Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

1
vote
1answer
230 views

Should we use plugins that aren't available from the official WordPress site?

I'm not sure if my question is appropriate here, apologies in advance but I am confused and need some helpful thoughts! We were using this plugin for our site , which has recently been removed from ...
0
votes
0answers
20 views

Disable or Modify Access-Control-Allow-Origin from Response Headers

I would like to know is that possible to modify or remove Access-Control-Allow-Origin from Response Headers Due to security reason, I need to change Access-Control-Allow-Origin from * to domain I ...
5
votes
1answer
389 views

Is WordPress vulnerable to the httpoxy?

Is WordPress vulnerable to the httpoxy exploit? See https://httpoxy.org/ Thanks.
0
votes
1answer
19 views

Using wp_localize_script in template file - is it secure?

I have the following code inside one of my template files (NOT functions.php) $datatoBePassed = array( 'pageTitle' => get_the_title() ); wp_localize_script( 'main-js', '...
0
votes
1answer
36 views

Is it safe to use admin-ajax.php in the frontend?

I am using Filter Custom Fields & Taxonomies Light. I found out it is using admin-ajax.php in the frontend for the AJAX search even not logged in. See: https://plugins.svn.wordpress.org/filter-...
1
vote
4answers
549 views

WP Cron doesn't save <iframe> or <object> in post body

I am using wp_cron to auto grab posts from a remote website and save them in my wp db. NOTICE! I am executing my code from my plugin, not from my template functions.php or somewhere else. I have my ...
0
votes
1answer
16 views

My site thinks it's secure when it is fact not

My site is loading enqueued content over HTTPS while it is not a secure site. I have a couple PHP sites behind a load balancer with a proxy ssl certificate on one other domain. This site does not ...
7
votes
3answers
3k views

What security concerns should I have when setting FS_METHOD to “direct” in wp-config?

I have recently had an issue where I have been unable to install the WP Smush Pro plugin because I don't have the Manual Install or One-Click Installation options available. I came across this post ...
0
votes
2answers
3k views

Embed Wordpress Admin in an iframe

I am trying to embed the admin "new post" WordPress page into an iframe: <iframe height="500px" frameborder="0" width="740px" src="my_wordpress_domain/wp-admin/post-new.php"/> For some reason ...
2
votes
2answers
2k views

how can i embed wordpress backend in iframe

I have 2 websites http://www.aaa.com and http://www.bbb.com and need them to show the same. Now I put an iframe in index.html and upload to aaa.com. It's ok for frontend but it's doesn't work for ...
0
votes
2answers
408 views

Troll the hackers by redirecting them

My website is getting somewhat popular, and with the it's increasing popularity there's an increase in the hackers. Last night I visited my security logs and found that everyday approximately 10 ...
-1
votes
1answer
44 views

What is nulled themes

In wordpress there is a concept (Nulled Themes) I google it and found some people say it is hacked and others say it is not. I try it with (iThemes Security) and everything works without errors. The ...
3
votes
1answer
443 views

Disallow file edit not preventing plugin install

I have a little demo site (admin details are listed publicly), and I've configured the wp-config.php to disallow file edits, so in theory no one can install a theme / plugin. define( '...
0
votes
1answer
36 views

What is the best practice for restricting a section to logged in users?

As a newbie, I've had a hard time finding a good starting point. I believe my case is fairly common and maybe this question has been answered comprehensively elsewhere. I am creating a simple site ...
4
votes
3answers
879 views

Secure WordPress paid plug-in

I want to create a WordPress plug-in but also want to ensure that the plugin can only be used after it has been activated with a serial key that should be unique for each domain. What is the best way ...
0
votes
0answers
8 views

Is it possible to only have the admin interface bind to the local loopback?

I was wondering if it's possible to bind only the admin interface (and not the page) to the local loop back address? For purposes of keeping the wrong people off the administrator interface with SSH.
0
votes
0answers
11 views

Gallery plugin in error logs — where is this coming from? [closed]

I'm in the process of reviewing my php error logs and have found repeated requests referencing a plugin I've never seen before. Doing a search for the plugin leads to a few instances of security and ...
0
votes
0answers
19 views

Mitigating Bruteforce attempts server wide

We host several WordPress sites on a VPS and see brute force attempts across each site. WordFence is in operation on each. Where we can manage the DNS the site sits behind Cloudflare. Can't help ...
0
votes
1answer
24 views

Checking for origin of a xmlrpc request

I have webapp A (running wordpress) talking to webapp B (running on Java, no wordpress or php). B issues xmlrpc requests to A over https. In order to secure the xmlrpc endpoint on A I'd like to ...
0
votes
1answer
7 views

Require confirmation of current user's email before updating database and before send_email_change_email

I like the core ability for users to update their default "Email" field. For example username1 can edit their own profile and change their "Email" field from email1@example.com to email2@example.com ...
0
votes
3answers
790 views

FORCE_SSL_ADMIN not working

Any ideas why define('FORCE_SSL_ADMIN', true); wouldn't work? I'm not getting any errors at all, but a http request to example.com/wp-admin isn't redirecting to https
1
vote
2answers
503 views

Which WordPress scripts need to be executable for a fresh installation?

For security reasons I need to block access to scripts that will not be executed on a fresh WordPress installation. Example: /index.php --> needs to be executable /wp-includes/cache.php --> should ...
0
votes
2answers
167 views

force login loophole

I want to restrict access to my WordPress site to allow registered users only. I have tried the following plugins: Require-login Authenticator WP-lock All of them have the same problem: After ...
0
votes
1answer
528 views

Single sign-on: wp_authenticate_user vs wp_authenticate

I have a wordpress site (lets call it site1) and another site with oauth2 (site2). When a new user is created, a record is created in both site1 and site2 databases with the same email as username, ...
1
vote
1answer
24 views

ajax nonce verification failing

I have a voting system where a list of posts are printed out using an archive template. Each post's voting button has html data attributes containing the vote-id and the vote-nonce. When the voting ...
0
votes
1answer
38 views

Safe to say WordPress security releases don't have database upgrades

Since all security releases are based on last released codebase + security patch, I think its safe to say WordPress security releases don't have database upgrades, but I figured I will ask my fellow ...
0
votes
0answers
19 views

Correct way check nonce (security) using old Options API

I am developing plugin for Wordpress. Firstly I started using Settings API it looks good, but it is little bit complex and it doesn't provide the way to handle options manually. I have quite ...
5
votes
4answers
229 views

Does My Child-Theme Functions.php Need if{die} Security In It? [duplicate]

I'm new to PHP, but I've noticed just about every PHP file has a security snippet, "Die if not accessed in the correct manner" script at the beginning; my question, does a child-theme functions.php ...
0
votes
1answer
19 views

Where is the php file, that does the checks for login information?

I would like to add some additional checks into my wordpress website's username and password authentication function for specific usernames, but I cannot find the correct php file... /* I would like ...
1
vote
2answers
44 views

Is default functions like update_post_meta safe to use user inputs?

Is default functions like update_post_meta() safe to use user inputs? e.g. update_post_meta(76, 'my_key', $_GET['value']) Or should I use $_GET['value'] = sanitize_text_field($_GET['value']); ...
9
votes
2answers
192 views

Improve wordpress security by hiding non public resources

I'm new from wordpress and i want improve security of wordpress multisite by hiding non public resources, eg. wp-admin, wp-config etc. My setting seem to work, but i don't know if this setting can ...
0
votes
1answer
18 views

Error on Wordpress Login

I am editing my wordpress site before and nothing is wrong until I change my ISP then this error came out when I try to login on my site: Not Acceptable! An appropriate representation of the ...
1
vote
1answer
30 views

WordPress Front end Form - Enable to Submit PHP Codes

I just create a front end form to submit posts for public persons. It works fine. I need to allow to submit PHP codes (because it is PHP tutorial site) via that form. I need to make sure it not ...
0
votes
2answers
1k views

Full path disclosure on rss-functions.php

I was running some security test on my WordPress apps and noticed that all of them have a full path disclosure on the following url. I am sure this has been answered before but I can't find any ...
48
votes
10answers
39k views

Can I rename the wp-admin folder?

Is it possible to rename the wp-admin folder? I know I could just rename it, but unless it's supported by the code lots of things would break. If I use a custom folder name, it will make it slightly ...
25
votes
4answers
12k views

Getting a List of Currently Available Roles on a WordPress Site?

When writing WordPress plugins there is often a need to set up options for which roles on the site have access to certain functionality or content. To do this a plugin dev needs to fetch the list of ...
0
votes
1answer
46 views

Load all files from folder in theme – Security concerns?

I'm using this code below in a config file to automatically require other PHP files in the same directory and in subdirectories. This helps my work flow become more efficient. I'm concerned that I ...
0
votes
1answer
626 views

What is pclzip.lib.php file that wordfence think it's a malicious code

I have checked original wordpress and this file isn't there but this file comes back every time I deleted it. Do you think it's a malicious script? Path: /wp-admin/uploader/pclzip.lib.php Code: http:/...
2
votes
1answer
37 views

Staging Site: Made Public - Security Questions

Previously, our staging site has been locked down to local access only. We hired a third party developer to assist with resolving a theme via our 'local staging server' remotely. In order to grant ...
3
votes
1answer
58 views

Is sanitize_text_field() is enough to save to DB?

So here is the situation. We allow users to enter input data, i.e. user_first_name and user_additional_comments. Then we use sanitize_text_field() , which is named as save. But after this filter: ...
0
votes
2answers
50 views

How to connect my wordpress plugin to a remote database securely?

First of all I do not have a lot of experience with wordpress plugins, but I am developing a plugin which has to connect and send data to a remote database ( which it is already doing ). But at this ...
1
vote
2answers
47 views

How to safely allow user upload on CPTs?

I have a form with a WP Media to allow user uploads for a custom post type on the front end. Every time I try to upload as a user I can the message You don't have permission to attach files to this ...
1
vote
0answers
68 views

How do I authenticate WP users from a chrome extension?

I'm new to WordPress, and I need help. I am writing a chrome extension and intend to use wordpress as the user database. I intend that because I'm using a subscription management WP plugin that keeps ...
0
votes
1answer
32 views

How to distinguish between a hack and an encoding error?

This morning I was working with a new image gallery plugin. After two hours of working with it, our server was struggling with a heavy network traffic, and then the server appeared to go out. ...
0
votes
3answers
51 views

Limit Login Attempts BEFORE PHP is executed?

I manage multiple WordPress installs (all related/cross-linked) and I've been getting hit hard with brute force attempts for the past few weeks, enough to crash my servers on multiple occasions. I ...
1
vote
1answer
257 views

Security issues with WP sites

I have just had to deal with a few of my WordPress websites being hacked. First time put an index.html file in the cpanel of each site and replenished my admin user. Once I felt I cleaned this up, it'...
0
votes
1answer
1k views

How do I properly update the Wordpress database password?

A site that I manage was recently compromised and I am going through the steps to harden and re-secure the site. I would like to change the MySql database password and want to make sure I do not take ...
1
vote
1answer
43 views

Verify if user is wordpress logged in from another app since wordpress 4.0

I try to implement in my Node.js app a way to verify if the user cookie is valid. I've found some post in internet who explain me very well the things, but as i try to implement it, with the WordPress-...
2
votes
0answers
37 views

How to implement secure frontend image upload? [closed]

I would like to implement an public image upload in my Wordpress Theme with ajax. What's the secure way to do this? I have read many about security problems when allow users to upload files to the ...
1
vote
1answer
47 views

<meta name=“generator” content=“WordPress 4.4.2” /> neccessary?

Hello fellow WordPressers Today, I realized that most WordPress sites have this small footprint saying: <meta name="generator" content="WordPress 4.4.2" /> where it indicates what "system" ...