Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

0
votes
2answers
38 views

Separate Out Real Users

If I look at /wp-admin/users.php I see all the users, but some have given a bogus email and never used their password. Is there some way to see who has used their password at least once? If not, ...
0
votes
1answer
73 views

Security to delete post by Admin

My code is so simple like when admin delete a post by Wordpress fucntion (PHP) and do action with jQuery <?php include('../../../../../../wp-config.php'); if(current_user_can('edit_posts')){ $id = ...
0
votes
1answer
513 views

Basic password protection without using users and roles

I'm using WooCommerce, and want to be able to password protect products (or preferably whole categories if possible), but without using the Users & Roles functionality build into WP(because I need ...
0
votes
2answers
1k views

Is Timthumb still broken? What security measures should be taken?

A client has requested we use a theme, and that theme has a Timthumb dependency. I know that there has been some serious vulnerabilities in the past, but what is the current state of that plugin? ...
0
votes
2answers
3k views

Protecting HTML5 video

I shall explain my situation as best I can so you can see where i'm coming from. I'm working on a wordpress site for a sports team, there are loads of teams. We want to put coaching sessions on our ...
0
votes
1answer
220 views

Renaming wp-admin without hard-coding it. Is it really possible?

I would like to rename my wp-admin folder due to some security concerns. Is it really possible? The less it looks/is built like default WP, the harder it is to attack known vulnerabilities. Being ...
0
votes
2answers
42 views

What can I do when an outside party hacks into my weblog and changes my display name?

Last night I wrote a mildly controversial blog post about religion on my weblog, and this morning I woke up to find that my display name had been changed to the name of a fanatic religious leader. The ...
0
votes
1answer
28 views

wordpress admin security

I scan my website using different tool but it shows no malicious script. But when i see in admin dashboard i see strange symbol square below body tag. i tried to check admin index file,root index ...
0
votes
2answers
32 views

How to give the same error message when the wrong password or wrong username is used?

For security reasons, my WordPress instance should give the same error message when an incorrect password or wrong username is used. How can it be done?
0
votes
1answer
47 views

Specific way to allow Wordpress users to view their current password? And edit it?

I know the built in user manager doesn't allow a user to see what her current pass is, just recover / reset it via email or write in a new one in the admin but I am looking for a plugin or other ...
0
votes
3answers
49 views

Do we need to escape data that we receive from theme options?

I'm creating a Wordpress theme that I'm hoping to sell on Themeforest. Now I know much about escaping user inputted data using functions like esc_html, esc_url and so on and I use them in the comments ...
0
votes
1answer
44 views

Why do Metabox use Nonces?

Why is it advised for admin panel metaboxes to use nonces? Every example I see of creation and saving metabox data there are nonces involved but aren't nonces a bit unnecessary in this case?
0
votes
1answer
79 views

Can a WordPress administrator see other users' passwords?

Of course, an administrator in WordPress can reset other users' passwords (including that of other administrators). However, can a WordPress administrator see other users' passwords? Phrased ...
0
votes
1answer
55 views

Security and Must Use Plugins

From the codex article on Must Use Plugins: Can be enabled simply by uploading file to the mu-plugins directory, without having to log-in This feels like a potential security problem to me. ...
0
votes
3answers
89 views

Why my plugins are updating automatically?

I have a wordpress site with a few plugins. I had to make some custom changes on a plugin (not a best practice), and of course I don't want to update that plugin. But for some reason all my plugins ...
0
votes
1answer
62 views

Why does WordPress change a file's permissions?

If I set the permissions to the CSS file in my theme to 444 and then attempt to edit it in the Appearance Editor, WordPress is not prevented from editing the file and in fact change the permissions to ...
0
votes
1answer
155 views

Wordpress built in custom fields don't validate or sanitize? Is there a way to fix this?

I'm surprised to see that when creating post meta using the default/built in custom fields on the post editor page it allows you to enter tags like: <a>,<script>,etc. I then ...
0
votes
1answer
678 views

Changing admin user id for database

Is it correct or ok to change default admin user id from 1 to any other number as done by better-wp-security plugin for wordpress for better security? what is best way for admin security. Thanks
0
votes
2answers
775 views

Too many login attempts

Since a week or two I keep receiving the following automatic email message sent from my WordPress website, and I'd like to know if it indicates any security hole and if there's anything I can do to ...
0
votes
1answer
131 views

Auto log in hook is requiring a page refresh

I have a simple auto log in hook that looks like the following: function auto_login() { if (!is_user_logged_in()) { //Removed some code for brevity. $user = ...
0
votes
1answer
99 views

security issue in wordpress?

I have installed wordpress in www.mysite.com/user and now suppose if someone is familiare with wordpress he/she can easily access my stuffs through www.mysite.com/user/members ...
0
votes
1answer
1k views

wp_insert_post disable HTML filter

I have input value "<iframe>....</iframe>" (param 'post_content'). When i execute wp_insert_post, function cut off my tag. How to disable HTML filter in wp_insert_post ?
0
votes
1answer
69 views

Wordpress custom admin functions security

i have a case in my admin panel where i need to call my own function that resides in my own php file, with a GET request. This function is actually removing entries from the database. So, i would ...
0
votes
1answer
544 views

Do I need to sanitize Wordpress search query?

I submit search data to custom page searchi.php <?php // $search_variables = $_GET['s']. '+' .$_GET['cat']; //This sends http post to url without curl header("Status: 301 Moved ...
0
votes
1answer
54 views

Is there any pre-existing plugin to track and block IPs with suspicious activity on my site?

The image below shows a recent (failed) attempt to crack my Wordpress install. It's easy for me to look at that and see what they were doing, but is there a plugin that exists that monitors this data ...
0
votes
2answers
3k views

Password protect a specific category page/post

I have searched high and low for this but nothing is sticking out at me. I am looking to password protect posts and/or pages based on a certain category. The reason for this is that I am creating a ...
0
votes
1answer
106 views

Security updates to 3.3.2

I know all security updates are important but given that how important on a scale from 1 to 10 is it to upgrade from 3.1.3 to 3.3.2. I have some sites that need to be upgraded but the host has me ...
0
votes
2answers
103 views

Side effects of disallowing *.php requests in production environment?

For security in the production environment a company I work with has removed the whole wp-admin/ directory, and is about to disallow all *.php file calls with a 403 Forbidden HTTP error. Are there ...
0
votes
2answers
181 views

How to prevent plugins from sniffing/stealing other plugins' options?

Many plugins require configuration with sensitive data such as API keys, passwords, etc. When implementing these plugins, this sensitive data is stored using functions such as update_option() and ...
0
votes
1answer
293 views

Does using a custom query_var create a security hole?

Say I put the following code in functions.php function add_my_query_vars($qvars) { $qvars[] = "new_var"; return $qvars; } add_filter('query_vars', 'add_my_query_vars'); If somebody requests ...
0
votes
2answers
263 views

On new server, site got hacked, permissions a bit strange? Please help

I moved to a new server recently, a week later a site got hacked, all they did was change the index.php file of the current enabled theme, no big deal. I did have a few security precautions in place, ...
0
votes
2answers
293 views

How can I password protect a WordPress site without requiring users to log in?

I don't want people to have to log in, I just want to prompt them with a question and if they can answer it, they can access the site. All the solutions and plugins that I've found seem to be overkill ...
0
votes
2answers
2k views

Embed Wordpress Admin in an iframe

I am trying to embed the admin "new post" wordpress page into an iframe: `<iframe height="500px" frameborder="0" width="740px" src="my_wordpress_domain/wp-admin/post-new.php"/>` For some ...
0
votes
3answers
400 views

Spam injected in w3 total cache page cache

I'm trying to fix a site which has been injected with external spam. After inspection I found out that the external content (so far just html advertising different kinds of drugs, no scripts) was in ...
0
votes
1answer
97 views

Privilege escalation bugs in 2.9?

Are there any known privilege escalation bugs in WP 2.9 to be careful for?
0
votes
1answer
41 views

Session Cookie security questions

I am a .NET developer but I also administer all of our corporate websites, which are all Wordpress. I inherited the sites from someone who is no longer at my company. My company recently spent a ...
0
votes
1answer
29 views

Secure my “add_settings_field” translation?

I am using "add_settings_field" and want to provide translation for it , but my problem is security. So is __('My Checbox:' , 'domain') secure enough for translation? If not what can I do about it? I ...
0
votes
1answer
47 views

Storing FTP details in wp-config.php

I'd like to hear about the security concerns for storing FTP details in wp-config.php on a shared server. It doesn't 'feel' safe to me. I'm using ManageWP to control sites on a shared server and have ...
0
votes
2answers
767 views

Tips for finding SPAM links injected into the_content

I'm working on a client's site and I noticed that posts have a hidden <div> filled to SPAM links to dick pills, etc. Hoping to get lucky, I searched for some of the keywords in the database ...
0
votes
1answer
61 views

Remove hacked code - out of ideas! [closed]

I've been working on a project which keeps getting some PHP inserted into the config.php file and it's causing a lot of issues with SEO. I'll paste in a sample of it (it's quite long) after this ...
0
votes
2answers
64 views

Config file with no Keys..?

I'm working on a site for someone that doesn't have any keys in the wp-config file. Isn't this a serious issue? I know I can generate these but I wonder if this will have any side-effects..also, is ...
0
votes
1answer
89 views

How do I determine if the user who registered is not spam?

I've recently set up a forum on my site with the bbpress-plugin. Now a user has registered on the site but the email-adress looks suspicious to me. How can I determine if the user is real? Is there a ...
0
votes
1answer
57 views

Hiding Media Source Links

I inserted an image onto my page from my WordPress media (Add Media -> Media Library -> Link To = None). However, when I right click on the page to view the source, I noticed the address to my media. ...
0
votes
1answer
28 views

Secret keys in SCM

I have a WordPress installation in a Git repository and I'm wondering, if it's safe to have the 8 "secret keys" stored in there, or if I should insert them during deploy.
0
votes
1answer
160 views

Selectively Disabling PHP via .htaccess in Root Directory

I'm reading up on securing WordPress and one of the commonly suggested techniques is to use an .htaccess file to disallow PHP execution in wp-content and wp-includes. I then read about another hack ...
0
votes
1answer
51 views

My website is getting too many dierect home arechives and this is increasing my bounce rate

My website is getting nearly 800 direct home archives daily, as a result the bounce rate of my website has increased. Usually i get only around 30 home archives a day These hits are not from Google, ...
0
votes
1answer
90 views

Form Post results in 404 Not Found [duplicate]

I am creating a POST-able form on the front-end of Wordpress (via a shortcode). If I submit this form without any input, the form submits fine. But as soon as I enter an data in the fields and POST ...
0
votes
1answer
50 views

How do I allow certain users to make a certain type of post?

Here's a brief summary of how my site is setup: I have a relatively simple Intranet site. Right now I am utilizing posts as a means to provide news to users. I am also using pages. I only want ...
0
votes
3answers
198 views

How to stop direct HTTP POST to a PHP script?

I have a form on my site, created using Contact Form 7 with Captcha. Contents of the form when POSTed are being sent to a PHP script, the "action" attribute of the form is set to ...
0
votes
1answer
369 views

Wordpress Security - How to block alternative Wordpress access

I own a self-hosted Wordpress 3.5 blog. I'm working on its security and I'm trying to prevent non-writers from accessing anything admin-ish they shouldn't. Recently I tried Better Wordpress Security, ...