Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

0
votes
1answer
100 views

WP upload/select image , isn't this a security issue?

If in image upload frame I select a zip http://prntscr.com/6ypjlv, it does not show it in list of files but it is up http://prntscr.com/6ypjvp shouldn't we only be able to upload image types if ...
0
votes
0answers
45 views

esc_url within iFrame

I'm building a WordPress theme. To improve security, I'm escaping any URLs, like so: <?php $background = wp_get_attachment_image_src(get_post_thumbnail_id($post->ID), '' ); ?> <div ...
0
votes
1answer
380 views

Single sign-on: wp_authenticate_user vs wp_authenticate

I have a wordpress site (lets call it site1) and another site with oauth2 (site2). When a new user is created, a record is created in both site1 and site2 databases with the same email as username, ...
0
votes
0answers
69 views

Post meta sanitization and escaping

I'm writing a plugin that adds a text meta box where user enters (supposedly) media URL, which then is displayed in posts with $featured_media = get_post_meta( $post_id, '_meta_key', true ); echo ...
0
votes
0answers
278 views

Collecting Sensitive Data in Wordpress?

I am in need of creating an online application form that collected a users SSN number and am therefore concerned with security. Is this possible to do on WP with existing plugins? My research thus ...
0
votes
1answer
109 views

How can i see/log all requests coming from a registration form (not from the UI)?

I am talking about the REGISTER form PROBLEM: I have some requests that are coming from somewhere else - not from the user interface. I know this, because these requests don't have all the mandatory ...
0
votes
0answers
12 views

Why are maintenance releases now auto-update? [duplicate]

When the recent 4.1.1 was released, I thought it must be an important security update, as it's going out to all sites automatically. Reading through the changelog, I found it actually doesn't mention ...
0
votes
2answers
924 views

How to sanitize select box values in post meta?

I have added a select box in the Post meta. Here is the code, and it works fine. My question is, do I need to sanitize the values before updating the post meta? If yes, how it should be done? This is ...
0
votes
1answer
209 views

Stop Plugin Enumeration [closed]

Is there any way to stop plugin enumeration? I have tried Acunetix WP Security plugin, It seems to work but Yoast SEO plugin is still enumerating. Any plugins or code modifications are appreciated. ...
0
votes
1answer
46 views

Write mysql credentials in plugin

I've to create a custom plugin to print data from a database different from the wordpress one. I'm using wpdb. Is it fine, from a security point, to write database credantials in the plugin files in ...
0
votes
1answer
20 views

Site is continuously accessing by several IPs

I have high traffic wordpress blog, but for last two days i am constantly getting the error "Error establishing a database connection". I have called to my hosting customer care and they are saying ...
0
votes
1answer
586 views

FORCE_SSL_ADMIN not working

Any ideas why define('FORCE_SSL_ADMIN', true); wouldn't work? I'm not getting any errors at all, but a http request to example.com/wp-admin isn't redirecting to https
0
votes
0answers
54 views

What is the best way to upload a temporary & sensitive file and then delete it when done

What is the best way to upload a temporary & sensitive file and then delete it when done. I'm writing a plugin (eventually for multisite) that allows users with a certain role to upload a .csv ...
0
votes
0answers
385 views

Why WordPress not logout after I have close my browser?

The default login cookie has expiry time as "session", so suppose when I close my browser, I need to login again when I visit wp-admin. But I've found that serveral time I've closed my browser (kill ...
0
votes
1answer
1k views

How do I properly update the Wordpress database password?

A site that I manage was recently compromised and I am going through the steps to harden and re-secure the site. I would like to change the MySql database password and want to make sure I do not take ...
0
votes
1answer
33 views

How to display post meta data in secure manner

I have have a custom post meta field where I can add a embedding code (a video for example, an iframe). Now I want to retrieve the code from the post meta and display it securely. I can display it ...
0
votes
2answers
254 views

How to create a private login page for admin.?

Can I create a login page, which could be entered all registered visitors, but were not allowed entrance to the administrator, even if he has entered the correct username and password? For admin I ...
0
votes
1answer
101 views

How can I save a password securely as a settings field

I have a plugin that requires the user to enter a password (to access an external site) into a form field on the plugin settings page. Right now this is just saved as plain text, but I need to make it ...
0
votes
1answer
182 views

wp_create_nonce function doesn't work inside a plugin?

I am writing a WordPress plugin which is creating a form in one of its functions. It looks like this (very simplyfied): class MyPlugin { public function createForm() { $nonce = ...
0
votes
1answer
145 views

Any way to disable /wp-login.php redirecting to the site folder?

We have our WP installs in folders on the server. We created folders called wp-admin and login to thwart hackers. However, incredulously, when you type in /wp-login.php it REDIRECTS to our ...
0
votes
1answer
879 views

Change Login URL Without Plugin

I want to change the login url of my Wordpress install away from /wp-admin.php I am aiming to do so and am looking at changing the .htaccess file to add in: RewriteRule ^login$ ...
0
votes
1answer
35 views

Should I change the default file and folder permissions?

After reading the Hardening WordPress article I realise a good permission scheme is essential to the security of my WordPress installation. The article suggests a possible permissions scheme but my ...
0
votes
3answers
44 views

How can I restrict access to specific parts of a page, not just the page itself?

I looked at WP's site and didn't see a role I could use. I can create my own, but how do I limit the content on the page itself? Some private and some public information can be on the same page. I ...
0
votes
2answers
88 views

Is there a way to remove the option to modify the Slug in post.php

I am trying to remove the option to edit the Permalink. I know how to hide it with CSS and I have. But a hacker could simply just go to Inspect Element and change display: none; to display: block; ...
0
votes
1answer
419 views

Which WordPress scripts need to be executable for a fresh installation?

For security reasons I need to block access to scripts that will not be executed on a fresh WordPress installation. Example: /index.php --> needs to be executable /wp-includes/cache.php --> should ...
0
votes
0answers
53 views

Background Updates Not Happening

I have some sites which are not updating with the background updater. I installed the Background Update Tester plugin and everything looks fine. Currently they are at 3.9 but they are telling me that ...
0
votes
0answers
33 views

Folder Permissions + Security Concerns

I messed up bad guys. I while working on another part of my website I accidentally nuked my WordPress folder permissions. I was able to find/fix some problems and I got my site up and running but some ...
0
votes
1answer
22 views

Validating values using Settings API?

I'm using the Settings API to create options for plugin. Do I need to validate the input values for the security (for example stripslashes etc)? (I could not find that part in most of the tutorials). ...
0
votes
1answer
184 views

using .htaccess only for wordpress security no plugins

Right now I am using bulletproof wordpress security for my websites, but when i am installing W3 Total Cache plugin it gives me some errors related to .htaccess file and bulletproof wordpress security ...
0
votes
0answers
37 views

How to get WP to run plugin code triggered by an external site hook?

I have written a plugin to sync data from a WP blog to an external website. Changes to made to the external site also sync back to the WP blog. Right now the external website executes a POST request ...
0
votes
0answers
452 views

WordPress it's cleaning a custom query_var to avoid sql injections?

I am using get_query_var function to get a custom query_var. This query_var will be used later in to query arguments to retrieve posts with: $the_query = new WP_Query( $args ); . My question is, ...
0
votes
0answers
154 views

SWF in wordpress post

My question is somewhat a two part question. First I embedded a SWF file into my blog post using Easy Flash Embed plugin. It shows up on my desktop computer but when I view the post on my mobile ...
0
votes
1answer
80 views

404 errors in log showing urls with 'GET', plus and numerical code

My wordpress logs show 404 errors to URLs having the following pattern: http://example.com/path/++GET+http:/example/+0,48595,73506+- Web searches do not return answers because of the plus and minus ...
0
votes
0answers
174 views

wp-config.php file and code injection

It looks like several my sites on BlueHost got code injection in the wp-config.php file. Injected code itself looks like Any clue where it comes from? BH malware scan doesn't recognize that code so ...
0
votes
2answers
25 views

Regarding plugin security

Is there any guarantee that the plugins I find on the wordpress site are legitimate and don't have any malicious code in them? Or is it up to me to check them? If so, what would be the best way to do ...
0
votes
2answers
149 views

How can I create a private site that is inaccessible from the outside?

I need a safe place where I can store data about projects that I am working on. This data includes text and files (pictures, sound and video). I want to create a private "blog" for this purpouse that ...
0
votes
1answer
313 views

Troll the hackers by redirecting them

My website is getting somewhat popular, and with the it's increasing popularity there's an increase in the hackers. Last night I visited my security logs and found that everyday approximately 10 ...
0
votes
0answers
548 views

Can I make an ajax response cross-domain?

I am trying to make a single ajax response cross-domain. Is that possible? I tried something like this, but that did not work: function my_call_callback() { header("Access-Control-Allow-Origin: ...
0
votes
0answers
100 views

Wordpress exploited theme is causing high io load on server

I used a Wordpress theme for a while that was causing high IO-load on my server. That was because there was some kind of exploits made/available for the theme: ...
0
votes
0answers
11 views

Configuration File Safety [duplicate]

I'm new to PHP and WordPress and I've a few questions to ask about database and configuration file security. I hope you answer them. When I try to reach some wp sites config file by typing ...
0
votes
0answers
174 views

Why are xmlrpc.php and wp-cron.php being called so often?

I'm running a Wordpress website and I have found from the server logs that xmlrpc.php and wp-cron.php are being requested (POST requests, of course) very frequently--including some suspicious ips that ...
0
votes
1answer
48 views

Is it necessary to use a WordPress nonce when allowing users to download public data?

I am using jQuery .load() to load the next page of WordPress posts after a button is clicked. The next page of posts is public data (no access restrictions on it whatsoever). Should I use a WordPress ...
0
votes
0answers
161 views

Hide wp-login.php but not the widget

I have a website which is still under nascent construction stage: http://42charts.com . Lately I find that couple of users are registering themselves in my site. It seems like a bot as the mails IDs ...
0
votes
1answer
96 views

Able to go to WordPress admin even after deleting auth cookies from request headers

I discovered that if I remove my auth cookies from my browser's request header, I am still able to view a page. Steps: Log into my WordPress installation Go to the wp-admin page In Chrome, use the ...
0
votes
1answer
106 views

User meta and public function security

I am using stripe to setup a system of buying credits, which can be used on my wordpress site. I save credits using wordpress user meta, and I increment those credits after a successful transaction ...
0
votes
2answers
1k views

How to rewrite rules for WP-security in Nginx?

I have a WordPress website on a VPS running nginx. I have installed the WP Security plugin to improve the security of my site. After changing all the settings to my liking, a pop-up notifies me that I ...
0
votes
0answers
17 views

Alternative ways to make ajax requests in wordpress [duplicate]

I'm currently having a problem with working with AJAX. Well not really a problem since I can pretty much do what I want to do. The only problem is my boss saying that the admin-ajax.php file is an ...
0
votes
0answers
15 views

Security: How to disallow viewing/browsing by author? [duplicate]

I've already inserted htaccess code to disallow searching for users by numeric id. However, one can still manually input a user name to view/browse by author, e.g. http://mywpsite.com/author/peter/ ...
0
votes
0answers
468 views

Nonces and Cache

It's clear that form submissions and AJAX requests, especially sensible ones, need "nonces" to avoid certain exploits. However, with heavy use of caching systems it becomes harder to generate them ...
0
votes
1answer
51 views

Restrict Content for only Contributors via .htaccess

I have been using this code to restrict content download from wp-content/uploads for only logged in users: RewriteEngine On RewriteBase / # Add these lines right after the preceding two ...