Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

-2
votes
0answers
12 views

Manual PHP code is showing only when WP logged in

Guys Please help me to solve a issue, I add echo 'test'; to footer. When I am logged in it showing me the output but when I open this link on other browser it doesn't shows the output. I am not ...
0
votes
1answer
33 views

How can i see/log all requests coming from a registration form (not from the UI)?

I am talking about the REGISTER form PROBLEM: I have some requests that are coming from somewhere else - not from the user interface. I know this, because these requests don't have all the mandatory ...
0
votes
2answers
23 views

How can I force a specific password?

How can I force a specific password for a specific user & not let that user change their password? I have a client that thinks that even if I force strong passwords via this plugin: ...
-1
votes
1answer
18 views

Website that sells statistics

I'm building a website that will have statistics based on user activity on the website (online votes and views etc). People will have to pay to view those stats. I am utilising wodpress features ...
1
vote
1answer
10 views

Using Contact Forms to Send Private Information [on hold]

I am working on a site for a Doctors Office who wants to use a contact form to send information about their patients to other offices....I was going to use contact form 7 but I'm wondering if there is ...
33
votes
10answers
23k views

Can I rename the wp-admin folder?

Is it possible to rename the wp-admin folder? I know I could just rename it, but unless it's supported by the code lots of things would break. If I use a custom folder name, it will make it slightly ...
4
votes
0answers
41 views

Should I check for ABSPATH in Themes? [duplicate]

I recently browsed WooCommerce source, and it appears that they're doing this: <?php /** * The template for displaying product content within loops. * * Override this template by copying it to ...
0
votes
0answers
16 views

Collecting Sensitive Data in Wordpress?

I am in need of creating an online application form that collected a users SSN number and am therefore concerned with security. Is this possible to do on WP with existing plugins? My research thus ...
0
votes
1answer
21 views

What highest security brake with wordpress and static files?

I want to build my sites with Wordpress files that can't be modified and dirs where new files can't be added. Static content with permission without possibilities to execute, that will served by ...
0
votes
0answers
12 views

Why are maintenance releases now auto-update? [duplicate]

When the recent 4.1.1 was released, I thought it must be an important security update, as it's going out to all sites automatically. Reading through the changelog, I found it actually doesn't mention ...
0
votes
2answers
30 views

How to sanitize select box values in post meta?

I have added a select box in the Post meta. Here is the code, and it works fine. My question is, do I need to sanitize the values before updating the post meta? If yes, how it should be done? This is ...
0
votes
1answer
30 views

Stop Plugin Enumeration [closed]

Is there any way to stop plugin enumeration? I have tried Acunetix WP Security plugin, It seems to work but Yoast SEO plugin is still enumerating. Any plugins or code modifications are appreciated. ...
80
votes
9answers
27k views

Steps to Take to Hide the Fact a Site is Using WordPress?

I have a website for which we are trying to be discreet about the fact that we are using WordPress. What steps can we take to make it less obvious?
1
vote
1answer
16 views

Registration Plugin - Recaptcha integration

Good Day Everyone, I'm currently writing a new plugin for Registration, I intend to actually share that Registration Plugin, but I would like to integrate reCaptcha into it. From what I understood ...
4
votes
2answers
4k views

Limiting sessions to one IP at a time

On a site with premium user account subscriptions, I'd like to be able to limit logins to one computer at a time. The most straightforward way to accomplish this would be to limit by IP, but I haven't ...
68
votes
12answers
9k views

Verifying that I have fully removed a WordPress hack?

My for-fun WordPress blog at http://fakeplasticrock.com (running WordPress 3.1.1) got hacked -- it was showing an <iframe> on every page like so: <iframe ...
1
vote
0answers
31 views

What securtity plugin should I use [closed]

I have more WordPress sites, and some of them has been hacked a several times. After that they send spam messages, what is very annoying :S I decided I will use some security plugin and I wanted to ...
-1
votes
1answer
191 views

Default installation permissions for wp-config.php

Recently I've noticed that many of the wordpress installations we have on our servers where being attacked and ifected by this thing ...
0
votes
3answers
3k views

How to secure WordPress XMLRPC?

XMLRPC is great for remote publishing to WordPress, but there has been many security issues attributed to it. How do it make it more secure? More specifically, only user from the intranet will be ...
0
votes
0answers
22 views

Getting the current page post_id in function hooked to wp_ajax?

I have created a kind of a social network where when a user registration happens, I create a post (custom post type follower) for each user and assign its post_id to the user ( ...
0
votes
1answer
18 views

Write mysql credentials in plugin

I've to create a custom plugin to print data from a database different from the wordpress one. I'm using wpdb. Is it fine, from a security point, to write database credantials in the plugin files in ...
0
votes
0answers
19 views

Security Plugin Blocks Access to theme folder?

I'm using some jquery to do an ajax request within my theme and it's spitting out a file 404 error even though the file exists. I"m guessing it has something to do with the security plugin. here's ...
13
votes
1answer
3k views

If a hacker changed the blog_charset to UTF-7 does that make WordPress vulnerable to further attacks?

I had a client who got hacked recently and I noticed that there were weird characters appearing on her site, like  and Æ. It turns out that the hackers changed the blog_charset to UTF-7 in the ...
0
votes
1answer
45 views

Wordpress Brute Force Prevention

I am using WordFence security plugin for keeping track of login attempts and I regularly check the logs from it. I realize that there are going to be a lot of login attempts with the username 'admin'. ...
1
vote
1answer
67 views

Hack-Proof OR Security in Wordpress — is it real?

For many years I've been using WordPress as a platform for websites, it is convenient to me as a developer and for customers. But recent months, several sites of my clients were hacked and I'm ...
0
votes
2answers
783 views

What do spammers gain by signing up as a user?

The majority of new user signups I receive on my Wordpress blog look dodgy, with @someblog.com, @somearticle.com, or @gmail.com addresses. What do they gain by signing up as a new user?
0
votes
0answers
8 views

Security of using uploaded file across two admin submits

I'm writing a plugin that merges two files, based on user input about which file to draw each section from. This means that I have to get the user upload and display it before I can get the user input ...
1
vote
1answer
23 views

Is it important to sanitize inputs in a shortcode that will be used in site that only I will post to?

Is there any security risk in not sanitizing shortcodes in a wordpress site if I am the only one who has access to the admin panel?
4
votes
2answers
1k views

wp.getUsersBlogs XMLRPC Brute Force Attack/Vulnerability

After the holiday weekend, one of the larger sites I manage had a brute force attack on it. The attacker was attempting to use the wp.getUsersBlogs function and a list of popular usernames and ...
0
votes
0answers
22 views

Is it good practice to use WordPress nonce values to restrict page access?

I'm working with a colleague on a WordPress plugin. Part of the plugin functionality is showing dynamic lists with links which allow you to open a new page. Depending on the user's role, they may or ...
0
votes
1answer
16 views

Site is continuously accessing by several IPs

I have high traffic wordpress blog, but for last two days i am constantly getting the error "Error establishing a database connection". I have called to my hosting customer care and they are saying ...
3
votes
1answer
699 views

Is it true $wpdb->get_results is faster than WP_Query in most cases?

On my homepage, I have a section where I have to display the last five featured posts, where a featured post is simply a post with a custom field is_featured set to 1. I achieved what I want with two ...
0
votes
1answer
77 views

FORCE_SSL_ADMIN not working

Any ideas why define('FORCE_SSL_ADMIN', true); wouldn't work? I'm not getting any errors at all, but a http request to example.com/wp-admin isn't redirecting to https
0
votes
0answers
25 views

What is the best way to upload a temporary & sensitive file and then delete it when done

What is the best way to upload a temporary & sensitive file and then delete it when done. I'm writing a plugin (eventually for multisite) that allows users with a certain role to upload a .csv ...
10
votes
5answers
5k views

Can I Prevent Enumeration of Usernames?

Can I prevent enumeration of usernames on my wordpress site? I can see users at the moment using the WPScan tool.
0
votes
0answers
54 views

Why WordPress not logout after I have close my browser?

The default login cookie has expiry time as "session", so suppose when I close my browser, I need to login again when I visit wp-admin. But I've found that serveral time I've closed my browser (kill ...
0
votes
1answer
57 views

How do I properly update the Wordpress database password?

A site that I manage was recently compromised and I am going through the steps to harden and re-secure the site. I would like to change the MySql database password and want to make sure I do not take ...
0
votes
1answer
27 views

Why isn't the login page rate limited by default?

Brute force attacks seem to the be most common vulnerability on WP installs and rate limiting ought to be relatively easy to bake into WP itself as part of the official, default software (without the ...
0
votes
0answers
9 views

Does adding nonce in save_post hook for every metabox really improve security? [duplicate]

I see a lot of example [1] that introduce the checking of nonce in the save_post callback of a metabox. e.g. function smashing_save_post_class_meta( $post_id, $post ) { /* Verify the nonce before ...
0
votes
2answers
440 views

Wordfence detects change in wp-admin/includes/upgrade.php

I moved my site from hosting provider A and domain name B to hosting provider X and domain name Y. I had Wordfence in the old site. I just installed it in the new site and ran a scan. Wordfence found ...
0
votes
1answer
26 views

How to display post meta data in secure manner

I have have a custom post meta field where I can add a embedding code (a video for example, an iframe). Now I want to retrieve the code from the post meta and display it securely. I can display it ...
1
vote
1answer
118 views

Evaluations of two wordpress security plans against php code injection attack

Senario: I've posted one wordpress php code injection senario on SO before, ...
2
votes
2answers
479 views

Subscribe to email for security fixes?

Is there any email alert list for security fixes? I'd rather not rely on just an RSS feed.
5
votes
6answers
210 views

Share same domain for wp-admin but for different website

I have site like http://www.foo.com http://www.bar.com And I've a wildcard SSL cert *.example.com, instead of buying two SSL certs for the above two domains, can I re-use my existing wildcard SSL ...
1
vote
1answer
52 views

Moving away from MD5: Where to declare the custom global $wp_hasher?

I want to move away from using MD5 for hashing passwords in the database. The plan is to declare a custom global $wp_hasher as hinted at in the docs for wp hash password(): Unless the global ...
0
votes
1answer
32 views

Custom RPC end-point security best pratice?

I trying to figure out how a custom entry point can be secured without loading the entire WP-stack. The built-in AJAX entry point is pretty slow and actually unusable on sites with lots of plugins. So ...
0
votes
0answers
14 views

How would I have to change rewrite rules to use a custom ms-files.php

I've previously wondered about securing file access by non-logged in users who know the full URL in multisite. When ms-files was still used modifications to this file allowed a basic form of WP-run ...
0
votes
2answers
97 views

How to create a private login page for admin.?

Can I create a login page, which could be entered all registered visitors, but were not allowed entrance to the administrator, even if he has entered the correct username and password? For admin I ...
6
votes
1answer
4k views

simple solution for restricting access to (some) uploads/downloads

Initial Situation For a site I'm setting up I was looking into the whole field of securing uploads/downloads and restricting access to them based on user roles/capabilities. Of course I have read ...
0
votes
3answers
327 views

WP Cron doesn't save <iframe> or <object> in post body

I am using wp_cron to auto grab posts from a remote website and save them in my wp db. NOTICE! I am executing my code from my plugin, not from my template functions.php or somewhere else. I have my ...