Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

0
votes
0answers
19 views

Wordpress security - hiding WordPress directory [duplicate]

Note: edited my post to make it more "is it useful?" than "how to do it?" after toscho marked it as duplicate (the post tosho referenced is more or less what I had in mind for the "how to do it" part)....
0
votes
0answers
23 views

About plugin security

I'm developping a couple of simple plugins for specific use, and want to do it right. I've read multiple pages about plugin security, including those. Now, considering that my plugins have for ...
0
votes
1answer
20 views

Dangers to allowing Access-Control-Allow-Origin: * for Feeds only?

I want to use a function like this to allow access to the feeds from a variety of services but my knowledge of the security implications is limited. I think I'm being safe by limiting the access to ...
0
votes
0answers
16 views

Logout via Subdomain, non-wordpress page on a different server?

Similar to the question over at Get wp_logout_url function to work on external (non-Wordpress) page The problem I am facing is the fact the subdomain is on a different server so I am unable to ...
0
votes
0answers
27 views

Upload file via settings page

Question: Is there a secure way to upload files via a plugin settings page? Context: Hello world! A feature of my plugin requires the user to upload one or more files. More precisely, JSON files ...
0
votes
1answer
24 views

What is more secure checking capabilities of user or checking role of user in WordPress plugin development

Suppose I need to check the logged in user is subscriber not anyone else. So if I check the capability like "read". Then subscriber is OK but "read" capability is also associated to admin/publisher as ...
0
votes
0answers
18 views

Cross site domain cookies in Wordpress (v4.x)

I have a plugin that executes an external script (outside of Wordpress) that i'd like to make 'more secure'. I'd like to make this script only accessible/executable when logged in as the Wordpress ...
0
votes
0answers
26 views

Vanilla Wordpress install, what can/should I put in disable_functions?

I would like to take steps to limit the damage a compromised Wordpress install can cause on the rest of my system. What system calls does Wordpress need? What can I put in the disable_functions ...
0
votes
0answers
47 views

PHP Code Sniffer - WordPress VIP Coding Standards

I'm trying to fix up my code to meet the WordPress VIP Coding Standards. I'm getting a couple of issues that I'd like to see go away, but i'm not sure what the best strategy is. The first issue is ...
0
votes
1answer
23 views

Webservice credential storage [duplicate]

I am developing a plugin that calls a web-service with a security header. Can anyone recommend a best practice for storing those credentials on the WordPress site? Right now my best option seems to be ...
0
votes
3answers
39 views

Directory to store secure file

I have a website hosted on ASP.NET server and using wordpress to build my site. I've extended its functionalities using PHP code. At which directory do I store secure files such as (passwords and ...
0
votes
0answers
18 views

Access passworded post with URL

I'm using Woocommerce to sell memberships which users must apply for and I've passworded them all to prevent unauthorized purchases. The best solution for me would be to have a link which 'unlocks' ...
0
votes
0answers
67 views

AJAX - nonce verification fails

I have a simple add-to-newsletter widge. I created a hidden input with nonce: $nlnonce = wp_create_nonce("add-newsletter"); echo '<input type="hidden" id="nlnonce" value="'.$nlnonce.'" />'; ...
0
votes
0answers
13 views

Download security

I would like to create a secure download link for digital content e.g. PDFs, Zips etc. There's a few plugins that offer "secure downloads" but they just block the download page. I need it so the ...
0
votes
1answer
94 views

Force SSL on a single page which is used as iFrame

I have one WordPress page that only contains a shortcode for a slider and is used by other websites as an iFrame. I need to force SSL one this one single page, but whatever I try, it is not being ...
0
votes
1answer
87 views

Being hacked. Is there a list of Wordpress security holes I can check against?

I observe a file being uploaded into various plugin folders in my Wordpress site. The file is used to send out spam from my server and every time I remove it it gets uploaded to another folder. There ...
0
votes
0answers
33 views

Some crawlers/bots attempting to login with very good guesses. How?

I am trying to figure out if wordpress exposes the user e-mail or any other user information to crawlers/bots? I have a couple of security plugins that have been blocking these bots IPs on the third ...
0
votes
1answer
31 views

How to distinguish between a hack and an encoding error?

This morning I was working with a new image gallery plugin. After two hours of working with it, our server was struggling with a heavy network traffic, and then the server appeared to go out. ...
0
votes
2answers
217 views

Allow SVG in WP step by step

I'm not strong in WP programming, bu I try to understand what to do to enable SVG in my site. I found that in need to add function below to functions.php: /** * Add SVG capabilities */ function ...
0
votes
1answer
332 views

.htaccess password protection bypassed

I’ve created .htaccess password in order to add a layer of security to a WordPress installation. The .htpasswd file is located one level above the installation. Yet, I’ve seen brute force attack ...
0
votes
1answer
195 views

Downloading File from Outside Web Root

I've set up some code to download zip files that exist in a folder above the web root. The download will be triggered from a user account page within WordPress. They don't need to be bank-level secure,...
0
votes
1answer
35 views

Hash user emails in database?

I have a wordpress based website, a very important thing is that no one should get to know the email addresses of the people who will admin. I will make the whole website private but I am still ...
0
votes
0answers
249 views

wp_verify_nonce fails always

I have created nonce fro my plugin and trying to verify it with another plugin pages. it fails always. both we are creating nonce with same parameter. why it fails. Plugin name : Wordfence it creates ...
0
votes
0answers
29 views

Server misconfiguration- Protect WordPress core files correctly from being called directly?

With a fresh WordPress 4.3 installation I have the following problem: If I call URLs like http://www.example.com/wp-admin/menu.php the script is executed directly. Is this a security issue which ...
0
votes
0answers
26 views

wordfence reports exploited files but nothing visible when I edit file on server

Wordfence is reporting exploit code on some of the empty idnex.php files asswell as wp-config.php but when I access these files via ssh I see no malicious code. Wordfence reports this malicious code ...
0
votes
0answers
35 views

Is wp_kses safe against XSS

Is this code safe against complex types of XSS attack? $v = wp_kses(esc_attr( $bad_input ), $allowed); where $allowed = array( 'a' => array( 'href' => array(), 'title' =&...
0
votes
1answer
42 views

Suspicious lines of code

Our company website was handed to me and source code was created by previous person. I noticed that there are lots of . I am getting suspicious with these I have the urge to delete these 18 lines of ...
0
votes
0answers
10 views

What is wp-admin/strebam_filter_register.php file?

I ran Sucuri Security integrity check for one of my wordpress websites which had been compromised by malware. I found two suspicious files: wp-admin/strebam_filter_register.php and ...
0
votes
1answer
65 views

Password-protect feed and make it usable in major aggregators

A WordPress site I'm on uses WordPress's default cookie-based authentication. This means that the RSS feed of the page is password-protected and can only be read when the cookie is available. ...
0
votes
0answers
22 views

WordPress and user security

When we talk about Information Security, many things come into mind and people tend to use CMS to be clear on security as CMS people do the job for you, in terms on hashing passwords, encryption etc. ...
0
votes
0answers
57 views

Force reauthentication/login for specific page for currently logged in users

I have a page that searches user information. The site is a record keeping site. I want it so that when people click the "View Records" link that they mus re-authenticate before proceeding. I'm not ...
0
votes
2answers
37 views

Secure Multiple WordPress Installations on shared hosting

Most shared hosting packages store all files of a given user under something like /user/myuser/www/ or /var/html. Addon domains are usually located under /var/html/domain1.com/, /var/html/domain2.com....
0
votes
1answer
68 views

RESTRICT EDIT of PHP files?

I wanted to restrict access to ALL Administrators to have access to EDIT any php file (Like Theme+plugin editor AND ETC..) I have developed a plugin, named System Edit Restriction. Currently, I use ...
0
votes
0answers
102 views

Best way to handle unregistered users as a unique idenitifier

I have a voting system for specific type of posts (site), similar to reddit, and I want to allow unregistered users to vote. In order to keep the voting count as valid as possible, I am thinking ...
0
votes
3answers
257 views

Headers already sent error after upgrading wordpress to 4.2.2

in wordpress version 3.6 and 3.7 everything works great, but with version 4 and above I get: Cannot modify header information - headers already sent the problem line is: header('Location: '. $...
0
votes
2answers
3k views

Block access to wp-admin

I'm attempting to use a .htaccess file to block access to the wp-admin folder. I've read through the Brute Force Attacks doc (https://codex.wordpress.org/Brute_Force_Attacks) and I've added the block ...
0
votes
1answer
314 views

wp-content - permissions for files/folders created by apache

My wp-content folder has owner 'User' and group 'www-data'. The permissions are 775 for folders and 664 for files, so the server can write inside folder. But when the server creates folder and files ...
0
votes
1answer
128 views

WP upload/select image , isn't this a security issue?

If in image upload frame I select a zip http://prntscr.com/6ypjlv, it does not show it in list of files but it is up http://prntscr.com/6ypjvp shouldn't we only be able to upload image types if ...
0
votes
1answer
502 views

Single sign-on: wp_authenticate_user vs wp_authenticate

I have a wordpress site (lets call it site1) and another site with oauth2 (site2). When a new user is created, a record is created in both site1 and site2 databases with the same email as username, ...
0
votes
0answers
383 views

Collecting Sensitive Data in Wordpress?

I am in need of creating an online application form that collected a users SSN number and am therefore concerned with security. Is this possible to do on WP with existing plugins? My research thus ...
0
votes
1answer
139 views

How can i see/log all requests coming from a registration form (not from the UI)?

I am talking about the REGISTER form PROBLEM: I have some requests that are coming from somewhere else - not from the user interface. I know this, because these requests don't have all the mandatory ...
0
votes
0answers
13 views

Why are maintenance releases now auto-update? [duplicate]

When the recent 4.1.1 was released, I thought it must be an important security update, as it's going out to all sites automatically. Reading through the changelog, I found it actually doesn't mention ...
0
votes
2answers
1k views

How to sanitize select box values in post meta?

I have added a select box in the Post meta. Here is the code, and it works fine. My question is, do I need to sanitize the values before updating the post meta? If yes, how it should be done? This is ...
0
votes
1answer
303 views

Stop Plugin Enumeration [closed]

Is there any way to stop plugin enumeration? I have tried Acunetix WP Security plugin, It seems to work but Yoast SEO plugin is still enumerating. Any plugins or code modifications are appreciated. ...
0
votes
1answer
51 views

Write mysql credentials in plugin

I've to create a custom plugin to print data from a database different from the wordpress one. I'm using wpdb. Is it fine, from a security point, to write database credantials in the plugin files in ...
0
votes
1answer
21 views

Site is continuously accessing by several IPs

I have high traffic wordpress blog, but for last two days i am constantly getting the error "Error establishing a database connection". I have called to my hosting customer care and they are saying ...
0
votes
2answers
750 views

FORCE_SSL_ADMIN not working

Any ideas why define('FORCE_SSL_ADMIN', true); wouldn't work? I'm not getting any errors at all, but a http request to example.com/wp-admin isn't redirecting to https
0
votes
0answers
58 views

What is the best way to upload a temporary & sensitive file and then delete it when done

What is the best way to upload a temporary & sensitive file and then delete it when done. I'm writing a plugin (eventually for multisite) that allows users with a certain role to upload a .csv ...
0
votes
0answers
532 views

Why WordPress not logout after I have close my browser?

The default login cookie has expiry time as "session", so suppose when I close my browser, I need to login again when I visit wp-admin. But I've found that serveral time I've closed my browser (kill ...
0
votes
1answer
33 views

How to display post meta data in secure manner

I have have a custom post meta field where I can add a embedding code (a video for example, an iframe). Now I want to retrieve the code from the post meta and display it securely. I can display it ...