Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

0
votes
1answer
50 views

Restrict Content for only Contributors via .htaccess

I have been using this code to restrict content download from wp-content/uploads for only logged in users: RewriteEngine On RewriteBase / # Add these lines right after the preceding two ...
0
votes
0answers
280 views

Malware/Permission bug removal?

I'm facing a hell of a problem on a client's WP theme. Whenever I try to 'Activate' it, it gives me the following errors on a blank page: Warning: ...
0
votes
0answers
20 views

Permission of uploads folder [duplicate]

My Wordpress site was hacked today. When I investigated, I noticed that there were some malicious files under wp-content/uploads/ folder. I had set the permission of uploads folder to 777 for ...
0
votes
0answers
21 views

What is the Best Way to Secure a Commercial Wordpress Plugin? [duplicate]

A friend has built a very powerful Wordpress plugin that was build mainly for his own use - and now he is considering opening it up to the public by selling it, but... But he's concerned that it will ...
0
votes
0answers
53 views

Allowing access to certain Wordpress created pages or posts with htaccess / htpasswd

Trying to figure out how to give access to a certain page, lets say http://mypage.com/page and not letting people access the main index via http://mypage.com. Or just simply disallow access to ...
0
votes
1answer
187 views

Unwanted Links and Spam Wordpress Pages and Posts

In webmaster tools I have a number of crawling errors of the Google spider. for example http://mydomain.com/my-page/de/roulette.html They say they cannot crawl to this page.. but what kind of page ...
0
votes
0answers
61 views

checking the form submit in right order

With help from experts on this site, I have been able to put together a plugin that allows to choose and submit categories from the front-end. Further, in order to make it a bit more secure I have ...
0
votes
0answers
106 views

Form That Submits Content Securely

I have built a WP site for a client. One of the pages has a form which my client's customers will use to submit material to my client, and one of the required fields is a file upload. My client ...
0
votes
0answers
41 views

False URL for shopping cart

OK. Re wording my question I have a digital product on a wordpress site Using a shopping cart I'm charging .99 cents for people to look at a video (going to charity) The cart directs them to a page ...
0
votes
0answers
35 views

Malware installation during plugin update?

I update my wordpress blog daily (current version: WordPress 3.5.2). Today I installed an update of "Search everything". After that, my webspace was infected by malware. Interestingly, my blog is ...
0
votes
0answers
28 views

Is [admin / admin] acceptable for all local websites?

Are there security issues with using the same credentials [admin / admin] for all client websites on a working, local server ?
0
votes
1answer
96 views

Trying to understand nature of hacking

Today we saw suddenly two files created in root folder in one of our wordpress websites - file name owp.php and gmail.html On investigating the access logs following entries were found which seem to ...
0
votes
1answer
289 views

If I use an alternative login (e.g. CAS or other SSO) plugin, is my site protected from the recent brute force login attempts?

I've been hearing about the recent increase in brute-force WordPress login attempts due to a massive botnet attack. Everything I've read so far indicates that the attack works by just trying different ...
0
votes
1answer
171 views

Data Validation, dynamically generated fields (select for example)

Working to secure my plugin, I'm not sure what (if anything) to do about output such as dynamically generated select fields. For example, I have a country code select generated on the backend via PHP ...
0
votes
1answer
162 views

Is it safe use wp_editor in public contact form

I'm going to make a contact form for my site, and i want to use WYSIWYG editor (wp_editor) in my form message field. Here is my question, is that safe use wp_editor in public though disable media ...
0
votes
2answers
133 views

force login loophole

I want to restrict access to my wordpress site to allow registered users only. I have tried the following plugins: Require-login Authenticator WP-lock All of them have the same problem: After ...
0
votes
2answers
241 views

File permissions for wp-minify plugin

I am worried on installing Wp-Minify plugin. But it needs 777 permission for the cache directory located inside wp-uploads directory. Isn't it a security issue?
0
votes
1answer
62 views

How 'secure' are loops?

I am using loops as means of displaying personal meta and customer information on the frontend. For example, I have a page which displays a user's 'profile' information to edit. Their profile is ...
0
votes
1answer
87 views

Basic File/Post restriction plugin

I am looking for a plugin that allows me to restrict access for a individual post/page to a specific role or individual. It also needs to restrict files attached to that post. I have tried several ...
0
votes
1answer
1k views

Problem with permissions in wp-content/plugins

I have a WP installation on my local machine and trying to get my hands dirty with plugins. I wish to clone a project from github which has this plugin code. However, i dont have the permissions ...
0
votes
1answer
573 views

How to rename the WordPress wp-login.php running on IIS6?

My Windows 2003 VPS recently hang due to bots hammering my WordPress login php non-stop for hours (determined from IIS6 logs). This caused MySQL to use up all the allocated 1G RAM. After resetting ...
-1
votes
3answers
1k views

Wordpress Hacks/Defacing [closed]

Im trying to figure out how Wordpress sites become defaced/hacked. I know development very well. I know how to secure code, etc. But I am finding recently, that tons of Wordpress sites are becoming ...
-1
votes
2answers
2k views

How to improve WordPress security by hiding non public facing files?

e.g. curl -I http://ma.tt/blog/wp-config.php 200 OK The wp-config.php is not public facing file, since it currently just return blank page, so why not return 404 instead. (so will not be cached by ...
-1
votes
3answers
4k views

nginx + wordpress: Best practices for configuring it to be secure, reliable, and fast? [closed]

BACKGROUND: Running everything up on Linode. Having followed the "Getting Started," "Securing Your Server," "LEMP Server on Ubuntu 12.04," and the "Manage Web Content with WordPress" guides I was ...
-1
votes
1answer
374 views

suspicious boolean.php file in wp web root [closed]

Today I noticed in my web root a suspicious php file: boolian.php and serveral .html files with random names, all containing trojans. I remember yesterday I just uploaded and activated few themes I ...
-1
votes
1answer
23 views

Website that sells statistics

I'm building a website that will have statistics based on user activity on the website (online votes and views etc). People will have to pay to view those stats. I am utilising wodpress features ...
-1
votes
2answers
133 views

hardened wordpress linux install

Are there any best practices for wordpress hardened install on Linux? I have recently had a WAMP server get malware attacked via word press so I want to harden the server up using read only apache ...
-1
votes
1answer
197 views

Default installation permissions for wp-config.php

Recently I've noticed that many of the wordpress installations we have on our servers where being attacked and ifected by this thing ...
-1
votes
2answers
1k views

Securing Contact Form 7 [closed]

I have a client who's website I created with Wordpress. It has a contact form created with contact form 7. This client is a subsidiary of a larger organization who's IT department runs scans on their ...
-1
votes
1answer
146 views

Will my Wordpress site become vulnerable after adding this functions which allows more HTML tags for subscribers?

I was thinking of adding the following lines of code to my functions.php file: /** * Change the default list of allowed html tags */ add_action('init', 'edittag', 10); function edittag() { ...
-1
votes
1answer
296 views

How to protect wp-admin from third party access?

How can the wordpress administration panel and the login page wp-login.php be hidden such that only the website administrator can access it? Can the URL be rewritten through some mod_rewrite rule ...
-1
votes
3answers
108 views

What techniques can a user employ to achieve a password rated “strong” in the WordPress password checker

I have strong passwords enforced for all my clients but I got some complaints recently as some users tried to change their password and gave up trying to achieve a strong rating. I was initially ...
-1
votes
1answer
25 views

is this code properly secured

The input will be an address. This is what I gather from looking at the Codex. See here: codex $wpdb->insert($address_table, array('address' => $address),array('%s'));
-2
votes
5answers
3k views

Is it a bad idea to CHMOD 777 all the files on your site?

I think i heard that it might pose a security threat to your site, is that right? Makes it more vulnerable to it getting hacked? How should I undo this, which files should be chmod to what number?
-2
votes
2answers
126 views

Is this a WordPress security bug?

<?php if ( ! is_admin() ) return; echo 'You should not see this if you\'re not logged in!'; ?> If you put this in a mu-plugin, and go to your admin, e.g., example.com/wp-admin/ while you are ...
-2
votes
1answer
1k views

Step by Step Instructions for Making Media/Uploads Private to Only Logged-In Users

all. I found this site via a Google search that led me to this topic: How to Protect Uploads, if User is not Logged In? It looks like that solution would work for my situation (including hakre's ...
-2
votes
2answers
2k views

Is there a secure way for the public to submit images, videos, and documents using WordPress?

I want the public to submit images, photo simulations, models, video, animation, illustrated narration, papers and other publications and multimedia. images - 30" x 42" 300 dpi . pdf format file size. ...
-3
votes
3answers
188 views

Should WordPress Add Options to Enhance Security or Leave it to plugin developers?

Based on the passion engendered with the responses to this question. It appears that the answer is a resounding "Nothing!" or "leave it to plugin developers to handle, WP is already secure enough"... ...
-3
votes
1answer
53 views

How to make a WordPress site unhackable (except during during upgrade/plugin update)?

We've had numerous cases where client's WordPress based sites have been hacked due to various reasons, mostly related to a unsecured PHP file inside a theme allowing POST uploads and planting a ...