Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

101
votes
12answers
38k views

Steps to Take to Hide the Fact a Site is Using WordPress?

I have a website for which we are trying to be discreet about the fact that we are using WordPress. What steps can we take to make it less obvious?
40
votes
2answers
22k views

How to Protect Uploads, if User is not Logged In?

I use wordpress for a private site where users upload files. I use the "Private WordPress" to prevent access in to the site if the user is not logged in. I would like to do the same to the files ...
78
votes
12answers
11k views

Verifying that I have fully removed a WordPress hack?

My for-fun WordPress blog at http://fakeplasticrock.com (running WordPress 3.1.1) got hacked -- it was showing an <iframe> on every page like so: <iframe src="http://evilsite.com/go/1">&...
47
votes
10answers
39k views

Can I rename the wp-admin folder?

Is it possible to rename the wp-admin folder? I know I could just rename it, but unless it's supported by the code lots of things would break. If I use a custom folder name, it will make it slightly ...
21
votes
1answer
4k views

Worthwhile to restrict direct access of theme files?

I've run across the following snippet in themes from time to time: if ( ! defined('ABSPATH')) exit('restricted access'); It's at the beginning of some (all?) PHP files in a theme and it's supposed ...
5
votes
3answers
3k views

Filter any HTTP request URI?

I want to filter any HTTP request URI done through the HTTP API. Use cases: The WordPress update check goes to http://api.wordpress.org/core/version-check/1.6/, but https://api.wordpress.org/core/...
0
votes
1answer
116 views

Developing a secure front end posting form

I want to add a front end posting functionality to one of my Wordpress sites. For more control and for more understanding of how this works (I am not a professional programmer) I choosed to use as a ...
84
votes
8answers
33k views

Is moving wp-config outside the web root really beneficial?

One of the most common security best practices these days seems to be moving wp-config.php one directory higher than the vhost's document root. I've never really found a good explanation for that, but ...
21
votes
6answers
14k views

Can I Prevent Enumeration of Usernames?

Can I prevent enumeration of usernames on my wordpress site? I can see users at the moment using the WPScan tool.
7
votes
2answers
3k views

Handling front-end file uploads, considering safety and ease of use

I'm looking to adapt an existing forum-like plugin which has no facility for attaching media. The plugin works as a Custom Post Type, so it would be as "simple" as attaching an image to a post. I am ...
20
votes
4answers
34k views

Is there any way to rename or hide wp-login.php?

Any way to change the wp-login.php url? It seems insecure that everyone that's ever used Wordpress could easily see if your site is using it, and get right to the login page. There used to be a ...
12
votes
2answers
3k views

How to store username and password to API in wordpress option DB?

I'm currently developing a plugin and the chances are that I will more than likely release it on the public plugin repository so others can use it. The plugin will be using an API and to use this API ...
25
votes
4answers
12k views

Getting a List of Currently Available Roles on a WordPress Site?

When writing WordPress plugins there is often a need to set up options for which roles on the site have access to certain functionality or content. To do this a plugin dev needs to fetch the list of ...
14
votes
3answers
467 views

What are the common security flaws I need to look for? [closed]

As a wannabe WP plugin developper, what are the main security flaws/holes I should look for? I'm about to create a new plugin with a configuration panel (ie input fields and stuff). What should I be ...
19
votes
3answers
9k views

Increase of failed login attempts, brute force attacks? [closed]

I Installed the plugin Simple Login Lockdown and since a couple of days ago the database is recording over 200 records by day. I think that is not possible to have my site attacked by so many IP's ...
9
votes
1answer
8k views

simple solution for restricting access to (some) uploads/downloads

Initial Situation For a site I'm setting up I was looking into the whole field of securing uploads/downloads and restricting access to them based on user roles/capabilities. Of course I have read ...
10
votes
3answers
5k views

Prevent access or auto-delete readme.html, license.txt, wp-config-sample.php

Just a quick question that might help a tad bit with security. I noticed that the readme.html file has the version number listed. It reappears after each upgrade and so do the licence.txt, and wp-...
19
votes
4answers
6k views

What's the easiest way to stop WP from ever logging me out

After a certain amount of time WP logs out all users and forces them to log back in again. For development environments on my local machine this is obnoxious and absolutely unnecessary. Is there an ...
5
votes
2answers
6k views

Limiting sessions to one IP at a time

On a site with premium user account subscriptions, I'd like to be able to limit logins to one computer at a time. The most straightforward way to accomplish this would be to limit by IP, but I haven't ...
15
votes
1answer
4k views

If a hacker changed the blog_charset to UTF-7 does that make WordPress vulnerable to further attacks?

I had a client who got hacked recently and I noticed that there were weird characters appearing on her site, like  and Æ. It turns out that the hackers changed the blog_charset to UTF-7 in the ...
3
votes
0answers
385 views

comment_post_ID 0 (cannot remove from dashboard)

Ran across something a bit odd that I haven't seen before. A client has a pretty active blog and uses Akismet (paid) to protect against spam. At least once a day, they're reporting a spam comment that ...
3
votes
1answer
4k views

How to make media upload private? [duplicate]

Possible Duplicate: How to Protect Uploads, if User is not Logged In? I know how to mark a Page or Post as visible only to members, using the Member Access plugin. This way, the public cannot ...
1
vote
2answers
84 views

Developing a secure front end post editing form

I want to add a front end post editing functionality to one of my Wordpress sites. I found a few plugins that do this, but they don't fits all my needs, so I decided to adapt an existing solution to ...
19
votes
13answers
2k views

What Are Security Best Practices for WordPress Plugins and Themes? [closed]

As suggested in this question, I am adding this topic as a new question, for community discussion/voting regarding best-practices for Plugin/Theme security. Here is the starting checklist, based on ...
14
votes
2answers
742 views

In Which Contexts are Plugins Responsible for Data Validation/Sanitization?

I want to make sure all of the data in my plugins/themes is handled securely before entering the database and before being output to the browser. My problem is that there are situations where the API ...
8
votes
4answers
2k views

Security and .htaccess

About a month ago I started a WordPress blog on a hosted server related to a hobby. So, I am new to this at present. Since I'm concerned about security, one thing I did was to install the plugin WP ...
7
votes
2answers
249 views

Where to securely store API keys and passwords in WordPress?

I'm looking to use a few APIs and many come with keys, secret keys and passwords required to work. Where in WordPress can you store that information? Assuming anyone can hack your DB is there anyway ...
6
votes
2answers
578 views

How can I lock down an old wordpress install I don't intend to update?

I am starting a new wordpress blog, and no longer updating an old one. The old one still gets 400-500 hits a day, so I would like to keep it up for archival purposes, as people still link to its posts....
6
votes
5answers
11k views

Is there a way to force ssl on certain pages

I want to force a secure connection on some of my pages (ones with forms), but I don't want the whole site to work with ssl (slows it down) Is there a way to configure specific pages to require ssl?
2
votes
2answers
95 views

Which ways can be used to log in to Wordpress?

FYI: This has been also posted here since I'm fairly new to this website and didn't know that the Wordpress part existed. Sorry for the repost. I'm currently trying to tighten the security for a ...
10
votes
2answers
3k views

Should I escape wordpress functions like the_title, the_excerpt, the_content

I had look at the code but I couldnt see any escaping on funcions like the_title the_content the_excerptetc. I might not be reading it right. Do I need to escape these functions in theme development ...
9
votes
2answers
454 views

Securing Admin Accounts - Username Discovery

We've had Limit Login Attempts installed for some weeks now, and the number of brute force attempts occurring on wp-admin/wp-login is pretty amazing. At first the attempts were all with the username "...
5
votes
1answer
2k views

What's the difference between esc_* functions?

I've read Professional WordPress and it says: esc_html function is used for scrubbing data that contains HTML. This function encodes special characters into their HTML entities esc_attr ...
4
votes
1answer
509 views

How to protect uploads in multisite if user is not logged in?

I am trying to set up a multisite intranet (using subdomains) where content on each sub-site is only accessible to users logged into their respective site. The problem I am having is trying to ...
3
votes
2answers
811 views

Can I force a password change?

When I create a new user, I would like to force that user to change their password on first log in, can this be done?
3
votes
2answers
2k views

Is there a security risk giving someone temporary access to my blog's code?

My blog is painfully slow for the last few days, and I would like to pay someone (anyone?) 15 BitCoins to optimize it for me (I would do it myself, but I'm not sure I have the time right now). It's ...
2
votes
3answers
540 views

How brute-forcer knows that the password is cracked for target username?

There are very many brute-force attacks (mostly for 'admin' username) on WordPress sites. All these attacks are made automatically via post requests. The question 1: how brute-forcer knows that the ...
8
votes
3answers
593 views

Will there be security updates for 3.1 once 3.2 is released?

I am currently running WordPress 3.1.2 on PHP 5.1.6. The minimum requirement for WordPress 3.2 is going to be PHP 5.2.4 or greater. If I keep running WordPress 3.1.2 and there is a security issue will ...
6
votes
3answers
1k views

WordPress Ajax Data Security

I am aware of nonces to check for intentions but can't make any sense if I can use them to restrict for database reads somehow? I mean, I am fetching records from the database using AJAX but I don't ...
5
votes
3answers
867 views

Secure WordPress paid plug-in

I want to create a WordPress plug-in but also want to ensure that the plugin can only be used after it has been activated with a serial key that should be unique for each domain. What is the best way ...
5
votes
1answer
2k views

Should I remove install.php and install-helper.php?

Is keeping wp-admin/install.php and wp-admin/install-helper.php a security leak on the newer versions of wordpress? By default file permission on those files are 644. If there is any leak, what kind ...
3
votes
1answer
2k views

Is it true $wpdb->get_results is faster than WP_Query in most cases?

On my homepage, I have a section where I have to display the last five featured posts, where a featured post is simply a post with a custom field is_featured set to 1. I achieved what I want with two ...
2
votes
1answer
392 views

How to block a category from one user and enable the category for the rest of the users

I have a site in which all categories are open to anyone, except for 2 categories that are password protected: Students, and Teachers. They are open only to specific users types, as follows: The ...
1
vote
3answers
5k views

Protecting HTML5 video [closed]

I shall explain my situation as best I can so you can see where i'm coming from. I'm working on a wordpress site for a sports team, there are loads of teams. We want to put coaching sessions on our ...
1
vote
1answer
6k views

Websites defaced by uploading script using theme editor

We've had several Wordpress sites defaced, all of them having the same pattern (at least the raw access log says so). From the logs it appears they directly login to Wordpress then go to theme editor >...
0
votes
2answers
222 views

Allow SVG in WP step by step

I'm not strong in WP programming, bu I try to understand what to do to enable SVG in my site. I found that in need to add function below to functions.php: /** * Add SVG capabilities */ function ...
0
votes
2answers
146 views

brute force attack even though it is limited by IP

The security settings of a website we have was done according to Wordpress Recommendations and we did not have any single hacking attempts for months. Especially that wp-login.php and wp-admin are ...
8
votes
2answers
937 views

Are Nonces Useless?

This is probably a noob question BUT hear me out - isn't the point of using Nonce to protect from things like scrappers (phpcurl scrappers etc.)? But my Nonce prints out in the head of the document ...
6
votes
1answer
607 views

multi page password protection

Is it possible to have the "password protected page" feature of WordPress apply to more than one page? I have dozens of pages which I wish to protect with the same password, but I don't want people to ...
6
votes
2answers
3k views

What security concerns should I have when setting FS_METHOD to “direct” in wp-config?

I have recently had an issue where I have been unable to install the WP Smush Pro plugin because I don't have the Manual Install or One-Click Installation options available. I came across this post ...