Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

1
vote
1answer
27 views

Failed login attempts

I'm using WordFence for site monitoring and overall security. I'm seeing some failed login attempts from a couple of different locations with username "admin" and "companyname". I'm not familiar with ...
1
vote
1answer
24 views

Using Contact Forms to Send Private Information [closed]

I am working on a site for a Doctors Office who wants to use a contact form to send information about their patients to other offices....I was going to use contact form 7 but I'm wondering if there is ...
1
vote
0answers
68 views

What securtity plugin should I use [closed]

I have more WordPress sites, and some of them has been hacked a several times. After that they send spam messages, what is very annoying :S I decided I will use some security plugin and I wanted to ...
1
vote
1answer
36 views

Is it important to sanitize inputs in a shortcode that will be used in site that only I will post to?

Is there any security risk in not sanitizing shortcodes in a wordpress site if I am the only one who has access to the admin panel?
1
vote
1answer
64 views

Is it safe to allow non-admin users access to media uploader

Hi fellow Wordpress users :) I wanted to ask is it safe to allow non-admin users access to WordPress media uploader. Can they inject a virus while uploading media? How is WP system fighting against ...
1
vote
0answers
116 views

How do I get around “Sorry, this file type is not permitted for security reasons”?

I was wondering how I could allow .tiff files to be uploaded in my wordpress site. I get the message "Sorry this file type is not permitted for security reasons". This question has been asked in ...
1
vote
0answers
67 views

How to allow internal links using wp_kses filtration

I'm working on front end submission and of course I want to secure data by filtering before inserting to database. The form contains repeatable fields group data which I want filter by wp_kses ...
1
vote
0answers
189 views

How to escape custom css?

I'm creating a WordPress theme in which I've allowed users to add some custom css from the Theme Options. This css code then directly gets echoed out in the head section of the page, with the ...
1
vote
0answers
44 views

Securing a multi-user permission structure

I'm currently working on a team that needs two distinct users from the same wpadmin group to be able to modify the wordpress files. Following the guide at Hardening WordPress (Codex), the following ...
1
vote
2answers
196 views

How to hide easy access to my website temporarily?

I am developing a new website and I do not want others, except for my colleagues, to access it easily. I don't want it to be password protected because my colleagues are testing it intensively. Is ...
1
vote
0answers
220 views

Renaming admin user on multisite install by MySQL

As part of a general tightening of security, I want to change the name of the admin user on my multisite install to something less commonly used. This user is admin on all five sites in the network ...
1
vote
1answer
32 views

Is it safe to hand over the admin rights?

I have a shared web hosting account where I have several different websites running on WordPress. I want to hand over the admin rights for one of my WordPress installs to someone and I am wondering ...
1
vote
0answers
222 views

Can I Remove xmlrpc.php completely?

My site is getting a lot of malicious traffic to domain.com/xmlrpc.php, to the point that the server is not being able to handle it. I tried to disable it via the wp-config.php, by adding this line: ...
1
vote
1answer
319 views

Using esc_html with HTML purifier and CSSTidy: Overkill?

Currently my text area input (which accepts custom CSS input from a user) in the Wordpress theme options panel are sanitized by esc_html function in Wordpress ...
1
vote
1answer
173 views

How can I secure a WordPress blog using OpenID from a single provider?

We're about to launch an internal blog for the company I work at. Much of the blog will be available to the public, but certain posts will be for employees only. Our intranet/extranet has an OpenID ...
1
vote
1answer
2k views

Disable directory browsing of uploads folder

I'm using Wordpress as a CMS for a simple website. I want to prevent users from being able to browse the directories such as the wp-content/uploads folder or any directories of my theme. My host does ...
1
vote
0answers
667 views

Security - Ajax and Nonce use [closed]

I'm developing a site which posts a number of ajax calls from jquery to PHP and returns data from PhP to jquery. Everything is working, but i'd to know if my approach to handling the calls is ok, in ...
1
vote
1answer
120 views

using rewrites to secure login page

I'm trying to be sneaky with iis to secure a wordpress login page (not my choice to run a windows server, but that's the reality of things). It's worked so far, only the login page itself loads itself ...
1
vote
0answers
86 views

Are un-sanitized theme options more vulnerable to malicious scripts than the theme editor?

I'd like to put text areas in a theme options area to allow users to easily add analytics code, scripts, and css. Is it silly to worry about malicious code being inserted via un-sanitized theme ...
1
vote
0answers
65 views

Network Admin URL is shown to anyone before accessing a blog

I have a multisite setup and I noticed today that my security was not working properly. Each of my blogs has its own url : http://www.example1.com http://www.example2.com … My "main blog" is not ...
1
vote
1answer
32 views

correct tags for validating input types

I have following types of theme options inputs, which I need to validate. $numbers = "#1234"; $email = "abc@example.com"; $simeple_text = "How's going?"; $code = "<script ...
1
vote
1answer
603 views

Is disabling test_form in wp_handle_upload a security concern?

I'm writing a plugin that modifies the default behavior when uploading a file for a post or to the media library. I'm setting $overrides in wp_handle_upload() with a custom $unique_filename_callback. ...
1
vote
2answers
424 views

Restrict Access in Admin Panel

I want to restrict access to certain plugin pages / normal WP Pages. I've found a way to Hide these pages from the menu but currently not restrict them. For instance, I have an editor and I don't want ...
1
vote
2answers
517 views

Is WordPress MultiSite secure & how much can it scale? [closed]

Great info on How to Scale Wordpress and more info on Wordpress Web Hosting. Still, I am left with questions. Creating a project that for the sake of argument we will call a blog network. A user ...
0
votes
5answers
369 views

Prevent Brute Force Attack

I already used Limit Login Attempts wordpress plugin. Are there other ways to prevent brute force attacks? I'm worried because I saw a lot of locked out.
0
votes
2answers
50 views

Is it good security advice to install wordpress in subdirectory but link to root?

Is it good to install wordpress in a subdirectory (with a random name), but set "Homepage" address to domain root? (based on Giving WordPress Its Own Directory) Since the wp-content is in the ...
0
votes
1answer
156 views

Admin can enter JavaScript - potential security risk?

WP 3.5/TwentyTwelve/Clean install. I try this when login as admin and editor. I try add reply for first post "Hello World": <script>alert('XSS')</script><script><</script> ...
0
votes
2answers
77 views

Which Versions of WordPress Ship with the Patched TimThumb?

Do you recall when the TimThumb exploit occurred? Which versions of WordPress bundled with this exploit? I need to inform a client that they should be upgrading to at least the version of WP when this ...
0
votes
1answer
32 views

Safe to say WordPress security releases don't have database upgrades

Since all security releases are based on last released codebase + security patch, I think its safe to say WordPress security releases don't have database upgrades, but I figured I will ask my fellow ...
0
votes
1answer
159 views

Secure Wordpress: Change admin

I'm sorry if this is an extremely stupid question. I've been looking for ways how to secure my WP and a lot of websites suggest to create a new admin user account and delete the old one. Now, if I ...
0
votes
1answer
46 views

How many security plugins are too many? [closed]

I currently have three security plugins installed on WordPress, one of them I have a paid subscription to. Do you think this is overkill? I took a lot of steps to secure my WP site, and I'm worried ...
0
votes
2answers
32 views

Changing the default header name

Is it possible to change the default header.php file to something else for security reasons? It seems header.php is target for malicious attacks. I know all that, we have different named headers, I ...
0
votes
3answers
2k views

How to control who can view certain pages in BuddyPress? [closed]

I would like to control who can see a page in BuddyPress and restrict anyone else from accessing it. Something along the lines of the following pseudocode: <?php if ( loggedin_user_ids==1,4,5,7 ) ...
0
votes
3answers
3k views

How to secure WordPress XMLRPC?

XMLRPC is great for remote publishing to WordPress, but there has been many security issues attributed to it. How do it make it more secure? More specifically, only user from the intranet will be ...
0
votes
1answer
538 views

How much should I worry about these messages?

I received about 50 messages today with the similar message: WordPress Firewall has detected and blocked a potential attack! Web Page: ...
0
votes
2answers
864 views

What do spammers gain by signing up as a user?

The majority of new user signups I receive on my Wordpress blog look dodgy, with @someblog.com, @somearticle.com, or @gmail.com addresses. What do they gain by signing up as a new user?
0
votes
1answer
517 views

Does WP show me if I'm logged in from multiple locations?

Does word press show me if I'm logged in in another location? Related: Limiting sessions to one IP at a time
0
votes
2answers
82 views

Is that a malicious code?

Recently I have downloaded a wordpress theme . I use Theme Authenticity Checker (TAC) (http://wordpress.org/plugins/tac/) plugin to find any malicious data . According to it's report the theme ...
0
votes
1answer
71 views

Security and Must Use Plugins

From the codex article on Must Use Plugins: Can be enabled simply by uploading file to the mu-plugins directory, without having to log-in This feels like a potential security problem to me. ...
0
votes
2answers
133 views

How can I tell who changed the password?

We recently had an employee leave our company. When they left, I changed all their passwords and removed their email access etc. I also changed the password on our Wordpress site for the Admin ...
0
votes
2answers
564 views

Wordfence detects change in wp-admin/includes/upgrade.php

I moved my site from hosting provider A and domain name B to hosting provider X and domain name Y. I had Wordfence in the old site. I just installed it in the new site and ran a scan. Wordfence found ...
0
votes
2answers
39 views

Separate Out Real Users

If I look at /wp-admin/users.php I see all the users, but some have given a bogus email and never used their password. Is there some way to see who has used their password at least once? If not, ...
0
votes
1answer
77 views

Security to delete post by Admin

My code is so simple like when admin delete a post by Wordpress fucntion (PHP) and do action with jQuery <?php include('../../../../../../wp-config.php'); if(current_user_can('edit_posts')){ $id = ...
0
votes
1answer
757 views

Basic password protection without using users and roles

I'm using WooCommerce, and want to be able to password protect products (or preferably whole categories if possible), but without using the Users & Roles functionality build into WP(because I need ...
0
votes
1answer
2k views

wp_insert_post disable HTML filter

I have input value "<iframe>....</iframe>" (param 'post_content'). When i execute wp_insert_post, function cut off my tag. How to disable HTML filter in wp_insert_post ?
0
votes
1answer
962 views

Do I need to sanitize Wordpress search query?

I submit search data to custom page searchi.php <?php // $search_variables = $_GET['s']. '+' .$_GET['cat']; //This sends http post to url without curl header("Status: 301 Moved ...
0
votes
2answers
1k views

Is Timthumb still broken? What security measures should be taken?

A client has requested we use a theme, and that theme has a Timthumb dependency. I know that there has been some serious vulnerabilities in the past, but what is the current state of that plugin? ...
0
votes
1answer
229 views

Renaming wp-admin without hard-coding it. Is it really possible?

I would like to rename my wp-admin folder due to some security concerns. Is it really possible? The less it looks/is built like default WP, the harder it is to attack known vulnerabilities. Being ...
0
votes
2answers
47 views

What can I do when an outside party hacks into my weblog and changes my display name?

Last night I wrote a mildly controversial blog post about religion on my weblog, and this morning I woke up to find that my display name had been changed to the name of a fanatic religious leader. The ...
0
votes
2answers
52 views

Wordpress login security

I have put up a logging script on my wp-login page. I noticed that a particular ip address- 193.176.147.7 has been consistently visiting my login page for some days now. The vitis are always in quick ...