Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

0
votes
1answer
120 views

Allowing Users to Register Themselves and Post : Does WordPerss Handle these Problems?

If one allows visitors of a WordPress blog to register themselves and post to the blog without moderation(i.e. without submit for review), malicious visitors may try to 1)Post a large number of posts ...
0
votes
3answers
400 views

WP Insert Post If user refreshes override new post

WP Insert Post is a very simple and easy to use function. Currently I have it set up on event triggered by whether a user is logged in during a booking to ratify their booking in its own page. My ...
0
votes
1answer
328 views

security concerns if using html data-* attribute for l10n?

I need to pass a localized multidimensional javascript object to a page. The object is constructed using php and represents some wp-theme settings. I cant find a way to utilize wp_localize_script for ...
0
votes
1answer
170 views

Secure Server after configuration

Recently I purchased a VPS from intovps.com, And first time I configured a fully unmanaged VPS through ssh comands. My website is working into it, properly. Now I just want to know how to secure it? ...
0
votes
1answer
558 views

404 errors when updating options in admin dashboard

Whenever I try to update my Permalink settings or use the Theme Editor to modify some file, I am redirected to a 404 page. This also happens when I update the All-In-One SEO Pack plugin's settings. ...
0
votes
0answers
20 views

Disable or Modify Access-Control-Allow-Origin from Response Headers

I would like to know is that possible to modify or remove Access-Control-Allow-Origin from Response Headers Due to security reason, I need to change Access-Control-Allow-Origin from * to domain I ...
0
votes
1answer
19 views

Using wp_localize_script in template file - is it secure?

I have the following code inside one of my template files (NOT functions.php) $datatoBePassed = array( 'pageTitle' => get_the_title() ); wp_localize_script( 'main-js', '...
0
votes
1answer
17 views

My site thinks it's secure when it is fact not

My site is loading enqueued content over HTTPS while it is not a secure site. I have a couple PHP sites behind a load balancer with a proxy ssl certificate on one other domain. This site does not ...
0
votes
1answer
36 views

What is the best practice for restricting a section to logged in users?

As a newbie, I've had a hard time finding a good starting point. I believe my case is fairly common and maybe this question has been answered comprehensively elsewhere. I am creating a simple site ...
0
votes
0answers
8 views

Is it possible to only have the admin interface bind to the local loopback?

I was wondering if it's possible to bind only the admin interface (and not the page) to the local loop back address? For purposes of keeping the wrong people off the administrator interface with SSH.
0
votes
0answers
19 views

Mitigating Bruteforce attempts server wide

We host several WordPress sites on a VPS and see brute force attempts across each site. WordFence is in operation on each. Where we can manage the DNS the site sits behind Cloudflare. Can't help ...
0
votes
1answer
7 views

Require confirmation of current user's email before updating database and before send_email_change_email

I like the core ability for users to update their default "Email" field. For example username1 can edit their own profile and change their "Email" field from email1@example.com to email2@example.com ...
0
votes
0answers
32 views

Sanitization Function in Wordpress (Example Twentyfifteen.1.4 Default WP Theme)

The ThemeForest Submission Requires some sanitization functions that should be incorporated in the theme - This page says this. The WordPress theme should make use of the following inbuilt ...
0
votes
2answers
33 views

Using an Encryption class in a WordPress Plugin

I'm making a WordPress plugin that works with sensitive data. So I need to store/retrieve date with a trusty encryption method. I did some searches among many php encryption wrapper classes, and ...
0
votes
2answers
60 views

Filter and validate user role in registration

I want to show a select box for user roles in the registration form. I am using this model: /* ROLES IN LIST REGISTRATION */ // 1. Add a new form element... add_action( 'register_form', '...
0
votes
0answers
19 views

Wordpress security - hiding WordPress directory [duplicate]

Note: edited my post to make it more "is it useful?" than "how to do it?" after toscho marked it as duplicate (the post tosho referenced is more or less what I had in mind for the "how to do it" part)....
0
votes
0answers
24 views

About plugin security

I'm developping a couple of simple plugins for specific use, and want to do it right. I've read multiple pages about plugin security, including those. Now, considering that my plugins have for ...
0
votes
1answer
21 views

Dangers to allowing Access-Control-Allow-Origin: * for Feeds only?

I want to use a function like this to allow access to the feeds from a variety of services but my knowledge of the security implications is limited. I think I'm being safe by limiting the access to ...
0
votes
0answers
17 views

Logout via Subdomain, non-wordpress page on a different server?

Similar to the question over at Get wp_logout_url function to work on external (non-Wordpress) page The problem I am facing is the fact the subdomain is on a different server so I am unable to ...
0
votes
0answers
28 views

Upload file via settings page

Question: Is there a secure way to upload files via a plugin settings page? Context: Hello world! A feature of my plugin requires the user to upload one or more files. More precisely, JSON files ...
0
votes
1answer
27 views

What is more secure checking capabilities of user or checking role of user in WordPress plugin development

Suppose I need to check the logged in user is subscriber not anyone else. So if I check the capability like "read". Then subscriber is OK but "read" capability is also associated to admin/publisher as ...
0
votes
0answers
19 views

Cross site domain cookies in Wordpress (v4.x)

I have a plugin that executes an external script (outside of Wordpress) that i'd like to make 'more secure'. I'd like to make this script only accessible/executable when logged in as the Wordpress ...
0
votes
0answers
29 views

Vanilla Wordpress install, what can/should I put in disable_functions?

I would like to take steps to limit the damage a compromised Wordpress install can cause on the rest of my system. What system calls does Wordpress need? What can I put in the disable_functions ...
0
votes
0answers
51 views

PHP Code Sniffer - WordPress VIP Coding Standards

I'm trying to fix up my code to meet the WordPress VIP Coding Standards. I'm getting a couple of issues that I'd like to see go away, but i'm not sure what the best strategy is. The first issue is ...
0
votes
1answer
26 views

Webservice credential storage [duplicate]

I am developing a plugin that calls a web-service with a security header. Can anyone recommend a best practice for storing those credentials on the WordPress site? Right now my best option seems to be ...
0
votes
3answers
40 views

Directory to store secure file

I have a website hosted on ASP.NET server and using wordpress to build my site. I've extended its functionalities using PHP code. At which directory do I store secure files such as (passwords and ...
0
votes
0answers
77 views

AJAX - nonce verification fails

I have a simple add-to-newsletter widge. I created a hidden input with nonce: $nlnonce = wp_create_nonce("add-newsletter"); echo '<input type="hidden" id="nlnonce" value="'.$nlnonce.'" />'; ...
0
votes
0answers
14 views

Download security

I would like to create a secure download link for digital content e.g. PDFs, Zips etc. There's a few plugins that offer "secure downloads" but they just block the download page. I need it so the ...
0
votes
1answer
101 views

Force SSL on a single page which is used as iFrame

I have one WordPress page that only contains a shortcode for a slider and is used by other websites as an iFrame. I need to force SSL one this one single page, but whatever I try, it is not being ...
0
votes
1answer
93 views

Being hacked. Is there a list of Wordpress security holes I can check against?

I observe a file being uploaded into various plugin folders in my Wordpress site. The file is used to send out spam from my server and every time I remove it it gets uploaded to another folder. There ...
0
votes
0answers
33 views

Some crawlers/bots attempting to login with very good guesses. How?

I am trying to figure out if wordpress exposes the user e-mail or any other user information to crawlers/bots? I have a couple of security plugins that have been blocking these bots IPs on the third ...
0
votes
1answer
32 views

How to distinguish between a hack and an encoding error?

This morning I was working with a new image gallery plugin. After two hours of working with it, our server was struggling with a heavy network traffic, and then the server appeared to go out. ...
0
votes
2answers
258 views

Allow SVG in WP step by step

I'm not strong in WP programming, bu I try to understand what to do to enable SVG in my site. I found that in need to add function below to functions.php: /** * Add SVG capabilities */ function ...
0
votes
1answer
349 views

.htaccess password protection bypassed

I’ve created .htaccess password in order to add a layer of security to a WordPress installation. The .htpasswd file is located one level above the installation. Yet, I’ve seen brute force attack ...
0
votes
1answer
224 views

Downloading File from Outside Web Root

I've set up some code to download zip files that exist in a folder above the web root. The download will be triggered from a user account page within WordPress. They don't need to be bank-level secure,...
0
votes
1answer
37 views

Hash user emails in database?

I have a wordpress based website, a very important thing is that no one should get to know the email addresses of the people who will admin. I will make the whole website private but I am still ...
0
votes
0answers
261 views

wp_verify_nonce fails always

I have created nonce fro my plugin and trying to verify it with another plugin pages. it fails always. both we are creating nonce with same parameter. why it fails. Plugin name : Wordfence it creates ...
0
votes
0answers
29 views

Server misconfiguration- Protect WordPress core files correctly from being called directly?

With a fresh WordPress 4.3 installation I have the following problem: If I call URLs like http://www.example.com/wp-admin/menu.php the script is executed directly. Is this a security issue which ...
0
votes
0answers
26 views

wordfence reports exploited files but nothing visible when I edit file on server

Wordfence is reporting exploit code on some of the empty idnex.php files asswell as wp-config.php but when I access these files via ssh I see no malicious code. Wordfence reports this malicious code ...
0
votes
0answers
36 views

Is wp_kses safe against XSS

Is this code safe against complex types of XSS attack? $v = wp_kses(esc_attr( $bad_input ), $allowed); where $allowed = array( 'a' => array( 'href' => array(), 'title' =&...
0
votes
1answer
42 views

Suspicious lines of code

Our company website was handed to me and source code was created by previous person. I noticed that there are lots of . I am getting suspicious with these I have the urge to delete these 18 lines of ...
0
votes
1answer
67 views

Password-protect feed and make it usable in major aggregators

A WordPress site I'm on uses WordPress's default cookie-based authentication. This means that the RSS feed of the page is password-protected and can only be read when the cookie is available. ...
0
votes
0answers
23 views

WordPress and user security

When we talk about Information Security, many things come into mind and people tend to use CMS to be clear on security as CMS people do the job for you, in terms on hashing passwords, encryption etc. ...
0
votes
2answers
37 views

Secure Multiple WordPress Installations on shared hosting

Most shared hosting packages store all files of a given user under something like /user/myuser/www/ or /var/html. Addon domains are usually located under /var/html/domain1.com/, /var/html/domain2.com....
0
votes
0answers
107 views

Best way to handle unregistered users as a unique idenitifier

I have a voting system for specific type of posts (site), similar to reddit, and I want to allow unregistered users to vote. In order to keep the voting count as valid as possible, I am thinking ...
0
votes
3answers
262 views

Headers already sent error after upgrading wordpress to 4.2.2

in wordpress version 3.6 and 3.7 everything works great, but with version 4 and above I get: Cannot modify header information - headers already sent the problem line is: header('Location: '. $...
0
votes
1answer
335 views

wp-content - permissions for files/folders created by apache

My wp-content folder has owner 'User' and group 'www-data'. The permissions are 775 for folders and 664 for files, so the server can write inside folder. But when the server creates folder and files ...
0
votes
1answer
138 views

WP upload/select image , isn't this a security issue?

If in image upload frame I select a zip http://prntscr.com/6ypjlv, it does not show it in list of files but it is up http://prntscr.com/6ypjvp shouldn't we only be able to upload image types if ...
0
votes
1answer
532 views

Single sign-on: wp_authenticate_user vs wp_authenticate

I have a wordpress site (lets call it site1) and another site with oauth2 (site2). When a new user is created, a record is created in both site1 and site2 databases with the same email as username, ...
0
votes
0answers
416 views

Collecting Sensitive Data in Wordpress?

I am in need of creating an online application form that collected a users SSN number and am therefore concerned with security. Is this possible to do on WP with existing plugins? My research thus ...