Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

0
votes
3answers
36 views

Do we need to escape data that we receive from theme options?

I'm creating a Wordpress theme that I'm hoping to sell on Themeforest. Now I know much about escaping user inputted data using functions like esc_html, esc_url and so on and I use them in the comments ...
0
votes
1answer
16 views

How can I create a private site that is inaccessible from the outside?

I need a safe place where I can store data about projects that I am working on. This data includes text and files (pictures, sound and video). I want to create a private "blog" for this purpouse that ...
0
votes
0answers
11 views

How to force two-step authentication with Jetpack?

I'm using Jetpack's SSO module for two-step authentication, but it's not what I thought. I can still simply login via the login form withing going into authentication. It's only calling for two-step ...
-1
votes
1answer
43 views

Is WordPress easier to hack? [closed]

Is WordPress more susceptible to hack attempts than commercial sites which is completely closed off to hackers? If it be possible to create and run a site with WordPress(and also suppose security is ...
0
votes
1answer
47 views

Troll the hackers by redirecting them

My website is getting somewhat popular, and with the it's increasing popularity there's an increase in the hackers. Last night I visited my security logs and found that everyday approximately 10 ...
1
vote
1answer
33 views

Is $wpdb->prepare escaping to much? How to use it properly?

Im pretty much confused by $wpdb->prepare. I want to use it to sanitize user input but it turned out that it destroys the query. I cannot imagine that this is how it's intended to work but I can't ...
10
votes
1answer
128 views

Why does WordPress need my private ssh key to update?

Configuring WordPress to update within the application (i.e. WordPress) is ideal for me because of its convenience. Nonetheless, I'm troubled by the requirements. The requested fields that show up ...
4
votes
2answers
174 views

Is WP vulnerable when updating plugins or themes?

Once, I had a problem that somehow someone managed to change files of my website without FTP or SSH credentials. Probably he got in through WP (probably it wasn't a 'he', but an 'it', a bot), we said ...
6
votes
4answers
20k views

Is there any way to rename or hide wp-login.php?

Any way to change the wp-login.php url? It seems insecure that everyone that's ever used Wordpress could easily see if your site is using it, and get right to the login page. There used to be a ...
0
votes
1answer
15 views

How to give the same error message when the wrong password or wrong username is used?

For security reasons, my WordPress instance should give the same error message when an incorrect password or wrong username is used. How can it be done?
4
votes
2answers
182 views

Make password invalid once logged out of password-protected page

In a WP-based site I have a custom form which I need to hide from the general public and give access to only a select few who would then get a password from me, enter it and access the form and submit ...
0
votes
0answers
7 views

xmlrpc.php act as threat to wordpress security? [duplicate]

please could any one suggest what are the necessary steps needs to make wordpress sites more secure. i know it is kind of general question but still if still any hacks which improves security of ...
0
votes
0answers
30 views

Can I make an ajax response cross-domain?

I am trying to make a single ajax response cross-domain. Is that possible? I tried something like this, but that did not work: function my_call_callback() { header("Access-Control-Allow-Origin: ...
0
votes
1answer
23 views

Secure my “add_settings_field” translation?

I am using "add_settings_field" and want to provide translation for it , but my problem is security. So is __('My Checbox:' , 'domain') secure enough for translation? If not what can I do about it? I ...
0
votes
0answers
38 views

Wordpress exploited theme is causing high io load on server

I used a Wordpress theme for a while that was causing high IO-load on my server. That was because there was some kind of exploits made/available for the theme: ...
0
votes
0answers
18 views

reCAPTCHA is not visible on comments loaded via ajax

I've a php template loaded on a popup and this template should contain on the bottom the possibility for a user -logged in or not- to write comments. for security reasons it was installed the plugin ...
0
votes
0answers
25 views

Changing WP location and wp-content folder name witouth loosing SEO

I'm trying to make my site the most efficient way as possible, and I find out thant changing lot of things in permalinks , security folders , etc, works pretty well. But what happen if the WP, is ...
0
votes
0answers
19 views

wordpress: only admin can access wp-content folder

as wp-content/ upload folder has public access and is accessible through url. for example: http://site.com/wp-content/uploads/2014/02/test.pdf i want to make it accessible by admin only.. it can ...
1
vote
2answers
19 views

How to hide easy access to my website temporarily?

I am developing a new website and I do not want others, except for my colleagues, to access it easily. I don't want it to be password protected because my colleagues are testing it intensively. Is ...
0
votes
1answer
31 views

Storing FTP details in wp-config.php

I'd like to hear about the security concerns for storing FTP details in wp-config.php on a shared server. It doesn't 'feel' safe to me. I'm using ManageWP to control sites on a shared server and have ...
2
votes
3answers
312 views

How brute-forcer knows that the password is cracked for target username?

There are very many brute-force attacks (mostly for 'admin' username) on WordPress sites. All these attacks are made automatically via post requests. The question 1: how brute-forcer knows that the ...
0
votes
0answers
15 views

What kind of security does wp_handle_upload() provide?

According to the docs, wp_handle_upload(), will: Handle PHP uploads in WordPress, sanitizing file names, checking extensions for mime type, and moving the file to the appropriate directory within ...
5
votes
4answers
2k views

How to hide admin account in BuddyPress? (for security reasons)

I have been working with WordPress for the past 3-4 years, but I am new to BuddyPress. I would like to hide the admin account completely from BuddyPress for security reasons. For example with a ...
0
votes
1answer
21 views

Specific way to allow Wordpress users to view their current password? And edit it?

I know the built in user manager doesn't allow a user to see what her current pass is, just recover / reset it via email or write in a new one in the admin but I am looking for a plugin or other ...
0
votes
2answers
155 views

Tips for finding SPAM links injected into the_content

I'm working on a client's site and I noticed that posts have a hidden <div> filled to SPAM links to dick pills, etc. Hoping to get lucky, I searched for some of the keywords in the database ...
1
vote
1answer
3k views

Receiving “This content cannot be displayed in a frame” error on login page

I am using a new domain for my WordPress directory in different server. When I click the meta links such "Login" or "register", I get this page: This content cannot be displayed in a frame To ...
0
votes
0answers
11 views

Configuration File Safety [duplicate]

I'm new to PHP and WordPress and I've a few questions to ask about database and configuration file security. I hope you answer them. When I try to reach some wp sites config file by typing ...
0
votes
0answers
43 views

Why are xmlrpc.php and wp-cron.php being called so often?

I'm running a Wordpress website and I have found from the server logs that xmlrpc.php and wp-cron.php are being requested (POST requests, of course) very frequently--including some suspicious ips that ...
1
vote
2answers
2k views

Password protect some uploaded files, so only logged-in users can view them

I would like to protect some uploaded files, so that they are not publicly accessible (they are not accessible without a login). I'm uploading some PDF files, and I'd like to mark some of them as ...
27
votes
10answers
15k views

Can I rename the wp-admin folder?

Is it possible to rename the wp-admin folder? I know I could just rename it, but unless it's supported by the code lots of things would break. If I use a custom folder name, it will make it slightly ...
1
vote
1answer
7k views

Change WP-Login or WP-Admin

Can I change the name of the wp-login or wp-admin file so that I can go to a different filename in order to login. I am trying to prevent hackers from finding my login and wp-login has become a very ...
0
votes
1answer
20 views

Is it necessary to use a WordPress nonce when allowing users to download public data?

I am using jQuery .load() to load the next page of WordPress posts after a button is clicked. The next page of posts is public data (no access restrictions on it whatsoever). Should I use a WordPress ...
0
votes
2answers
2k views

How to secure WordPress XMLRPC?

XMLRPC is great for remote publishing to WordPress, but there has been many security issues attributed to it. How do it make it more secure? More specifically, only user from the intranet will be ...
0
votes
0answers
33 views

Renaming admin user on multisite install by MySQL

As part of a general tightening of security, I want to change the name of the admin user on my multisite install to something less commonly used. This user is admin on all five sites in the network ...
5
votes
2answers
3k views

Limiting sessions to one IP at a time

On a site with premium user account subscriptions, I'd like to be able to limit logins to one computer at a time. The most straightforward way to accomplish this would be to limit by IP, but I haven't ...
1
vote
2answers
68 views

How to protect wp-admin through .htaccess?

I'd like to protect the /wp-admin/ directory at the server level. This means two logins. One through the server and another through WordPress. I believe this can be handled through .htaccess. Does ...
0
votes
1answer
50 views

Hide wp-login.php but not the widget

I have a website which is still under nascent construction stage: http://42charts.com . Lately I find that couple of users are registering themselves in my site. It seems like a bot as the mails IDs ...
1
vote
1answer
96 views

using rewrites to secure login page

I'm trying to be sneaky with iis to secure a wordpress login page (not my choice to run a windows server, but that's the reality of things). It's worked so far, only the login page itself loads itself ...
0
votes
2answers
83 views

Restrict Access in Admin Panel

I want to restrict access to certain plugin pages / normal WP Pages. I've found a way to Hide these pages from the menu but currently not restrict them. For instance, I have an editor and I don't want ...
47
votes
8answers
13k views

Is moving wp-config outside the web root really beneficial?

One of the most common security best practices these days seems to be moving wp-config.php one directory higher than the vhost's document root. I've never really found a good explanation for that, but ...
6
votes
5answers
2k views

Can I Prevent Enumeration of Usernames?

Can I prevent enumeration of usernames on my wordpress site? I can see users at the moment using the WPScan tool.
0
votes
0answers
14 views

Bots finding WP users list. How to hide? [duplicate]

I have been monitoring about 20 WP websites login attempts. About half of these websites get hit by bots on a monthly bases, attempting to guess the login. You can tell it's a bot because the pattern ...
2
votes
3answers
6k views

How does admin-ajax.php work?

we are having some issues with an external developer. i am not a wp person so i turn to the masses to help out. we want to limit access to the wp-admin site to internal access only (via vpn). simply ...
0
votes
0answers
30 views

Inserting HTML elements into table with TinyMCE, security

I am working on a wordpress plugin where the administrator can fill out a form that adds products to a table. For most inputs I am using sanitize_text_field(), and then inserting the data. But for ...
0
votes
2answers
2k views

Password protect a specific category page/post

I have searched high and low for this but nothing is sticking out at me. I am looking to password protect posts and/or pages based on a certain category. The reason for this is that I am creating a ...
0
votes
1answer
37 views

Able to go to WordPress admin even after deleting auth cookies from request headers

I discovered that if I remove my auth cookies from my browser's request header, I am still able to view a page. Steps: Log into my WordPress installation Go to the wp-admin page In Chrome, use the ...
4
votes
3answers
156 views

Disabled plugins are the security holes - rumor or reality?

I've read many WordPress Security blog articles, where the Security Experts're recommending some special matters to take care when somebody is concern about his/her WordPress site's security. Among ...
0
votes
1answer
41 views

User meta and public function security

I am using stripe to setup a system of buying credits, which can be used on my wordpress site. I save credits using wordpress user meta, and I increment those credits after a successful transaction ...
0
votes
1answer
42 views

Remove hacked code - out of ideas! [closed]

I've been working on a project which keeps getting some PHP inserted into the config.php file and it's causing a lot of issues with SEO. I'll paste in a sample of it (it's quite long) after this ...
0
votes
1answer
163 views

How to rewrite rules for WP-security in Nginx?

I have a WordPress website on a VPS running nginx. I have installed the WP Security plugin to improve the security of my site. After changing all the settings to my liking, a pop-up notifies me that I ...