Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

7
votes
1answer
158 views

Improve wordpress security by hiding non public resources

I'm new from wordpress and i want improve security of wordpress multisite by hiding non public resources, eg. wp-admin, wp-config etc. My setting seem to work, but i don't know if this setting can ...
25
votes
4answers
11k views

Getting a List of Currently Available Roles on a WordPress Site?

When writing WordPress plugins there is often a need to set up options for which roles on the site have access to certain functionality or content. To do this a plugin dev needs to fetch the list of ...
0
votes
1answer
34 views

Load all files from folder in theme – Security concerns?

I'm using this code below in a config file to automatically require other PHP files in the same directory and in subdirectories. This helps my work flow become more efficient. I'm concerned that I ...
0
votes
1answer
481 views

Single sign-on: wp_authenticate_user vs wp_authenticate

I have a wordpress site (lets call it site1) and another site with oauth2 (site2). When a new user is created, a record is created in both site1 and site2 databases with the same email as username, ...
0
votes
1answer
445 views

What is pclzip.lib.php file that wordfence think it's a malicious code

I have checked original wordpress and this file isn't there but this file comes back every time I deleted it. Do you think it's a malicious script? Path: /wp-admin/uploader/pclzip.lib.php Code: ...
2
votes
1answer
30 views

Staging Site: Made Public - Security Questions

Previously, our staging site has been locked down to local access only. We hired a third party developer to assist with resolving a theme via our 'local staging server' remotely. In order to grant ...
-1
votes
0answers
16 views

Changing php version breaks login

I'm using wp_login_form within a custom widget on a website I am working on and it works great when I'm using php5.3. When I use anything newer, the login form stops working. My question is, does ...
3
votes
1answer
38 views

Is sanitize_text_field() is enough to save to DB?

So here is the situation. We allow users to enter input data, i.e. user_first_name and user_additional_comments. Then we use sanitize_text_field() , which is named as save. But after this filter: ...
0
votes
2answers
41 views

How to connect my wordpress plugin to a remote database securely?

First of all I do not have a lot of experience with wordpress plugins, but I am developing a plugin which has to connect and send data to a remote database ( which it is already doing ). But at this ...
45
votes
10answers
38k views

Can I rename the wp-admin folder?

Is it possible to rename the wp-admin folder? I know I could just rename it, but unless it's supported by the code lots of things would break. If I use a custom folder name, it will make it slightly ...
1
vote
2answers
42 views

How to safely allow user upload on CPTs?

I have a form with a WP Media to allow user uploads for a custom post type on the front end. Every time I try to upload as a user I can the message You don't have permission to attach files to this ...
3
votes
1answer
426 views

Disallow file edit not preventing plugin install

I have a little demo site (admin details are listed publicly), and I've configured the wp-config.php to disallow file edits, so in theory no one can install a theme / plugin. define( ...
1
vote
0answers
32 views

How do I authenticate WP users from a chrome extension?

I'm new to WordPress, and I need help. I am writing a chrome extension and intend to use wordpress as the user database. I intend that because I'm using a subscription management WP plugin that keeps ...
0
votes
1answer
840 views

Full path disclosure on rss-functions.php

I was running some security test on my WordPress apps and noticed that all of them have a full path disclosure on the following url. I am sure this has been answered before but I can't find any ...
0
votes
1answer
30 views

How to distinguish between a hack and an encoding error?

This morning I was working with a new image gallery plugin. After two hours of working with it, our server was struggling with a heavy network traffic, and then the server appeared to go out. ...
0
votes
3answers
40 views

Limit Login Attempts BEFORE PHP is executed?

I manage multiple WordPress installs (all related/cross-linked) and I've been getting hit hard with brute force attempts for the past few weeks, enough to crash my servers on multiple occasions. I ...
1
vote
1answer
208 views

Security issues with WP sites

I have just had to deal with a few of my WordPress websites being hacked. First time put an index.html file in the cpanel of each site and replenished my admin user. Once I felt I cleaned this up, ...
0
votes
1answer
1k views

How do I properly update the Wordpress database password?

A site that I manage was recently compromised and I am going through the steps to harden and re-secure the site. I would like to change the MySql database password and want to make sure I do not take ...
0
votes
1answer
718 views

FORCE_SSL_ADMIN not working

Any ideas why define('FORCE_SSL_ADMIN', true); wouldn't work? I'm not getting any errors at all, but a http request to example.com/wp-admin isn't redirecting to https
1
vote
1answer
469 views

Which WordPress scripts need to be executable for a fresh installation?

For security reasons I need to block access to scripts that will not be executed on a fresh WordPress installation. Example: /index.php --> needs to be executable /wp-includes/cache.php --> should ...
1
vote
1answer
32 views

Verify if user is wordpress logged in from another app since wordpress 4.0

I try to implement in my Node.js app a way to verify if the user cookie is valid. I've found some post in internet who explain me very well the things, but as i try to implement it, with the ...
2
votes
0answers
30 views

How to implement secure frontend image upload? [closed]

I would like to implement an public image upload in my Wordpress Theme with ajax. What's the secure way to do this? I have read many about security problems when allow users to upload files to the ...
1
vote
1answer
42 views

<meta name=“generator” content=“WordPress 4.4.2” /> neccessary?

Hello fellow WordPressers Today, I realized that most WordPress sites have this small footprint saying: <meta name="generator" content="WordPress 4.4.2" /> where it indicates what "system" ...
0
votes
0answers
25 views

Sanitization Function in Wordpress (Example Twentyfifteen.1.4 Default WP Theme)

The ThemeForest Submission Requires some sanitization functions that should be incorporated in the theme - This page says this. The WordPress theme should make use of the following inbuilt ...
7
votes
2answers
191 views

Where to securely store API keys and passwords in WordPress?

I'm looking to use a few APIs and many come with keys, secret keys and passwords required to work. Where in WordPress can you store that information? Assuming anyone can hack your DB is there anyway ...
3
votes
1answer
36 views

Extra themes - ok or bad?

I know I am a newbie here, but I'm just wondering, if you keep extra themes in your Wordpress setup, will it add bloat to your site? Can these other themes provide a security risk even if they aren't ...
0
votes
2answers
41 views

Correct and safe way to include php content in my page

I have a website where I use [insert_php] to insert php content to my page. What I do is simply use php's include inside insert_php to include my complex php script. I asked a question a while ago, ...
0
votes
2answers
31 views

Using an Encryption class in a WordPress Plugin

I'm making a WordPress plugin that works with sensitive data. So I need to store/retrieve date with a trusty encryption method. I did some searches among many php encryption wrapper classes, and ...
1
vote
2answers
127 views

How to check plugins for malicious code?

Our new hosting company ran a security check on our installation and I was very surprised to hear that a premium plugin we had purchased (Easy Media Gallery Pro) contained malicious code. (It may ...
6
votes
1answer
77 views

What is the purpose of having a token in cookies?

WordPress utilizes cookies for better security, and I've been trying to understand how exactly this could make a WordPress website more secure, and I found this article . There's a pretty decent ...
0
votes
2answers
52 views

Filter and validate user role in registration

I want to show a select box for user roles in the registration form. I am using this model: /* ROLES IN LIST REGISTRATION */ // 1. Add a new form element... add_action( 'register_form', ...
0
votes
2answers
53 views

Relative security of different releases of WordPress

Since each major-version of WordPress (like 4.0 or 4.4) gets its own series of security updates (currently 4.0.10 or 4.4.2), are the updated newer major-versions significantly more secure than updated ...
0
votes
0answers
19 views

Wordpress security - hiding WordPress directory [duplicate]

Note: edited my post to make it more "is it useful?" than "how to do it?" after toscho marked it as duplicate (the post tosho referenced is more or less what I had in mind for the "how to do it" ...
0
votes
0answers
23 views

About plugin security

I'm developping a couple of simple plugins for specific use, and want to do it right. I've read multiple pages about plugin security, including those. Now, considering that my plugins have for ...
0
votes
1answer
25 views

Is it safe to give wordpress directories ownership to www-data?

I am not server or security expert so please excuse if my question sounds odd. I am running wordpress site on ubuntu 14.04 with nginx server. I had a problem while installing new plugin, So I have ...
9
votes
5answers
12k views

What are the recommended database permissions for WordPress?

I just got WP running on my own server. I am not trying to lock things down more. What permissions should the db user have to my WP db?
1
vote
0answers
15 views

Are there security risks in working directly in the themes folder that builds into a theme folder?

I'm wondering if there are any security risks in using the wp-content/themes/ folder as my project root and using wp-content/themes/my-theme as my build folder. Basically, in the themes folder I would ...
0
votes
1answer
17 views

Dangers to allowing Access-Control-Allow-Origin: * for Feeds only?

I want to use a function like this to allow access to the feeds from a variety of services but my knowledge of the security implications is limited. I think I'm being safe by limiting the access to ...
0
votes
0answers
14 views

Logout via Subdomain, non-wordpress page on a different server?

Similar to the question over at Get wp_logout_url function to work on external (non-Wordpress) page The problem I am facing is the fact the subdomain is on a different server so I am unable to ...
100
votes
12answers
37k views

Steps to Take to Hide the Fact a Site is Using WordPress?

I have a website for which we are trying to be discreet about the fact that we are using WordPress. What steps can we take to make it less obvious?
1
vote
1answer
63 views

Should I Worry About SQL Injection When Using wp_insert_post?

I have created a form to insert posts via front-end to users. I use wp_insert_post function. Should I worry about SQL injection or Does wp_insert_post function handle it?
-1
votes
2answers
1k views

Change Login URL Without Plugin

I want to change the login url of my Wordpress install away from /wp-admin.php I am aiming to do so and am looking at changing the .htaccess file to add in: RewriteRule ^login$ ...
1
vote
1answer
32 views

Frontend Password change

First off, I apologize if there is a duplicate of this roaming around somewhere...I have spent the better part of the past hour looking for the solution, with no luck, but maybe I just suck at picking ...
6
votes
6answers
4k views

How to hide admin account in BuddyPress? (for security reasons)

I have been working with WordPress for the past 3-4 years, but I am new to BuddyPress. I would like to hide the admin account completely from BuddyPress for security reasons. For example with a ...
1
vote
3answers
327 views

Best way to eliminate xmlrpc.php?

What is a best way to eliminate xmlrpc.php file from WordPress when you don't need it?
0
votes
2answers
1k views

How to sanitize select box values in post meta?

I have added a select box in the Post meta. Here is the code, and it works fine. My question is, do I need to sanitize the values before updating the post meta? If yes, how it should be done? This is ...
5
votes
3answers
144 views

Are the default salts secure?

When installing a fresh wordpress, one of the things one should do is, updating the salts in wp-config.php. The section looks like this define('AUTH_KEY', 'put your unique phrase here'); ...
0
votes
0answers
26 views

Upload file via settings page

Question: Is there a secure way to upload files via a plugin settings page? Context: Hello world! A feature of my plugin requires the user to upload one or more files. More precisely, JSON files ...
0
votes
1answer
24 views

What is more secure checking capabilities of user or checking role of user in WordPress plugin development

Suppose I need to check the logged in user is subscriber not anyone else. So if I check the capability like "read". Then subscriber is OK but "read" capability is also associated to admin/publisher as ...
2
votes
0answers
60 views

Does Wordpress contain “default” anti-SQL injection code that responds with a 404 error?

I've been through the “seven layers of the candy cane forest” on this one… :) Our plugin receives data via a POST request. On a particular site that has our plugin installed, we observed odd ...