
votes
1answer
56 views
How 'secure' are loops?
I am using loops as means of displaying personal meta and customer information on the frontend.
For example, I have a page which displays a user's 'profile' information to edit. Their profile is ...
0
votes
0answers
50 views
How should I debug this spam? [closed]
I manage a large news site powered by Wordpress. Recently, when visitors go to the site, they are redirected to very sketchy pages as this picture shows (The URL redirected to could differ every ...
0
votes
0answers
24 views
Hiding Wordpress version and directory information [duplicate]
Possible Duplicate:
Steps to Take to Hide the Fact a Site is Using WordPress?
Is it possible to secure WP information and stop version numbers and location of theme directories being picked ...
0
votes
0answers
58 views
Htaccess rule doesn`t work [closed]
I have .htacces in a root of site. And I wrote this rule to file:
<files .htaccess>
Order allow,deny
Deny from all
</files>
But i still see content of my .htaccess file in ...
0
votes
1answer
74 views
Basic File/Post restriction plugin
I am looking for a plugin that allows me to restrict access for a individual post/page to a specific role or individual. It also needs to restrict files attached to that post. I have tried several ...
0
votes
1answer
75 views
WorldPress Site got lots of spam links [closed]
Recently my wordpress website has got a lot of spam links. Google has indexed a lot of spam links from my website. The links are like:
http://example.com/viagra-buy.html
I found out that my ...
0
votes
1answer
718 views
Problem with permissions in wp-content/plugins
I have a WP installation on my local machine and trying to get my hands dirty with plugins. I wish to clone a project from github which has this plugin code. However, i dont have the permissions ...
0
votes
2answers
99 views
WordPress Didn't like the site move? [closed]
I have a site that has been dropped on my lap and it currently has some WordPress issues. The site can longer auto update, and complains about paths when I try to update a plugin:
Unable to locate ...
0
votes
1answer
64 views
wp-docs folder - can I delete it and is is a security hole? [closed]
I have recently installed a new 3.2.1 version of WP and I have come across the wp-docs folder.
It contains some HTML documents about multi-site set-up and licence information etc.
I have turned off ...
0
votes
3answers
583 views
Securing Contact Form 7
I have a client who's website I created with Wordpress. It has a contact form created with contact form 7. This client is a subsidiary of a larger organization who's IT department runs scans on their ...
0
votes
0answers
83 views
Wordpress and login security?
Can and does Wordpress tell me if I am logged in on another machine?
Does it store login IP addresses?
0
votes
2answers
284 views
Is WordPress MultiSite secure & how much can it scale? [closed]
Great info on How to Scale Wordpress and more info on Wordpress Web Hosting. Still, I am left with questions.
Creating a project that for the sake of argument we will call a blog network. A user ...
-1
votes
3answers
638 views
Wordpress Hacks/Defacing [closed]
Im trying to figure out how Wordpress sites become defaced/hacked. I know development very well. I know how to secure code, etc. But I am finding recently, that tons of Wordpress sites are becoming ...
-1
votes
1answer
2k views
How to secure WordPress XMLRPC?
XMLRPC is great for remote publishing to WordPress, but there has been many security issues attributed to it. How do it make it more secure?
More specifically, only user from the intranet will be ...
-1
votes
2answers
388 views
What do spammers gain by signing up as a user?
The majority of new user signups I receive on my Wordpress blog look dodgy, with @someblog.com, @somearticle.com, or @gmail.com addresses.
What do they gain by signing up as a new user?
-1
votes
3answers
2k views
How to remove “Connection Information” requirement on localhost install of WP on MACOSX
I've just installed XAMPP on Mac OSX and when trying to install a theme or plugin in WP admin, I'm getting this screen. I've never gotten this on my shared hosting account. how to get rid of it on ...
-1
votes
2answers
358 views
How to improve WordPress security by hiding non public facing files?
e.g.
curl -I http://ma.tt/blog/wp-config.php
200 OK
The wp-config.php is not public facing file, since it currently just return blank page, so why not return 404 instead. (so will not be cached by ...
-1
votes
1answer
293 views
suspicious boolean.php file in wp web root [closed]
Today I noticed in my web root a suspicious php file: boolian.php and serveral .html files with random names, all containing trojans.
I remember yesterday I just uploaded and activated few themes I ...
-1
votes
1answer
131 views
Will my Wordpress site become vulnerable after adding this functions which allows more HTML tags for subscribers?
I was thinking of adding the following lines of code to my functions.php file:
/**
* Change the default list of allowed html tags
*/
add_action('init', 'edittag', 10);
function edittag() {
...
-1
votes
1answer
274 views
How to protect wp-admin from third party access?
How can the wordpress administration panel and the login page wp-login.php be hidden such that only the website administrator can access it? Can the URL be rewritten through some mod_rewrite rule ...
-1
votes
0answers
48 views
Unauthorized administrator accounts [closed]
I realized that a weird name-less account appeared in the admin group. I identified this as I realized that some spam user accounts were being generated.
The user ID for these is 1001001 (with ...
-1
votes
1answer
83 views
Overwhelming code injection [closed]
My WP site was plagued with code injection such as this:
68c8c7
echo "
asgq=[0x28,0x66,0x75,0x6e,0x63,0x7d, .......
...
-1
votes
1answer
95 views
FERPA Security and Gravity Forms [closed]
I have a bit of a new question that I haven't seen talked about anywhere.
I made a website for a school who has a Gravity Form setup on the site that collects students names. Recently this school ...
-1
votes
1answer
111 views
Default installation permissions for wp-config.php
Recently I've noticed that many of the wordpress installations we have on our servers where being attacked and ifected by this thing
...
-1
votes
1answer
30 views
How To Secure Word Press? [closed]
I am working in web hosting company so my job is to fix clients problem, one of the biggest problem we are facing right now is that our only word press customer site got hacked 'not one all of them', ...
-1
votes
2answers
496 views
How can I build an e-commerce website with wordpress for selling services? [closed]
If that is possible, I would want my site to be the safest possible and most secure when it comes to online monetary transactions. is that possible with wordpress? Also, are there any good themes ...
