Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

2
votes
4answers
129 views

How to properly secure my Wordpress installation?

I'm currently on my own server (fredericpilon.com) with my own website. Wordpress being kind of a big shot of CMS, it may be targeted by hacks. Any tips and tricks on how to properly secure my ...
2
votes
1answer
397 views

Stop wordpress automatically escaping $_POST data

I have a custom front end form which creates a custom post type post and have just discovered WordPress automatically escapes $_POST data in the same way that Magic Quotes does. I have Magic Quotes ...
0
votes
1answer
165 views

Secure Wordpress: Change admin

I'm sorry if this is an extremely stupid question. I've been looking for ways how to secure my WP and a lot of websites suggest to create a new admin user account and delete the old one. Now, if I ...
0
votes
2answers
2k views

Embed Wordpress Admin in an iframe

I am trying to embed the admin "new post" wordpress page into an iframe: `<iframe height="500px" frameborder="0" width="740px" src="my_wordpress_domain/wp-admin/post-new.php"/>` For some ...
8
votes
2answers
901 views

Are Nonces Useless?

This is probably a noob question BUT hear me out - isn't the point of using Nonce to protect from things like scrappers (phpcurl scrappers etc.)? But my Nonce prints out in the head of the document ...
0
votes
2answers
41 views

I need to find which is the file that checks the DB for correct login (username, password)

I let users to register in my page, however I want to improve the password security that is saved in the DB. For this I need to find out which is the file that makes the query where pass=pass and ...
1
vote
2answers
736 views

How can I make uploaded images in the editor load with HTTPS?

I have the admin section of my site using HTTPS. This works pretty well except that the images inside the TinyMCE editor (the post and page rich text editor) load with http instead of https and so I ...
0
votes
2answers
48 views

What can I do when an outside party hacks into my weblog and changes my display name?

Last night I wrote a mildly controversial blog post about religion on my weblog, and this morning I woke up to find that my display name had been changed to the name of a fanatic religious leader. The ...
1
vote
1answer
561 views

Protecting Wordpress login page

How can i do this: Whenever visitors open the login page (wp-login.php), they will be redirected to the mainpage. Only the admin (me) can view the page to login. I am doing this to protect my wp ...
-2
votes
3answers
1k views

Wordpress Hacks/Defacing [closed]

Im trying to figure out how Wordpress sites become defaced/hacked. I know development very well. I know how to secure code, etc. But I am finding recently, that tons of Wordpress sites are becoming ...
2
votes
1answer
130 views

Where should my plugin POST to?

I'm creating a simple plugin to set a page as a homepage from the list pages (to appear next to edit, preview, trash actions etc), I was just wondering what that the most appropriate/secure place to ...
2
votes
1answer
142 views

Restricting access to content

I'm developing a functionality to let only customers and doctors have access to exam results. But i'm not so sure about the strenght of my code in securing view only to those authorised. I've gotten ...
2
votes
1answer
134 views

Changing Table Prefixes - once done, am I good to go going forward?

In the book Beginning WordPress 3 the author advises that changing the default WP table prefixes can provide some slight security advantage (protects from SQL injection scripts). I found several ...
4
votes
2answers
225 views

What does a security risk in a plugin look like?

My server was hacked this weekend. By the Russians! Of the 50+ domains on my server, every single one had a hacked .htaccess file which was redirecting search results and a few other things to a ...
5
votes
3answers
1k views

Moving wp-config.php: Can this be done after site launch?

For additional security, the suggestion is made to move the wp-config.php up one level. Can this be done after the site has already been launched? Any potential issues in doing this? Are there an ...
10
votes
2answers
3k views

How to store username and password to API in wordpress option DB?

I'm currently developing a plugin and the chances are that I will more than likely release it on the public plugin repository so others can use it. The plugin will be using an API and to use this API ...
10
votes
1answer
955 views

How safe / sanitized is wp_insert_posts()?

Looking at the Codex for wp_insert_post() it states that this function "...sanitizes variables, does some checks, fills in missing variables like date/time, etc. " (EDIT: I updated the Codex entry to ...
0
votes
1answer
496 views

Is the Block Bad Queries Plugin Still Relevant?

The Block Bad Queries Plugin hasn't been updated recently. Is WordPress still subject to these types of malicious attacks or has it been hardened sufficiently to make the plugin obsolete? Is there an ...
1
vote
1answer
8k views

Change WP-Login or WP-Admin

Can I change the name of the wp-login or wp-admin file so that I can go to a different filename in order to login. I am trying to prevent hackers from finding my login and wp-login has become a very ...
0
votes
1answer
164 views

Using password protection to load different page elements?

I have a page that is password protected, and I wish to removed some parts of the theme, and add others. Can I do that? Is there a check I can do in the theme files to see if a user has entered the ...
-1
votes
5answers
3k views

Is it a bad idea to CHMOD 777 all the files on your site?

I think i heard that it might pose a security threat to your site, is that right? Makes it more vulnerable to it getting hacked? How should I undo this, which files should be chmod to what number?
-1
votes
2answers
2k views

Securing Contact Form 7 [closed]

I have a client who's website I created with Wordpress. It has a contact form created with contact form 7. This client is a subsidiary of a larger organization who's IT department runs scans on their ...
0
votes
1answer
135 views

User generated content and security

I'm gonna create a new site. I want to make the site as user generate able content site. Basically this is my site's function. Users signup in my wordpress site, Submit content from wp-admin panel, ...
2
votes
1answer
1k views

What is the relationship between cURL, WordPress and cacert.pem?

I've run into a problem concerning wp_remote_get() and the underlying cURL call. On some WordPress installations I see the following SSL error: httprequest_failed: SSL certificate problem, verify ...
0
votes
2answers
1k views

What do spammers gain by signing up as a user?

The majority of new user signups I receive on my Wordpress blog look dodgy, with @someblog.com, @somearticle.com, or @gmail.com addresses. What do they gain by signing up as a new user?
2
votes
1answer
390 views

How to block a category from one user and enable the category for the rest of the users

I have a site in which all categories are open to anyone, except for 2 categories that are password protected: Students, and Teachers. They are open only to specific users types, as follows: The ...
4
votes
1answer
284 views

What is the most secure way to store post meta data in WP?

Sony's recent security "holes" showed how unsafe it can be to store data unencrypted. As some of you may know, I 'm working on re-releasing the free CRM theme Driftwood. What is the most secure way ...
-1
votes
1answer
149 views

Will my Wordpress site become vulnerable after adding this functions which allows more HTML tags for subscribers?

I was thinking of adding the following lines of code to my functions.php file: /** * Change the default list of allowed html tags */ add_action('init', 'edittag', 10); function edittag() { ...
0
votes
1answer
218 views

Is there a way to hide WordPress behind a web visible directory?

Is there a way to hide WordPress behind a web visible directory for extra security using a symlink?
2
votes
3answers
8k views

How to change “wp-admin” to something else without search-replacing the core?

for example: foobar.com/wp/edit instead of foobar.com/wp/wp-admin How would I do that? I've tried using this in htaccess but it won't work: ##### ABOVE THIS POINT IS ALREADY INSERTED BY WORD PRESS ...
6
votes
1answer
692 views

Which KSES should be used and when?

The WP source shows that wp_filter_kses and wp_filter_post_kses are passed data that's "expected to be escaped with slashes." On the other hand, wp_kses_data is passed data that's "expected to not be ...
1
vote
1answer
65 views

Does WordPress validate inputs to all functions? (such as get_user_meta and insert_user_meta)

Does WordPress validate inputs made to all built-in functions that access the database to protect against SQL injection vulnerabilities or do we have to validate before passing them?
5
votes
1answer
1k views

Multiple ajax nonce requests

I have a feature in my current project that will be allow multiple ajax requests - I've got a single nonce request worked out (via this tute), but am somewhat unsure how to figure in multiple nonce ...
72
votes
12answers
11k views

Verifying that I have fully removed a WordPress hack?

My for-fun WordPress blog at http://fakeplasticrock.com (running WordPress 3.1.1) got hacked -- it was showing an <iframe> on every page like so: <iframe ...
1
vote
1answer
93 views

Why was my blog post inserted lot's of ad links by others?

I found that my blog posts are inserted lot's of ad links, I'm using WordPress 2.9.2, is there a known security vulnerability in it? A screenshot : I post some codes on my blog, the ad links are ...
0
votes
1answer
120 views

Allowing Users to Register Themselves and Post : Does WordPerss Handle these Problems?

If one allows visitors of a WordPress blog to register themselves and post to the blog without moderation(i.e. without submit for review), malicious visitors may try to 1)Post a large number of posts ...
4
votes
1answer
128 views

Will my Wordpress site become vulnerable to Cross-Site Scripting (XSS) if I allow img tags in the comments area?

I'm planning to follow this tutorial in order to allow my subscribers to add images to comments (actually a custom post type called "Replies"). Wordpress filters <img> tags by default (except ...
7
votes
3answers
580 views

Will there be security updates for 3.1 once 3.2 is released?

I am currently running WordPress 3.1.2 on PHP 5.1.6. The minimum requirement for WordPress 3.2 is going to be PHP 5.2.4 or greater. If I keep running WordPress 3.1.2 and there is a security issue will ...
3
votes
4answers
1k views

ensure user can only be logged in on one computer at a time?

how can i make sure a user can only be logged in on one computer at a time? I want to make a wordpress site that could potentially have paid accounts for content in the future. Is there anything built ...
1
vote
1answer
291 views

Detect session/cookie variable in wordpress to prevent access to documents

<?php @session_start(); If (!array_key_exists(‘authed’, $_SESSION)) { include ‘not_authed.inc’; exit(); } // go about your business. ?> and i'm trying to add that to this: ...
5
votes
2answers
4k views

Can upload doc and pdf but not ppt - not permitted for security reasons

"Insert search engine here" was pretty useless for this one - I've had a look through wp-includes/functions.php, wp-admin/includes/file.php etc. but not found a reason for the behaviour I'm getting. ...
6
votes
3answers
1k views

WordPress Ajax Data Security

I am aware of nonces to check for intentions but can't make any sense if I can use them to restrict for database reads somehow? I mean, I am fetching records from the database using AJAX but I don't ...
4
votes
4answers
795 views

What are the pros and cons of using a custom front-end to retrieve content from a Wordpress back-end

I've been building wordpress sites for a few years now and have noticed a few things that bother me. 1. It's fairly slow (awful blanket statement, I apologize) My initial desire to create a ...
19
votes
13answers
2k views

What Are Security Best Practices for WordPress Plugins and Themes? [closed]

As suggested in this question, I am adding this topic as a new question, for community discussion/voting regarding best-practices for Plugin/Theme security. Here is the starting checklist, based on ...
14
votes
3answers
458 views

What are the common security flaws I need to look for? [closed]

As a wannabe WP plugin developper, what are the main security flaws/holes I should look for? I'm about to create a new plugin with a configuration panel (ie input fields and stuff). What should I be ...
3
votes
2answers
2k views

Is there a security risk giving someone temporary access to my blog's code?

My blog is painfully slow for the last few days, and I would like to pay someone (anyone?) 15 BitCoins to optimize it for me (I would do it myself, but I'm not sure I have the time right now). It's ...
1
vote
4answers
5k views

How to remove “Connection Information” requirement on localhost install of WP on MACOSX

I've just installed XAMPP on Mac OSX and when trying to install a theme or plugin in WP admin, I'm getting this screen. I've never gotten this on my shared hosting account. how to get rid of it on ...
1
vote
1answer
1k views

Securing wp-config leads to sensitive information leak on wp-settings

I read the following tutorial, which mentions moving your config file out of an HTTP-accessible folder. http://codex.wordpress.org/Hardening_WordPress#Securing_wp-config.php I did this, and it works ...
1
vote
1answer
663 views

Is disabling test_form in wp_handle_upload a security concern?

I'm writing a plugin that modifies the default behavior when uploading a file for a post or to the media library. I'm setting $overrides in wp_handle_upload() with a custom $unique_filename_callback. ...
2
votes
2answers
1k views

Has anyone experience w/ WordPress (MultiSite) hidden users (possibly hacked)?

I have 2 WordPress MultiSite installs (on different accounts, but under the same HostGator reseller a/c) and both seem to have been compromised. I say "compromised" because the user_logins have been ...