Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

14
votes
6answers
390 views

Are Wordpress Plugins essential?

I'm new to WordPress. I recently read an article about how hackers can exploit vulnerabilities in plugins. Various sources such as Google Pagespeed has also disssuaded me from using plugins or at ...
1
vote
0answers
8 views

How to Block Access to Standard Login Flow and Comment Flow

I've set up custom flows on my Wordpress blog for login, signup, and commenting. I would like to password protect the standard login flow so only I can use it, and block access entirely to the ...
1
vote
0answers
31 views

How to get Wordpress to save upload file beyond web root

I am using nginx on a multisite install. I am trying to get Wordpress to save uploads to a folder beyond the webroot : /var/www/vhosts/mydomain.com/private as opposed to ...
5
votes
1answer
1k views

simple solution for restricting access to (some) uploads/downloads

Initial Situation For a site I'm setting up I was looking into the whole field of securing uploads/downloads and restricting access to them based on user roles/capabilities. Of course I have read ...
1
vote
1answer
65 views

When to use esc_html and when to use sanitize_text_field?

It seems that they do almost same type of job. So... When should I use esc_html() instead of sanitize_text_field()?
0
votes
2answers
39 views

Config file with no Keys..?

I'm working on a site for someone that doesn't have any keys in the wp-config file. Isn't this a serious issue? I know I can generate these but I wonder if this will have any side-effects..also, is ...
1
vote
1answer
26 views

Is wp_nonce_field vulnerable if you know the action name?

Is wp_nonce_field vulnerable if you know the action name? I am actually adding a hidden field with name = the name of the action name in my form so that my plugin can identify it. I want to know if ...
0
votes
3answers
37 views

Do we need to escape data that we receive from theme options?

I'm creating a Wordpress theme that I'm hoping to sell on Themeforest. Now I know much about escaping user inputted data using functions like esc_html, esc_url and so on and I use them in the comments ...
0
votes
1answer
17 views

How can I create a private site that is inaccessible from the outside?

I need a safe place where I can store data about projects that I am working on. This data includes text and files (pictures, sound and video). I want to create a private "blog" for this purpouse that ...
0
votes
0answers
13 views

How to force two-step authentication with Jetpack?

I'm using Jetpack's SSO module for two-step authentication, but it's not what I thought. I can still simply login via the login form withing going into authentication. It's only calling for two-step ...
0
votes
1answer
51 views

Troll the hackers by redirecting them

My website is getting somewhat popular, and with the it's increasing popularity there's an increase in the hackers. Last night I visited my security logs and found that everyday approximately 10 ...
1
vote
1answer
35 views

Is $wpdb->prepare escaping to much? How to use it properly?

Im pretty much confused by $wpdb->prepare. I want to use it to sanitize user input but it turned out that it destroys the query. I cannot imagine that this is how it's intended to work but I can't ...
10
votes
1answer
128 views

Why does WordPress need my private ssh key to update?

Configuring WordPress to update within the application (i.e. WordPress) is ideal for me because of its convenience. Nonetheless, I'm troubled by the requirements. The requested fields that show up ...
4
votes
2answers
180 views

Is WP vulnerable when updating plugins or themes?

Once, I had a problem that somehow someone managed to change files of my website without FTP or SSH credentials. Probably he got in through WP (probably it wasn't a 'he', but an 'it', a bot), we said ...
7
votes
4answers
20k views

Is there any way to rename or hide wp-login.php?

Any way to change the wp-login.php url? It seems insecure that everyone that's ever used Wordpress could easily see if your site is using it, and get right to the login page. There used to be a ...
0
votes
1answer
15 views

How to give the same error message when the wrong password or wrong username is used?

For security reasons, my WordPress instance should give the same error message when an incorrect password or wrong username is used. How can it be done?
4
votes
2answers
185 views

Make password invalid once logged out of password-protected page

In a WP-based site I have a custom form which I need to hide from the general public and give access to only a select few who would then get a password from me, enter it and access the form and submit ...
0
votes
0answers
7 views

xmlrpc.php act as threat to wordpress security? [duplicate]

please could any one suggest what are the necessary steps needs to make wordpress sites more secure. i know it is kind of general question but still if still any hacks which improves security of ...
0
votes
0answers
31 views

Can I make an ajax response cross-domain?

I am trying to make a single ajax response cross-domain. Is that possible? I tried something like this, but that did not work: function my_call_callback() { header("Access-Control-Allow-Origin: ...
0
votes
1answer
23 views

Secure my “add_settings_field” translation?

I am using "add_settings_field" and want to provide translation for it , but my problem is security. So is __('My Checbox:' , 'domain') secure enough for translation? If not what can I do about it? I ...
0
votes
0answers
38 views

Wordpress exploited theme is causing high io load on server

I used a Wordpress theme for a while that was causing high IO-load on my server. That was because there was some kind of exploits made/available for the theme: ...
0
votes
0answers
18 views

reCAPTCHA is not visible on comments loaded via ajax

I've a php template loaded on a popup and this template should contain on the bottom the possibility for a user -logged in or not- to write comments. for security reasons it was installed the plugin ...
0
votes
0answers
25 views

Changing WP location and wp-content folder name witouth loosing SEO

I'm trying to make my site the most efficient way as possible, and I find out thant changing lot of things in permalinks , security folders , etc, works pretty well. But what happen if the WP, is ...
0
votes
0answers
20 views

wordpress: only admin can access wp-content folder

as wp-content/ upload folder has public access and is accessible through url. for example: http://site.com/wp-content/uploads/2014/02/test.pdf i want to make it accessible by admin only.. it can ...
1
vote
2answers
19 views

How to hide easy access to my website temporarily?

I am developing a new website and I do not want others, except for my colleagues, to access it easily. I don't want it to be password protected because my colleagues are testing it intensively. Is ...
0
votes
1answer
31 views

Storing FTP details in wp-config.php

I'd like to hear about the security concerns for storing FTP details in wp-config.php on a shared server. It doesn't 'feel' safe to me. I'm using ManageWP to control sites on a shared server and have ...
2
votes
3answers
312 views

How brute-forcer knows that the password is cracked for target username?

There are very many brute-force attacks (mostly for 'admin' username) on WordPress sites. All these attacks are made automatically via post requests. The question 1: how brute-forcer knows that the ...
0
votes
0answers
16 views

What kind of security does wp_handle_upload() provide?

According to the docs, wp_handle_upload(), will: Handle PHP uploads in WordPress, sanitizing file names, checking extensions for mime type, and moving the file to the appropriate directory within ...
5
votes
4answers
2k views

How to hide admin account in BuddyPress? (for security reasons)

I have been working with WordPress for the past 3-4 years, but I am new to BuddyPress. I would like to hide the admin account completely from BuddyPress for security reasons. For example with a ...
0
votes
1answer
22 views

Specific way to allow Wordpress users to view their current password? And edit it?

I know the built in user manager doesn't allow a user to see what her current pass is, just recover / reset it via email or write in a new one in the admin but I am looking for a plugin or other ...
0
votes
2answers
166 views

Tips for finding SPAM links injected into the_content

I'm working on a client's site and I noticed that posts have a hidden <div> filled to SPAM links to dick pills, etc. Hoping to get lucky, I searched for some of the keywords in the database ...
1
vote
1answer
3k views

Receiving “This content cannot be displayed in a frame” error on login page

I am using a new domain for my WordPress directory in different server. When I click the meta links such "Login" or "register", I get this page: This content cannot be displayed in a frame To ...
0
votes
0answers
11 views

Configuration File Safety [duplicate]

I'm new to PHP and WordPress and I've a few questions to ask about database and configuration file security. I hope you answer them. When I try to reach some wp sites config file by typing ...
0
votes
0answers
44 views

Why are xmlrpc.php and wp-cron.php being called so often?

I'm running a Wordpress website and I have found from the server logs that xmlrpc.php and wp-cron.php are being requested (POST requests, of course) very frequently--including some suspicious ips that ...
1
vote
2answers
2k views

Password protect some uploaded files, so only logged-in users can view them

I would like to protect some uploaded files, so that they are not publicly accessible (they are not accessible without a login). I'm uploading some PDF files, and I'd like to mark some of them as ...
28
votes
10answers
15k views

Can I rename the wp-admin folder?

Is it possible to rename the wp-admin folder? I know I could just rename it, but unless it's supported by the code lots of things would break. If I use a custom folder name, it will make it slightly ...
1
vote
1answer
7k views

Change WP-Login or WP-Admin

Can I change the name of the wp-login or wp-admin file so that I can go to a different filename in order to login. I am trying to prevent hackers from finding my login and wp-login has become a very ...
0
votes
1answer
22 views

Is it necessary to use a WordPress nonce when allowing users to download public data?

I am using jQuery .load() to load the next page of WordPress posts after a button is clicked. The next page of posts is public data (no access restrictions on it whatsoever). Should I use a WordPress ...
0
votes
2answers
2k views

How to secure WordPress XMLRPC?

XMLRPC is great for remote publishing to WordPress, but there has been many security issues attributed to it. How do it make it more secure? More specifically, only user from the intranet will be ...
0
votes
0answers
35 views

Renaming admin user on multisite install by MySQL

As part of a general tightening of security, I want to change the name of the admin user on my multisite install to something less commonly used. This user is admin on all five sites in the network ...
5
votes
2answers
3k views

Limiting sessions to one IP at a time

On a site with premium user account subscriptions, I'd like to be able to limit logins to one computer at a time. The most straightforward way to accomplish this would be to limit by IP, but I haven't ...
1
vote
2answers
68 views

How to protect wp-admin through .htaccess?

I'd like to protect the /wp-admin/ directory at the server level. This means two logins. One through the server and another through WordPress. I believe this can be handled through .htaccess. Does ...
0
votes
1answer
52 views

Hide wp-login.php but not the widget

I have a website which is still under nascent construction stage: http://42charts.com . Lately I find that couple of users are registering themselves in my site. It seems like a bot as the mails IDs ...
1
vote
1answer
96 views

using rewrites to secure login page

I'm trying to be sneaky with iis to secure a wordpress login page (not my choice to run a windows server, but that's the reality of things). It's worked so far, only the login page itself loads itself ...
0
votes
2answers
85 views

Restrict Access in Admin Panel

I want to restrict access to certain plugin pages / normal WP Pages. I've found a way to Hide these pages from the menu but currently not restrict them. For instance, I have an editor and I don't want ...
48
votes
8answers
13k views

Is moving wp-config outside the web root really beneficial?

One of the most common security best practices these days seems to be moving wp-config.php one directory higher than the vhost's document root. I've never really found a good explanation for that, but ...
6
votes
5answers
2k views

Can I Prevent Enumeration of Usernames?

Can I prevent enumeration of usernames on my wordpress site? I can see users at the moment using the WPScan tool.
0
votes
0answers
14 views

Bots finding WP users list. How to hide? [duplicate]

I have been monitoring about 20 WP websites login attempts. About half of these websites get hit by bots on a monthly bases, attempting to guess the login. You can tell it's a bot because the pattern ...
2
votes
3answers
6k views

How does admin-ajax.php work?

we are having some issues with an external developer. i am not a wp person so i turn to the masses to help out. we want to limit access to the wp-admin site to internal access only (via vpn). simply ...
0
votes
0answers
32 views

Inserting HTML elements into table with TinyMCE, security

I am working on a wordpress plugin where the administrator can fill out a form that adds products to a table. For most inputs I am using sanitize_text_field(), and then inserting the data. But for ...