Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

-3
votes
0answers
7 views

What's the nature of latest WooCommerce security issues? [on hold]

I've seen that WooCommerce 2.2.8 and 2.2.9 have been security releases. However, the changelog does not say anything about the nature of these security issues (nor do the related github commit ...
4
votes
2answers
1k views

wp.getUsersBlogs XMLRPC Brute Force Attack/Vulnerability

After the holiday weekend, one of the larger sites I manage had a brute force attack on it. The attacker was attempting to use the wp.getUsersBlogs function and a list of popular usernames and ...
0
votes
1answer
19 views

What is a PHP firewall plugin? [on hold]

I would like to know what do PHP firewall do and do they protect all wordpress sites even sites that are not written in PHP.
0
votes
0answers
12 views

Is it good practice to use WordPress nonce values to restrict page access?

I'm working with a colleague on a WordPress plugin. Part of the plugin functionality is showing dynamic lists with links which allow you to open a new page. Depending on the user's role, they may or ...
0
votes
1answer
14 views

Site is continuously accessing by several IPs

I have high traffic wordpress blog, but for last two days i am constantly getting the error "Error establishing a database connection". I have called to my hosting customer care and they are saying ...
3
votes
1answer
511 views

Is it true $wpdb->get_results is faster than WP_Query in most cases?

On my homepage, I have a section where I have to display the last five featured posts, where a featured post is simply a post with a custom field is_featured set to 1. I achieved what I want with two ...
0
votes
1answer
13 views

FORCE_SSL_ADMIN not working

Any ideas why define('FORCE_SSL_ADMIN', true); wouldn't work? I'm not getting any errors at all, but a http request to example.com/wp-admin isn't redirecting to https
0
votes
0answers
20 views

What is the best way to upload a temporary & sensitive file and then delete it when done

What is the best way to upload a temporary & sensitive file and then delete it when done. I'm writing a plugin (eventually for multisite) that allows users with a certain role to upload a .csv ...
9
votes
5answers
4k views

Can I Prevent Enumeration of Usernames?

Can I prevent enumeration of usernames on my wordpress site? I can see users at the moment using the WPScan tool.
0
votes
0answers
31 views

Why WordPress not logout after I have close my browser?

The default login cookie has expiry time as "session", so suppose when I close my browser, I need to login again when I visit wp-admin. But I've found that serveral time I've closed my browser (kill ...
0
votes
1answer
34 views

How do I properly update the Wordpress database password?

A site that I manage was recently compromised and I am going through the steps to harden and re-secure the site. I would like to change the MySql database password and want to make sure I do not take ...
0
votes
1answer
44 views

Found WordPress Site's Index.php File Changed / Spammed / Hacked - Where to Begin Inspection Procedure? [closed]

I saw that one of the sites I've been working on have it's index.php file changed with some weird code. Which is not a deliberate action of mine, then it means that someone has access to my hosting ...
0
votes
1answer
20 views

Why isn't the login page rate limited by default?

Brute force attacks seem to the be most common vulnerability on WP installs and rate limiting ought to be relatively easy to bake into WP itself as part of the official, default software (without the ...
0
votes
0answers
8 views

Does adding nonce in save_post hook for every metabox really improve security? [duplicate]

I see a lot of example [1] that introduce the checking of nonce in the save_post callback of a metabox. e.g. function smashing_save_post_class_meta( $post_id, $post ) { /* Verify the nonce before ...
0
votes
2answers
376 views

Wordfence detects change in wp-admin/includes/upgrade.php

I moved my site from hosting provider A and domain name B to hosting provider X and domain name Y. I had Wordfence in the old site. I just installed it in the new site and ran a scan. Wordfence found ...
0
votes
1answer
16 views

How to display post meta data in secure manner

I have have a custom post meta field where I can add a embedding code (a video for example, an iframe). Now I want to retrieve the code from the post meta and display it securely. I can display it ...
4
votes
2answers
4k views

Limiting sessions to one IP at a time

On a site with premium user account subscriptions, I'd like to be able to limit logins to one computer at a time. The most straightforward way to accomplish this would be to limit by IP, but I haven't ...
1
vote
1answer
80 views

Evaluations of two wordpress security plans against php code injection attack

Senario: I've posted one wordpress php code injection senario on SO before, ...
2
votes
2answers
423 views

Subscribe to email for security fixes?

Is there any email alert list for security fixes? I'd rather not rely on just an RSS feed.
5
votes
6answers
199 views

Share same domain for wp-admin but for different website

I have site like http://www.foo.com http://www.bar.com And I've a wildcard SSL cert *.example.com, instead of buying two SSL certs for the above two domains, can I re-use my existing wildcard SSL ...
1
vote
1answer
28 views

Moving away from MD5: Where to declare the custom global $wp_hasher?

I want to move away from using MD5 for hashing passwords in the database. The plan is to declare a custom global $wp_hasher as hinted at in the docs for wp hash password(): Unless the global ...
0
votes
1answer
17 views

Custom RPC end-point security best pratice?

I trying to figure out how a custom entry point can be secured without loading the entire WP-stack. The built-in AJAX entry point is pretty slow and actually unusable on sites with lots of plugins. So ...
0
votes
0answers
10 views

How would I have to change rewrite rules to use a custom ms-files.php

I've previously wondered about securing file access by non-logged in users who know the full URL in multisite. When ms-files was still used modifications to this file allowed a basic form of WP-run ...
0
votes
2answers
58 views

How to create a private login page for admin.?

Can I create a login page, which could be entered all registered visitors, but were not allowed entrance to the administrator, even if he has entered the correct username and password? For admin I ...
5
votes
1answer
4k views

simple solution for restricting access to (some) uploads/downloads

Initial Situation For a site I'm setting up I was looking into the whole field of securing uploads/downloads and restricting access to them based on user roles/capabilities. Of course I have read ...
0
votes
3answers
292 views

WP Cron doesn't save <iframe> or <object> in post body

I am using wp_cron to auto grab posts from a remote website and save them in my wp db. NOTICE! I am executing my code from my plugin, not from my template functions.php or somewhere else. I have my ...
0
votes
0answers
213 views

Nonces and Cache

It's clear that form submissions and AJAX requests, especially sensible ones, need "nonces" to avoid certain exploits. However, with heavy use of caching systems it becomes harder to generate them ...
0
votes
1answer
28 views

How can I save a password securely as a settings field

I have a plugin that requires the user to enter a password (to access an external site) into a form field on the plugin settings page. Right now this is just saved as plain text, but I need to make it ...
2
votes
5answers
365 views

Upgrading Wordpress 4.0 asks for FTP password

I was able to upgrade Wordpress 4.0 on my local machine, and I also just updated some plugins on the production machine, but when I try to update Wordpress 4.0 on the production machine, it is asking ...
0
votes
1answer
31 views

wp_create_nonce function doesn't work inside a plugin?

I am writing a WordPress plugin which is creating a form in one of its functions. It looks like this (very simplyfied): class MyPlugin { public function createForm() { $nonce = ...
1
vote
1answer
42 views

Is it safe to allow non-admin users access to media uploader

Hi fellow Wordpress users :) I wanted to ask is it safe to allow non-admin users access to WordPress media uploader. Can they inject a virus while uploading media? How is WP system fighting against ...
0
votes
1answer
48 views

Should I use wp_nonce_field on my contact form?

I have created a self submitting contact form template and it works nicely, however when I was browsing the web in search for tutorials (for creating contact forms) I have noticed that some people ...
1
vote
2answers
308 views

Restrict Access in Admin Panel

I want to restrict access to certain plugin pages / normal WP Pages. I've found a way to Hide these pages from the menu but currently not restrict them. For instance, I have an editor and I don't want ...
0
votes
1answer
109 views

How to secure or disable the RSS feeds?

I'm trying to set up WordPress as a CMS. As such, I want to disable the feeds since it's mostly a secured site. I've gone through all the Settings pages but found no setting to tweak or disable the ...
0
votes
0answers
32 views

Any way to disable /wp-login.php redirecting to the site folder?

We have our WP installs in folders on the server. We created folders called wp-admin and login to thwart hackers. However, incredulously, when you type in /wp-login.php it REDIRECTS to our ...
4
votes
1answer
259 views

Securing wp-admin folder - Purpose? Importance?

I am trying to understand how to secure a WordPress site. One security task I do not understand is...How important is it to protect the "wp-admin folder"? For example, I would consider limit login ...
0
votes
0answers
23 views

Storing Facebook page token in the options table

I developed on few wordpress sites, the ability to publish a post or page to facebook with custom values. I am on the process of turning my code into a plugin but I want to make it the good way. I ...
0
votes
1answer
71 views

is_email() VS sanitize_email()

If I'm allowing a user to enter an email address to be saved into the database, should I use is_email() or sanitize_email()? Ex. update_user_meta( $user_id, $social_site, sanitize_email( ...
0
votes
4answers
75 views

Do we need to escape data that we receive from theme options?

I'm creating a Wordpress theme that I'm hoping to sell on Themeforest. Now I know much about escaping user inputted data using functions like esc_html, esc_url and so on and I use them in the comments ...
0
votes
0answers
19 views

How can I obscure the fact my site uses WordPress? [duplicate]

Is there anything I can do to prevent somebody from knowing my site is using WordPress by looking at the source code of the front page and trying to access the login page? I am referring to people who ...
3
votes
1answer
246 views

Security error WP 4.0 + WP phpBB Bridge [closed]

so today I updated to 4.0 (glad I had backup). Everything was working fine until I tried to publish a post. There I got Are you sure you want to do this. Also had Cheatin' Uh under ...
0
votes
0answers
113 views

Change Login URL Without Plugin

I want to change the login url of my Wordpress install away from /wp-admin.php I am aiming to do so and am looking at changing the .htaccess file to add in: RewriteRule ^login$ ...
10
votes
3answers
2k views

What could a hacker do with my wp-config.php

I am trying to secure my wordpress blog. I read some posts on the web that I should change my table_prefix and hide my wp-config.php. However, I do not get it? What could an attacker do with my ...
0
votes
1answer
27 views

Should I change the default file and folder permissions?

After reading the Hardening WordPress article I realise a good permission scheme is essential to the security of my WordPress installation. The article suggests a possible permissions scheme but my ...
1
vote
3answers
3k views

Protecting HTML5 video [closed]

I shall explain my situation as best I can so you can see where i'm coming from. I'm working on a wordpress site for a sports team, there are loads of teams. We want to put coaching sessions on our ...
0
votes
4answers
4k views

How to remove “Connection Information” requirement on localhost install of WP on MACOSX

I've just installed XAMPP on Mac OSX and when trying to install a theme or plugin in WP admin, I'm getting this screen. I've never gotten this on my shared hosting account. how to get rid of it on ...
1
vote
0answers
49 views

How do I get around “Sorry, this file type is not permitted for security reasons”?

I was wondering how I could allow .tiff files to be uploaded in my wordpress site. I get the message "Sorry this file type is not permitted for security reasons". This question has been asked in ...
7
votes
2answers
399 views

Why are passwords exportable as plain text in WordPress?

On my WordPress 3.9.2 installation can I extract the users plain text passwords by going to Users, select all users, and choosing Bulk Actions Export. When I look in the mySQL database with ...
1
vote
1answer
113 views

Is there a way to create a URL (new WP page) that can only be accessed from a specific source?

To explain further, here's what I"m looking to do: Create a WP page Use the URL and implement it in a reader service that is hosted (not downloadable) that in order to read (& access the URL) ...
5
votes
4answers
8k views

What are the recommended database permissions for WordPress?

I just got WP running on my own server. I am not trying to lock things down more. What permissions should the db user have to my WP db?