Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

1
vote
1answer
36 views

<meta name=“generator” content=“WordPress 4.4.2” /> neccessary?

Hello fellow WordPressers Today, I realized that most WordPress sites have this small footprint saying: <meta name="generator" content="WordPress 4.4.2" /> where it indicates what "system" ...
1
vote
1answer
33 views

How Restrict access to admin dashboard by specific static ip?

i'm trying to restrict access to admin dashboard (wp-admin.php) by specific static ip so tried to add .htaccess to the wp-admin and set <FilesMatch "admin\.php$"> Order deny,allow Deny from ...
1
vote
2answers
64 views

Developing a secure front end post editing form

I want to add a front end post editing functionality to one of my Wordpress sites. I found a few plugins that do this, but they don't fits all my needs, so I decided to adapt an existing solution to ...
1
vote
2answers
130 views

Changing Table Prefix for an Existing WordPresss Site

Hoping someone can assist with Wordpress table prefix for an already established site. What is the best approach in changing the existing table prefix within both DB and wp-config file to reflect new ...
1
vote
1answer
68 views

Registration Plugin - Recaptcha integration

Good Day Everyone, I'm currently writing a new plugin for Registration, I intend to actually share that Registration Plugin, but I would like to integrate reCaptcha into it. From what I understood ...
1
vote
1answer
285 views

Evaluations of two wordpress security plans against php code injection attack

Senario: I've posted one wordpress php code injection senario on SO before, ...
1
vote
1answer
175 views

Form Post results in 404 Not Found [duplicate]

I am creating a POST-able form on the front-end of Wordpress (via a shortcode). If I submit this form without any input, the form submits fine. But as soon as I enter an data in the fields and POST ...
1
vote
2answers
358 views

Is Wordpress vulnerable to “comment posting forgery”?

I recently scanned my Wordpress site using 6scan's security scanning service. It reported a high severity vulnerability: "Wordpress comment posting forgery". Technical details from 6scan: The ...
1
vote
1answer
592 views

Wordpress Security - How to block alternative Wordpress access

I own a self-hosted Wordpress 3.5 blog. I'm working on its security and I'm trying to prevent non-writers from accessing anything admin-ish they shouldn't. Recently I tried Better Wordpress Security, ...
1
vote
2answers
72 views

What permissions should I give directories if I want to make WordPress more secure?

A follow up to a previous question found here How can I lock down an old wordpress install I don't intend to update? Same info still stands. WordPress install will (probably) not be updated. ...
1
vote
1answer
69 views

Protect HTML in Comment

In wordpress comments system, it work HTML. I want to protect inserting HTML in wordpress comment system.
1
vote
2answers
777 views

How can I make uploaded images in the editor load with HTTPS?

I have the admin section of my site using HTTPS. This works pretty well except that the images inside the TinyMCE editor (the post and page rich text editor) load with http instead of https and so I ...
1
vote
1answer
566 views

Protecting Wordpress login page

How can i do this: Whenever visitors open the login page (wp-login.php), they will be redirected to the mainpage. Only the admin (me) can view the page to login. I am doing this to protect my wp ...
1
vote
1answer
182 views

Using HTACCESS for Secret Access

I saw this post yesterday http://digwp.com/2011/01/simpler-login-url/ where a 'custom' word is used to direct the user from url.com/admin to url.com/wp-login.php and I'm asking (also did so in the ...
1
vote
1answer
28 views

Verify if user is wordpress logged in from another app since wordpress 4.0

I try to implement in my Node.js app a way to verify if the user cookie is valid. I've found some post in internet who explain me very well the things, but as i try to implement it, with the ...
1
vote
1answer
31 views

Using esc_url with a hard coded url

I've added following URL in my theme, but I have been informed that I must use esc_url(). I could not figure out, how can I use that function with following code? <a ...
1
vote
1answer
19 views

Handling email piping attachments and detecting unsupported file types

I have a plugin that I am working on which uses Email Piping. When an email is processed I want all the attachments from the email to be added to the WordPress Media Library. Currently I am using ...
1
vote
1answer
64 views

How to delete Passwrd Protected posts cookies when a user logged out from the site

I wanted to delete all the cookies set for password protected posts when user logged out from the site after going through those Password protected posts. Is there any function to do this?
1
vote
1answer
210 views

Moving away from MD5: Where to declare the custom global $wp_hasher?

I want to move away from using MD5 for hashing passwords in the database. The plan is to declare a custom global $wp_hasher as hinted at in the docs for wp hash password(): Unless the global ...
1
vote
2answers
44 views

Would it be dangerous to send all the wp_options to javascript file?

I've noticed that wordpress allows me to send the wordpress options to javascript via wp_localize_script: wp_localize_script( $this->plugin_slug . '-plugin-script', 'wp_options', ...
1
vote
1answer
407 views

How can I safely use $_SERVER['REQUEST_URI'] to avoid XSS?

I've seen a lot of warnings about using $_SERVER['REQUEST_URI'] because it can open things up to XSS, but I haven't been able to find anything confirming a safe way to use it. Some people have ...
1
vote
1answer
44 views

Restrict custom post type from appearing with ?post_types=

When appending the querystring post_types = "name of your post type", it displays all the posts. I am using a plugin that has its own custom post type which is restricted (only users that have ...
1
vote
1answer
134 views

Is there a way to create a URL (new WP page) that can only be accessed from a specific source?

To explain further, here's what I"m looking to do: Create a WP page Use the URL and implement it in a reader service that is hosted (not downloadable) that in order to read (& access the URL) ...
1
vote
2answers
46 views

Secure Pages Best Practice

I am in process of writing a plugin that has front-end shortcodes that display a user's information/data. If the user is not logged in, I need to redirect to a front-end login page/form. What would ...
1
vote
2answers
84 views

How to protect wp-admin through .htaccess?

I'd like to protect the /wp-admin/ directory at the server level. This means two logins. One through the server and another through WordPress. I believe this can be handled through .htaccess. Does ...
1
vote
1answer
59 views

About WordPress site security

If I install WordPress on my server, does it mean that Akismet is installed automatically? If so - do I still need to create e-mail verification and captcha tools for improving site security (as I see ...
1
vote
3answers
753 views

Simple Online Payment for Event Registration [closed]

I am looking for a simple (and secure) way to accept payment for event registration. I am managing a Wordpress website for a organization that hosts events throughout the year. A handful of these ...
1
vote
1answer
443 views

How to expire all wordpress user passwords instantly?

So I own an article directory website and recently a lot of bots have signed up and started posting spam. (I approve posts prior to publication) I've added a captcha to the user registration page now ...
1
vote
3answers
5k views

Protecting HTML5 video [closed]

I shall explain my situation as best I can so you can see where i'm coming from. I'm working on a wordpress site for a sports team, there are loads of teams. We want to put coaching sessions on our ...
1
vote
1answer
8k views

Change WP-Login or WP-Admin

Can I change the name of the wp-login or wp-admin file so that I can go to a different filename in order to login. I am trying to prevent hackers from finding my login and wp-login has become a very ...
1
vote
1answer
65 views

Does WordPress validate inputs to all functions? (such as get_user_meta and insert_user_meta)

Does WordPress validate inputs made to all built-in functions that access the database to protect against SQL injection vulnerabilities or do we have to validate before passing them?
1
vote
1answer
291 views

Detect session/cookie variable in wordpress to prevent access to documents

<?php @session_start(); If (!array_key_exists(‘authed’, $_SESSION)) { include ‘not_authed.inc’; exit(); } // go about your business. ?> and i'm trying to add that to this: ...
1
vote
2answers
148 views

What may be causing failure of auto-install features in Wordpress (v3.0.3)?

What may be causing the installation errors I continue to get when trying to auto update anything in Wordpress? I've been manually upgrading everything for quite some time, and I've tried all sorts ...
1
vote
2answers
1k views

Best practices for securing a Buddypress installation?

A client of mine runs a Buddypress-based site (BP 1.2.6 on WP 3.0.2). We'd like to give users the ability to publish blogs of their own, but we don't want them to be able to execute PHP code (we make ...
1
vote
2answers
115 views

Upgraded to latest version - 3.0.3 and Now I get a “sufficient permissions to access this page” error

The issue appeared immediately after upgrade. The only part of the application impacted is the sub-menu items under settings where it relates to a plug-in. The core application settings work, just ...
1
vote
0answers
19 views

How do I authenticate WP users from a chrome extension?

I'm new to WordPress, and I need help. I am writing a chrome extension and intend to use wordpress as the user database. I intend that because I'm using a subscription management WP plugin that keeps ...
1
vote
0answers
13 views

Are there security risks in working directly in the themes folder that builds into a theme folder?

I'm wondering if there are any security risks in using the wp-content/themes/ folder as my project root and using wp-content/themes/my-theme as my build folder. Basically, in the themes folder I would ...
1
vote
1answer
30 views

Frontend Password change

First off, I apologize if there is a duplicate of this roaming around somewhere...I have spent the better part of the past hour looking for the solution, with no luck, but maybe I just suck at picking ...
1
vote
1answer
152 views

Security issues with WP sites

I have just had to deal with a few of my WordPress websites being hacked. First time put an index.html file in the cpanel of each site and replenished my admin user. Once I felt I cleaned this up, ...
1
vote
2answers
84 views

site get login attempts after htaccess ip restriction

I'm using a security plugin that keep sending me emails: "A lockdown event has occurred due to too many failed login attempts or invalid username: Username: Admin IP Address: 195.154.243.31 IP ...
1
vote
0answers
21 views

Hacked site is now Generating Users..What can we do? [closed]

Our site is hacked and auto-registering 1 new user/3min. What we did so far : 1- Added Captcha on all the registration pages 2- Changed the superAdmin pswd 3- upgraded WP to 4.4 4- upgraded all ...
1
vote
0answers
31 views

Underscore Based Theme File Permissions in Git

I'm using underscores to develop my theme. For some reason git is saying that my file permissions are being changed from 10644 to 10744. I can override this in git's settings this but is it safe for ...
1
vote
0answers
232 views

How does the “authentication unique keys and salts” feature work?

I'm trying to find some information on how the authentication keys and salts work in WordPress, but unfortunately I wasn't able to find anything useful. All I got is that the keys should be random, ...
1
vote
0answers
185 views

Hide username discovery

How do I stop my usernames being leaked? To explain I tested my WordPress site on http://wprecon.com, and found that my admin username (that I have changed) was able to be discovered. User ...
1
vote
1answer
51 views

Failed login attempts

I'm using WordFence for site monitoring and overall security. I'm seeing some failed login attempts from a couple of different locations with username "admin" and "companyname". I'm not familiar with ...
1
vote
1answer
36 views

Using Contact Forms to Send Private Information [closed]

I am working on a site for a Doctors Office who wants to use a contact form to send information about their patients to other offices....I was going to use contact form 7 but I'm wondering if there is ...
1
vote
0answers
139 views

What securtity plugin should I use [closed]

I have more WordPress sites, and some of them has been hacked a several times. After that they send spam messages, what is very annoying :S I decided I will use some security plugin and I wanted to ...
1
vote
1answer
81 views

Is it important to sanitize inputs in a shortcode that will be used in site that only I will post to?

Is there any security risk in not sanitizing shortcodes in a wordpress site if I am the only one who has access to the admin panel?
1
vote
1answer
92 views

Is it safe to allow non-admin users access to media uploader

Hi fellow Wordpress users :) I wanted to ask is it safe to allow non-admin users access to WordPress media uploader. Can they inject a virus while uploading media? How is WP system fighting against ...
1
vote
0answers
193 views

How do I get around “Sorry, this file type is not permitted for security reasons”?

I was wondering how I could allow .tiff files to be uploaded in my wordpress site. I get the message "Sorry this file type is not permitted for security reasons". This question has been asked in ...