Questions tagged [security]

Strengthening themes, plugins and core installation to prevent intrusion.

Filter by
Sorted by
Tagged with
1 vote
1 answer
68 views

Security threat with `home_url`?

In the docs of built-in function home_url, it is said to be used with esc_url. Are there any security threats without using home_url? Can someone spoof it with fake request?
T.Todua's user avatar
  • 5,779
1 vote
2 answers
1k views

How to combat flooding admin-ajax.php?

I found many requests made from Russia targeting the file admin-ajax.php, my server is not working right now. I am sure that this traffic doesn't come from normal users but a robot. How to avoid ...
AFA Med's user avatar
  • 183
1 vote
1 answer
913 views

When is wp_set_password() called or how to capture a password

Disclaimer: I'm fully aware of the security issues created by this. This is not for production. Whenever a new user is registered or a password is (re)set in WordPress I'm attempting to also capture ...
Rich's user avatar
  • 825
1 vote
1 answer
2k views

not logged in users can't submit form

I embedded a Mailchimp newsletter registration using the mailchimp-plugin, which works just fine for logged in users and also on other websites of mine. But on this page, users who are not logged in, ...
murcoder's user avatar
1 vote
1 answer
176 views

Wordpress filter that hook after each action/filter hook

In my wordpress site virus script added in footer on wp_footer action. I try many techniques, but i cant find virus hook location. Is there any wp action/filter, that hook after each action /filter ...
asad app's user avatar
  • 111
1 vote
1 answer
91 views

Woocommerce reviews xss issue [closed]

I enabled reviews on my woocommerce website and I see that I can insert html / js code in the review comments. How can I solve that problem?
Markus's user avatar
  • 13
1 vote
1 answer
663 views

SELinux security vs Wordpress updates

We have a quite huge Wordpress multi-sites installation with lots of themes/plugins. So we often have new available updates (core/themes/plugins). We don't use automatic updates : ...
Yann39's user avatar
  • 113
1 vote
1 answer
725 views

Definitive wordpress directory ownership and permissions on linux

I know there are a thousand questions about this all over the place and trust me I've been trying every possible solution for years [not an overstatement] and each and every one is either missing a ...
Nikksno's user avatar
  • 11
1 vote
1 answer
219 views

XML-RPC errors they know my username?

I have noticed a lot of XML-RPC authentication failures to my blog site. This can be normal and idiots attempting to crack a wordpress site but what is worrying is that the username being shown in the ...
Junaid's user avatar
  • 113
1 vote
3 answers
517 views

Sniffing wordpress user's credentials

Coming to WordPress development from more "hardcore" (slow) development, I find it extremely odd that the WordPress login process provides absolutely no defense from sniffing credentials data. It all ...
user avatar
1 vote
1 answer
3k views

ajax nonce verification failing

I have a voting system where a list of posts are printed out using an archive template. Each post's voting button has html data attributes containing the vote-id and the vote-nonce. When the voting ...
Stephen Mahood's user avatar
1 vote
1 answer
356 views

Verify if user is wordpress logged in from another app since wordpress 4.0

I try to implement in my Node.js app a way to verify if the user cookie is valid. I've found some post in internet who explain me very well the things, but as i try to implement it, with the WordPress-...
Nicolas Frbezar's user avatar
1 vote
3 answers
1k views

Dangers to allowing Access-Control-Allow-Origin: * for Feeds only?

I want to use a function like this to allow access to the feeds from a variety of services but my knowledge of the security implications is limited. I think I'm being safe by limiting the access to ...
Tom Woodward's user avatar
1 vote
1 answer
1k views

Using esc_url with a hard coded url

I've added following URL in my theme, but I have been informed that I must use esc_url(). I could not figure out, how can I use that function with following code? <a href="http://pinterest.com/pin/...
kashan's user avatar
  • 13
1 vote
2 answers
1k views

Developing a secure front end post editing form

I want to add a front end post editing functionality to one of my Wordpress sites. I found a few plugins that do this, but they don't fits all my needs, so I decided to adapt an existing solution to ...
Yuri's user avatar
  • 1,111
1 vote
1 answer
111 views

How to distinguish between a hack and an encoding error?

This morning I was working with a new image gallery plugin. After two hours of working with it, our server was struggling with a heavy network traffic, and then the server appeared to go out. ...
LJones's user avatar
  • 11
1 vote
1 answer
144 views

The safest way to automate WordPress backups

I'm running over 20+ sites on a Linux shared cloud environment. At present, my hosting company performs daily, offsite backups. However, these are only kept for 30 days. This works great, but what ...
Sam's user avatar
  • 2,126
1 vote
2 answers
158 views

How do I hide WordPress users from security scanning?

We are about to launch a WordPress site hosted internally. As a standard practice, our IT security team does their check for any vulnerabilities. And sadly, they are able to retrieve the list of ...
mrjayviper's user avatar
1 vote
2 answers
116 views

Would it be dangerous to send all the wp_options to javascript file?

I've noticed that wordpress allows me to send the wordpress options to javascript via wp_localize_script: wp_localize_script( $this->plugin_slug . '-plugin-script', 'wp_options', ...
Malibur's user avatar
  • 579
1 vote
1 answer
56 views

Restrict custom post type from appearing with ?post_types=

When appending the querystring post_types = "name of your post type", it displays all the posts. I am using a plugin that has its own custom post type which is restricted (only users that have ...
yeahman's user avatar
  • 724
1 vote
2 answers
68 views

Secure Pages Best Practice

I am in process of writing a plugin that has front-end shortcodes that display a user's information/data. If the user is not logged in, I need to redirect to a front-end login page/form. What would ...
clockwiseq's user avatar
1 vote
2 answers
632 views

How to protect wp-admin through .htaccess?

I'd like to protect the /wp-admin/ directory at the server level. This means two logins. One through the server and another through WordPress. I believe this can be handled through .htaccess. Does ...
4thSpace's user avatar
  • 267
1 vote
1 answer
37 views

Is [admin / admin] acceptable for all local websites?

Are there security issues with using the same credentials [admin / admin] for all client websites on a working, local server ?
drake035's user avatar
  • 1,147
1 vote
1 answer
6k views

Something is unescaping all html entities before output to browser [closed]

I have a nasty problem. In my wordpress site something unescapes all html entities before sending data to the browser. It happens for all of the following cases: echo "&quot;XSS" print_r( ...
user avatar
1 vote
3 answers
1k views

Simple Online Payment for Event Registration [closed]

I am looking for a simple (and secure) way to accept payment for event registration. I am managing a Wordpress website for a organization that hosts events throughout the year. A handful of these ...
Susan's user avatar
  • 67
1 vote
3 answers
5k views

Protecting HTML5 video [closed]

I shall explain my situation as best I can so you can see where i'm coming from. I'm working on a wordpress site for a sports team, there are loads of teams. We want to put coaching sessions on our ...
Jonnny's user avatar
  • 211
1 vote
1 answer
150 views

Changing Table Prefixes - once done, am I good to go going forward?

In the book Beginning WordPress 3 the author advises that changing the default WP table prefixes can provide some slight security advantage (protects from SQL injection scripts). I found several ...
PVA's user avatar
  • 659
1 vote
1 answer
242 views

Is there a way to hide WordPress behind a web visible directory?

Is there a way to hide WordPress behind a web visible directory for extra security using a symlink?
user avatar
1 vote
1 answer
72 views

Does WordPress validate inputs to all functions? (such as get_user_meta and insert_user_meta)

Does WordPress validate inputs made to all built-in functions that access the database to protect against SQL injection vulnerabilities or do we have to validate before passing them?
Can't Tell's user avatar
1 vote
1 answer
308 views

Detect session/cookie variable in wordpress to prevent access to documents

<?php @session_start(); If (!array_key_exists(‘authed’, $_SESSION)) { include ‘not_authed.inc’; exit(); } // go about your business. ?> and i'm trying to add that to this: <?...
Jeffrey Jones's user avatar
1 vote
2 answers
151 views

What may be causing failure of auto-install features in Wordpress (v3.0.3)?

What may be causing the installation errors I continue to get when trying to auto update anything in Wordpress? I've been manually upgrading everything for quite some time, and I've tried all sorts ...
user avatar
1 vote
2 answers
1k views

Best practices for securing a Buddypress installation?

A client of mine runs a Buddypress-based site (BP 1.2.6 on WP 3.0.2). We'd like to give users the ability to publish blogs of their own, but we don't want them to be able to execute PHP code (we make ...
Aurelia Peters's user avatar
1 vote
2 answers
116 views

Upgraded to latest version - 3.0.3 and Now I get a "sufficient permissions to access this page" error

The issue appeared immediately after upgrade. The only part of the application impacted is the sub-menu items under settings where it relates to a plug-in. The core application settings work, just ...
jon gatrell's user avatar
1 vote
0 answers
10 views

nonce_user_logged_out to assign guests unique nonces breaks ajax calls

I've been researching implementing unique guest nonces via nonce_user_logged_out - for reference. So far I can generate nonces for the random UID I create: add_filter( 'nonce_user_logged_out', '...
ghosted's user avatar
  • 11
1 vote
0 answers
11 views

Verify Cryptographic Authenticity after Downloading Releases (Signatures)

How can I verify the authenticity of a wordpress release after downloading it? I tried to securely download wordpress today, but I didn’t find any information on the page about how I can verify that ...
Michael Altfield's user avatar
1 vote
0 answers
23 views

Code Snippets security when selecting "only run on front end"

As I understand the functions.php only runs on the server and its source code is not provided to the browser on the client's side. Additionally, Code Snippets plug-in, assuming previous security ...
Anonymous's user avatar
1 vote
1 answer
96 views

Why is this line of code Wrong in every Wordpress .Htaccess security article?

The following line of code (RegEx) is partly wrong in every Wordpress .Htaccess hardening article I've seen. Why is that? <FilesMatch "^.*(error_log|wp-config\.php|php.ini|\.[hH][tT][aApP].*)$&...
Yahya Tarjuman's user avatar
1 vote
0 answers
740 views

is exposed wp-admin site a serious security vulnerability

this is a basic question that i was unable to wrap my head around via chat gpt or google, namely is it a serious security vulnerability for a wordpress site to have publicly available wp-admin (login ...
pawelek69420's user avatar
1 vote
0 answers
93 views

Impossible to update jQuery version from 3.1.0

PageSpeed Insights is complaining about me using jQuery version 3.1.0 because of security risks. I've been trying to update my jQuery version with two plugins: jQuery Updater jQuery Version Control ...
Fernando Redondo's user avatar
1 vote
1 answer
378 views

How to securely set dynamic HTML content with JavaScript?

Description I have implemented a frontend script that gets a few text options from the server via wp_add_inline_script. When the user does an action the content should dynamically change to one of the ...
Josef Wittmann's user avatar
1 vote
0 answers
414 views

Is there any risk setting Wordpress file permissions and FS method to 'direct' on localhost?

After installing a fresh WordPress on my computer using XAMPP, I got this message when I tried uploading a theme: Connection Information To perform the requested action, WordPress needs to access ...
Frank Fotangs's user avatar
1 vote
0 answers
1k views

Headers Content-Security-Policy CSP Major Issue

Im trying to add CSP : Header add Content-Security-Policy "script-src 'self';" - to my htaccess, seems like this line keeps breaking my site, The blocks gets broken, Unable to edit ...
Emotional's user avatar
1 vote
0 answers
1k views

How to Change The WordPress Login URL Without Plugin

I'm looking for a way to change the wordpress admin login url from site.com/wp-login.php or sit.com/wp-admin.php to my custom login url like site.com/mylogin. I want to this without using plugin or ...
Nina's user avatar
  • 21
1 vote
0 answers
75 views

Is it possible to access the wp-admin from one instance while keeping WP_HOME pointing to the balancing url?

I have a Wordpress running in a load balancer scheme with two instances. For security reasons, i've decided to block wp admin access from the public url and allowing it from one of the instances. ...
Max's user avatar
  • 121
1 vote
0 answers
90 views

Securing/Escaping Output of file content - reading via fread() in PHP

I am working on securing the content read from a file via the fread() function. private function readfile_chunked($file) { $chunksize = 1024 * 1024; // Open Resume $handle = @fopen($file, ...
sehrish's user avatar
  • 11
1 vote
0 answers
610 views

Frequently getting attacks on admin-ajax.php, wp-cron.php, xmlrpc.php and wp-login.php

I am running more than 500 WordPress website in my shared server, Frequently I am getting attacks on admin-ajax.php, wp-cron.php, xmlrpc.php and wp-login.php files. Due to that our server load is ...
jegan balu's user avatar
1 vote
0 answers
72 views

SQL Injection blocked by firewall

I have a WordPress site that is guarded by firewall. Today I got a notification of blocked SQL injection. I cannot understand what the hacker is trying to do with the query: https://example.com/?p=121%...
Tony's user avatar
  • 111
1 vote
1 answer
150 views

Should I disable directory listing for wp-includes?

This is more of a personal question for my own curiosity. One of my websites appears to be vulnerable because the directory listing (/wp-includes) is enabled. It’s not difficult to fix, however I’m ...
addirect's user avatar
1 vote
1 answer
42 views

How to prevent XSS alter custom global javascript object & methods in Wordpress

Im working on a project in Wordpress that enqueues multiple .js files where each file adds a new method to a global javascript object, this in order to make the desired methods available only if ...
Pappageorgio's user avatar
1 vote
1 answer
526 views

.htaccess rules for blocking bots with an extra condition

I have a WP multisite installed. I am integrated with Ezoic and Cloudflare. I had implemented firewall rules. However, I have an issue blocking bots that have X-Middleton in the User-Agent, because my ...
Irene's user avatar
  • 23

1
7 8
9
10 11
20