Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

1
vote
4answers
2k views

No option “I would like my site to be private, visible only to users I choose” in Privacy Settings

I am running WordPress 3.3.2 self-hosted. I used to see the option "I would like my site to be private, visible only to users I choose" under Privacy Settings but I no longer see this option. Instead, ...
3
votes
2answers
1k views

Secure Validation of wp_editor in Theme Options

So I just found this great WPSE thread about security for themes/plugins. It answered most of my questions but it was created before the new wp_editor() function was built. I have two TinyMCE editors ...
2
votes
3answers
117 views

Why users disable the WordPress update?

Users install plugins which disable update reminders. Plugins: disable WordPress Core Updates disable WordPress Plugin Updates disable WordPress Theme Updates Look at the counter of plugins ...
0
votes
1answer
109 views

Security updates to 3.3.2

I know all security updates are important but given that how important on a scale from 1 to 10 is it to upgrade from 3.1.3 to 3.3.2. I have some sites that need to be upgraded but the host has me ...
1
vote
3answers
768 views

Simple Online Payment for Event Registration [closed]

I am looking for a simple (and secure) way to accept payment for event registration. I am managing a Wordpress website for a organization that hosts events throughout the year. A handful of these ...
2
votes
1answer
471 views

How to expire all wordpress user passwords instantly?

So I own an article directory website and recently a lot of bots have signed up and started posting spam. (I approve posts prior to publication) I've added a captcha to the user registration page now ...
2
votes
2answers
2k views

how can i embed wordpress backend in iframe

I have 2 websites http://www.aaa.com and http://www.bbb.com and need them to show the same. Now I put an iframe in index.html and upload to aaa.com. It's ok for frontend but it's doesn't work for ...
0
votes
1answer
114 views

Why do people use “admin” username by default? [closed]

WordPress users use "admin" username by default to login to admin panel because WordPress suggest this username at the end off install. But "admin" username is the most common username to brute-force ...
12
votes
1answer
3k views

wp_verify_nonce vs check_admin_referer

What is the difference, which one should I use? I know that wp_verify_nonce checks the time limit, and check_admin_referer I think calls wp_verify_nonce as well as checking for an admin url segment, ...
21
votes
6answers
14k views

Can I Prevent Enumeration of Usernames?

Can I prevent enumeration of usernames on my wordpress site? I can see users at the moment using the WPScan tool.
1
vote
2answers
435 views

esc_html__ security : what for in this example?

how does esc_html__ (the 2nd one) protect the $message variable from being hacked ? what's the point to use this protection here (the second one with a plain text)? <?php function unknown(){ ...
0
votes
1answer
1k views

Problem with permissions in wp-content/plugins

I have a WP installation on my local machine and trying to get my hands dirty with plugins. I wish to clone a project from github which has this plugin code. However, i dont have the permissions ...
1
vote
2answers
882 views

wp_nonce_field displaying twice

I have wp_nonce_field in my code but it's creating two instances to the html code for some reason, one where I'd expect it and another at the start of the entry. Is this correct or am I doing ...
0
votes
1answer
245 views

Spam in Wordpress root folder

Two questions in one. A php file was recently introduced in the root directory of my Wordpress installation (a domain installation). It didn't disturb my website but was apparently using the domain ...
3
votes
1answer
1k views

What is the difference between strip_tags and wp_filter_nohtml_kses?

What is the difference between strip_tags and wp_filter_nohtml_kses. I tried to figure wp_filter_nohtml_kses from the source but it looks like it does something a bit more complex than strip all html ...
0
votes
1answer
214 views

Contact Form Security

Building my own contact form in Wordpress. Any there any security steps I need to consider other than the typical email etc validation and maybe a captcha. I am not sending any data to the database.
0
votes
2answers
114 views

Side effects of disallowing *.php requests in production environment?

For security in the production environment a company I work with has removed the whole wp-admin/ directory, and is about to disallow all *.php file calls with a 403 Forbidden HTTP error. Are there ...
6
votes
1answer
950 views

What is the difference between esc_html and wp_filter_nohtml_kses?

What is the exact difference between esc_html and wp_filter_nohtml_kses. Everywhere I look says that both strip all the html, the only difference I can see is to do with exactly how they do this. Does ...
3
votes
1answer
1k views

Encrypt emails?

We need to maintain HIPPA compliance for forms on our website that are currently mailed to an internal email address. While the user/customers provides the info over HTTPS, we still want to make sure ...
1
vote
1answer
488 views

The 'https_local_ssl_verify' filter

I have run into some WordPress code which does POST requests to API sites and in the POST parameters for the SSL property it has $params = array( 'body' => $_POST, 'sslverify' => apply_filters('...
2
votes
1answer
203 views

Which of WordPress's .php files need to be directly accessible via HTTP?

I'm trying to tighten up security on my WordPress installation, and one of the things that seems like it might be a good idea is preventing all of the internal-use .php files from being accessed ...
5
votes
3answers
169 views

Regular security checks - what steps should be included?

There are heaps of tutorials explaining how to secure a WordPress installation, but I couldn't find any that listed out steps for weekly or monthly security checks. What are some steps that you ...
2
votes
1answer
250 views

Wordpress Malware Problem help! [duplicate]

Possible Duplicate: Wordpress Trojan issue help! I accessed the wordpress website I am building and received a warning about a trojan from my anti virus software. I have now checked the site ...
6
votes
1answer
623 views

multi page password protection

Is it possible to have the "password protected page" feature of WordPress apply to more than one page? I have dozens of pages which I wish to protect with the same password, but I don't want people to ...
1
vote
3answers
5k views

Protecting HTML5 video [closed]

I shall explain my situation as best I can so you can see where i'm coming from. I'm working on a wordpress site for a sports team, there are loads of teams. We want to put coaching sessions on our ...
7
votes
2answers
3k views

Handling front-end file uploads, considering safety and ease of use

I'm looking to adapt an existing forum-like plugin which has no facility for attaching media. The plugin works as a Custom Post Type, so it would be as "simple" as attaching an image to a post. I am ...
1
vote
2answers
72 views

What permissions should I give directories if I want to make WordPress more secure?

A follow up to a previous question found here How can I lock down an old wordpress install I don't intend to update? Same info still stands. WordPress install will (probably) not be updated. ...
0
votes
3answers
4k views

How to secure WordPress XMLRPC?

XMLRPC is great for remote publishing to WordPress, but there has been many security issues attributed to it. How do it make it more secure? More specifically, only user from the intranet will be ...
10
votes
2answers
459 views

How Can I Securely Implement a Password-less Login Feature?

Just posted a new plugin: No More Passwords I currently have it tagged beta because logging into a platform is a sensitive issue and I don't want to release something that may have security holes. So ...
2
votes
1answer
467 views

Extend the list of MIME-types supported by the builtin uploader in 3.3

Goal I want to be able to extend the list of mime-types supported by the builtin uploader in wp 3.3.1 For example when I try to upload an .apk file to our class blog, I get a Sorry, this file type ...
0
votes
2answers
201 views

Is Wordpress secure enough for a multi-user article directory?

One of my friends is going to launch a small article directory (ex: http://ezinearticles.com/) using WP. The site will be hosted on a shared hosting in the beginning and will be moved to a dedicated ...
3
votes
2answers
2k views

How do I create a WP user outside of Wordpress and auto login?

I've built a directory of members on a non-WP site (using php and mysql). Each member can log in and update their details using a username and password. I want to be able to get this to automatically ...
0
votes
2answers
262 views

How to prevent plugins from sniffing/stealing other plugins' options?

Many plugins require configuration with sensitive data such as API keys, passwords, etc. When implementing these plugins, this sensitive data is stored using functions such as update_option() and ...
0
votes
1answer
489 views

Does using a custom query_var create a security hole?

Say I put the following code in functions.php function add_my_query_vars($qvars) { $qvars[] = "new_var"; return $qvars; } add_filter('query_vars', 'add_my_query_vars'); If somebody requests my....
0
votes
2answers
354 views

On new server, site got hacked, permissions a bit strange? Please help

I moved to a new server recently, a week later a site got hacked, all they did was change the index.php file of the current enabled theme, no big deal. I did have a few security precautions in place, ...
0
votes
1answer
242 views

Renaming wp-admin without hard-coding it. Is it really possible?

I would like to rename my wp-admin folder due to some security concerns. Is it really possible? The less it looks/is built like default WP, the harder it is to attack known vulnerabilities. Being ...
0
votes
2answers
303 views

How can I password protect a WordPress site without requiring users to log in?

I don't want people to have to log in, I just want to prompt them with a question and if they can answer it, they can access the site. All the solutions and plugins that I've found seem to be overkill ...
0
votes
1answer
154 views

Has anyone developed a anti-spam plugin to simply allow users to BLOCK whatever they wish to, but one that will also go easy on IP addresses?

I'm new here xD I'm thinking of developing a plugin to allow users to block ANY spammy traces (IPs, Email addresses, Website URLs, phone numbers, phrases, etc etc) from those evil spammers. BUT, ...
40
votes
2answers
22k views

How to Protect Uploads, if User is not Logged In?

I use wordpress for a private site where users upload files. I use the "Private WordPress" to prevent access in to the site if the user is not logged in. I would like to do the same to the files ...
0
votes
1answer
554 views

How much should I worry about these messages?

I received about 50 messages today with the similar message: WordPress Firewall has detected and blocked a potential attack! Web Page: domain.com/index.php?option=com_simpledownload&...
1
vote
1answer
69 views

Protect HTML in Comment

In wordpress comments system, it work HTML. I want to protect inserting HTML in wordpress comment system.
2
votes
4answers
130 views

How to properly secure my Wordpress installation?

I'm currently on my own server (fredericpilon.com) with my own website. Wordpress being kind of a big shot of CMS, it may be targeted by hacks. Any tips and tricks on how to properly secure my ...
2
votes
1answer
454 views

Stop wordpress automatically escaping $_POST data

I have a custom front end form which creates a custom post type post and have just discovered WordPress automatically escapes $_POST data in the same way that Magic Quotes does. I have Magic Quotes ...
0
votes
1answer
169 views

Secure Wordpress: Change admin

I'm sorry if this is an extremely stupid question. I've been looking for ways how to secure my WP and a lot of websites suggest to create a new admin user account and delete the old one. Now, if I ...
0
votes
2answers
3k views

Embed Wordpress Admin in an iframe

I am trying to embed the admin "new post" WordPress page into an iframe: <iframe height="500px" frameborder="0" width="740px" src="my_wordpress_domain/wp-admin/post-new.php"/> For some reason ...
8
votes
2answers
942 views

Are Nonces Useless?

This is probably a noob question BUT hear me out - isn't the point of using Nonce to protect from things like scrappers (phpcurl scrappers etc.)? But my Nonce prints out in the head of the document ...
0
votes
2answers
42 views

I need to find which is the file that checks the DB for correct login (username, password)

I let users to register in my page, however I want to improve the password security that is saved in the DB. For this I need to find out which is the file that makes the query where pass=pass and ...
1
vote
2answers
793 views

How can I make uploaded images in the editor load with HTTPS?

I have the admin section of my site using HTTPS. This works pretty well except that the images inside the TinyMCE editor (the post and page rich text editor) load with http instead of https and so I ...
0
votes
2answers
48 views

What can I do when an outside party hacks into my weblog and changes my display name?

Last night I wrote a mildly controversial blog post about religion on my weblog, and this morning I woke up to find that my display name had been changed to the name of a fanatic religious leader. The ...
1
vote
1answer
567 views

Protecting Wordpress login page

How can i do this: Whenever visitors open the login page (wp-login.php), they will be redirected to the mainpage. Only the admin (me) can view the page to login. I am doing this to protect my wp ...