Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

0
votes
1answer
166 views

Secure Server after configuration

Recently I purchased a VPS from intovps.com, And first time I configured a fully unmanaged VPS through ssh comands. My website is working into it, properly. Now I just want to know how to secure it? ...
4
votes
2answers
708 views

How Attackers write script into my php files?

I have a blog created with wordpress, now i have a problem. Attackers writes javascript codes into my files. Let's assume i have holes in my plugin scripts, but how can they write into php files? ...
2
votes
2answers
625 views

Subscribe to email for security fixes?

Is there any email alert list for security fixes? I'd rather not rely on just an RSS feed.
-1
votes
1answer
296 views

How to protect wp-admin from third party access?

How can the wordpress administration panel and the login page wp-login.php be hidden such that only the website administrator can access it? Can the URL be rewritten through some mod_rewrite rule ...
3
votes
5answers
471 views

WordPress and Security

Are there some simple ways to beef up the security on a WordPress site?
1
vote
1answer
176 views

Using HTACCESS for Secret Access

I saw this post yesterday http://digwp.com/2011/01/simpler-login-url/ where a 'custom' word is used to direct the user from url.com/admin to url.com/wp-login.php and I'm asking (also did so in the ...
13
votes
4answers
27k views

Is there any way to rename or hide wp-login.php?

Any way to change the wp-login.php url? It seems insecure that everyone that's ever used Wordpress could easily see if your site is using it, and get right to the login page. There used to be a ...
3
votes
2answers
537 views

Setting WP Admin passwords to expire

I'm aware it's not a feature of Wordpress, but I was wondering if there was a way or a plug-in (haven't found one from searching) that allows me to force a user to change their password after a ...
6
votes
2answers
535 views

How can I lock down an old wordpress install I don't intend to update?

I am starting a new wordpress blog, and no longer updating an old one. The old one still gets 400-500 hits a day, so I would like to keep it up for archival purposes, as people still link to its ...
1
vote
2answers
148 views

What may be causing failure of auto-install features in Wordpress (v3.0.3)?

What may be causing the installation errors I continue to get when trying to auto update anything in Wordpress? I've been manually upgrading everything for quite some time, and I've tried all sorts ...
1
vote
2answers
956 views

Best practices for securing a Buddypress installation?

A client of mine runs a Buddypress-based site (BP 1.2.6 on WP 3.0.2). We'd like to give users the ability to publish blogs of their own, but we don't want them to be able to execute PHP code (we make ...
8
votes
2answers
3k views

Prevent access or auto-delete readme.html, license.txt, wp-config-sample.php

Just a quick question that might help a tad bit with security. I noticed that the readme.html file has the version number listed. It reappears after each upgrade and so do the licence.txt, and ...
1
vote
2answers
115 views

Upgraded to latest version - 3.0.3 and Now I get a “sufficient permissions to access this page” error

The issue appeared immediately after upgrade. The only part of the application impacted is the sub-menu items under settings where it relates to a plug-in. The core application settings work, just ...
0
votes
3answers
501 views

Spam injected in w3 total cache page cache [closed]

I'm trying to fix a site which has been injected with external spam. After inspection I found out that the external content (so far just html advertising different kinds of drugs, no scripts) was in ...
3
votes
2answers
78 views

Any reason to be concerned by a wave of “zombie” blog signups?

I maintain a blog for a friend of mine. It's basically an aggregater of videos from other embeddable video sites, and provides a way for users to comment on those videos. Not really high-value ...
0
votes
1answer
506 views

404 errors when updating options in admin dashboard

Whenever I try to update my Permalink settings or use the Theme Editor to modify some file, I am redirected to a 404 page. This also happens when I update the All-In-One SEO Pack plugin's settings. ...
4
votes
2answers
5k views

Limiting sessions to one IP at a time

On a site with premium user account subscriptions, I'd like to be able to limit logins to one computer at a time. The most straightforward way to accomplish this would be to limit by IP, but I haven't ...
1
vote
2answers
125 views

Weird problems after recovery from security breach

The shared server that I used for hosting my WordPress website was hacked recently, and many of the index.php files, plugin files and uploads were deleted, with my MySQL databases untouched. But after ...
3
votes
2answers
784 views

Can I force a password change?

When I create a new user, I would like to force that user to change their password on first log in, can this be done?
3
votes
3answers
1k views

Options for restricting access to wp-admin

So i've installed a plug-in which allows me to enable two-factor authentication for my users. The problem is that to enable the plug-in i have to log in as that user and enable it via their profile ...
0
votes
1answer
99 views

Privilege escalation bugs in 2.9?

Are there any known privilege escalation bugs in WP 2.9 to be careful for?
0
votes
1answer
518 views

Does WP show me if I'm logged in from multiple locations?

Does word press show me if I'm logged in in another location? Related: Limiting sessions to one IP at a time
19
votes
2answers
9k views

Getting a List of Currently Available Roles on a WordPress Site?

When writing WordPress plugins there is often a need to set up options for which roles on the site have access to certain functionality or content. To do this a plugin dev needs to fetch the list of ...
4
votes
1answer
986 views

What's the difference between esc_* functions?

I've read Professional WordPress and it says: esc_html function is used for scrubbing data that contains HTML. This function encodes special characters into their HTML entities esc_attr ...
1
vote
3answers
2k views

Why do I need to check if wp_nonce_field() exists before using it

i dont really understand why the check if the nonce function exists before running it ... if ( function_exists('wp_nonce_field') ) wp_nonce_field('gmp_nonce_check'); i understand its for ...
83
votes
10answers
30k views

Steps to Take to Hide the Fact a Site is Using WordPress?

I have a website for which we are trying to be discreet about the fact that we are using WordPress. What steps can we take to make it less obvious?
13
votes
4answers
4k views

What's the easiest way to stop WP from ever logging me out

After a certain amount of time WP logs out all users and forces them to log back in again. For development environments on my local machine this is obnoxious and absolutely unnecessary. Is there an ...
0
votes
2answers
2k views

Uploading .webm format on WordPress results in security guidline breach and fail

I cannot upload the .webm video format on WordPress. This is after adding: AddType video/webm .webm into both: my .htaccess file (on the root folder of the WordPress installation) the mime type ...
8
votes
4answers
2k views

Security and .htaccess

About a month ago I started a WordPress blog on a hosted server related to a hobby. So, I am new to this at present. Since I'm concerned about security, one thing I did was to install the plugin WP ...
4
votes
5answers
8k views

Is there a way to force ssl on certain pages

I want to force a secure connection on some of my pages (ones with forms), but I don't want the whole site to work with ssl (slows it down) Is there a way to configure specific pages to require ssl?
35
votes
10answers
27k views

Can I rename the wp-admin folder?

Is it possible to rename the wp-admin folder? I know I could just rename it, but unless it's supported by the code lots of things would break. If I use a custom folder name, it will make it slightly ...
5
votes
2answers
296 views

What is the ideal setup to address security concerns?

I'm aware of the requirements WP has for certain directories and files to be writable. I'm also aware that making permissions too loose can open security holes. Finally, I know that the user that ...
4
votes
3answers
795 views

Secure WordPress paid plug-in

I want to create a WordPress plug-in but also want to ensure that the plugin can only be used after it has been activated with a serial key that should be unique for each domain. What is the best way ...