Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

63
votes
12answers
8k views

Verifying that I have fully removed a WordPress hack?

My for-fun WordPress blog at http://fakeplasticrock.com (running WordPress 3.1.1) got hacked -- it was showing an <iframe> on every page like so: <iframe ...
69
votes
9answers
21k views

Steps to Take to Hide the Fact a Site is Using WordPress?

I have a website for which we are trying to be discreet about the fact that we are using WordPress. What steps can we take to make it less obvious?
15
votes
2answers
9k views

How to Protect Uploads, if User is not Logged In?

I use wordpress for a private site where users upload files. I use the "Private WordPress" to prevent access in to the site if the user is not logged in. I would like to do the same to the files ...
30
votes
10answers
17k views

Can I rename the wp-admin folder?

Is it possible to rename the wp-admin folder? I know I could just rename it, but unless it's supported by the code lots of things would break. If I use a custom folder name, it will make it slightly ...
54
votes
8answers
15k views

Is moving wp-config outside the web root really beneficial?

One of the most common security best practices these days seems to be moving wp-config.php one directory higher than the vhost's document root. I've never really found a good explanation for that, but ...
5
votes
3answers
1k views

Filter any HTTP request URI?

I want to filter any HTTP request URI done through the HTTP API. Use cases: The WordPress update check goes to http://api.wordpress.org/core/version-check/1.6/, but ...
7
votes
2answers
2k views

Handling front-end file uploads, considering safety and ease of use

I'm looking to adapt an existing forum-like plugin which has no facility for attaching media. The plugin works as a Custom Post Type, so it would be as "simple" as attaching an image to a post. I am ...
5
votes
1answer
2k views

simple solution for restricting access to (some) uploads/downloads

Initial Situation For a site I'm setting up I was looking into the whole field of securing uploads/downloads and restricting access to them based on user roles/capabilities. Of course I have read ...
18
votes
2answers
5k views

Increase of failed login attempts, brute force attacks?

I Installed the plugin Simple Login Lockdown and since a couple of days ago the database is recording over 200 records by day. I think that is not possible to have my site attacked by so many IP's ...
7
votes
5answers
3k views

Can I Prevent Enumeration of Usernames?

Can I prevent enumeration of usernames on my wordpress site? I can see users at the moment using the WPScan tool.
0
votes
2answers
2k views

How to secure WordPress XMLRPC?

XMLRPC is great for remote publishing to WordPress, but there has been many security issues attributed to it. How do it make it more secure? More specifically, only user from the intranet will be ...
9
votes
4answers
21k views

Is there any way to rename or hide wp-login.php?

Any way to change the wp-login.php url? It seems insecure that everyone that's ever used Wordpress could easily see if your site is using it, and get right to the login page. There used to be a ...
14
votes
2answers
482 views

In Which Contexts are Plugins Responsible for Data Validation/Sanitization?

I want to make sure all of the data in my plugins/themes is handled securely before entering the database and before being output to the browser. My problem is that there are situations where the API ...
13
votes
3answers
407 views

What are the common security flaws I need to look for? [closed]

As a wannabe WP plugin developper, what are the main security flaws/holes I should look for? I'm about to create a new plugin with a configuration panel (ie input fields and stuff). What should I be ...
6
votes
2answers
2k views

Prevent access or auto-delete readme.html, license.txt, wp-config-sample.php

Just a quick question that might help a tad bit with security. I noticed that the readme.html file has the version number listed. It reappears after each upgrade and so do the licence.txt, and ...
13
votes
2answers
6k views

Getting a List of Currently Available Roles on a WordPress Site?

When writing WordPress plugins there is often a need to set up options for which roles on the site have access to certain functionality or content. To do this a plugin dev needs to fetch the list of ...
10
votes
4answers
2k views

What's the easiest way to stop WP from ever logging me out

After a certain amount of time WP logs out all users and forces them to log back in again. For development environments on my local machine this is obnoxious and absolutely unnecessary. Is there an ...
5
votes
2answers
3k views

Limiting sessions to one IP at a time

On a site with premium user account subscriptions, I'd like to be able to limit logins to one computer at a time. The most straightforward way to accomplish this would be to limit by IP, but I haven't ...
4
votes
5answers
5k views

Is there a way to force ssl on certain pages

I want to force a secure connection on some of my pages (ones with forms), but I don't want the whole site to work with ssl (slows it down) Is there a way to configure specific pages to require ssl?
2
votes
0answers
297 views

comment_post_ID 0 (cannot remove from dashboard)

Ran across something a bit odd that I haven't seen before. A client has a pretty active blog and uses Akismet (paid) to protect against spam. At least once a day, they're reporting a spam comment that ...
3
votes
1answer
2k views

How to make media upload private? [duplicate]

Possible Duplicate: How to Protect Uploads, if User is not Logged In? I know how to mark a Page or Post as visible only to members, using the Member Access plugin. This way, the public ...
18
votes
13answers
1k views

What Are Security Best Practices for WordPress Plugins and Themes? [closed]

As suggested in this question, I am adding this topic as a new question, for community discussion/voting regarding best-practices for Plugin/Theme security. Here is the starting checklist, based on ...
8
votes
4answers
1k views

Security and .htaccess

About a month ago I started a WordPress blog on a hosted server related to a hobby. So, I am new to this at present. Since I'm concerned about security, one thing I did was to install the plugin WP ...
6
votes
2answers
495 views

How can I lock down an old wordpress install I don't intend to update?

I am starting a new wordpress blog, and no longer updating an old one. The old one still gets 400-500 hits a day, so I would like to keep it up for archival purposes, as people still link to its ...
8
votes
2answers
297 views

Securing Admin Accounts - Username Discovery

We've had Limit Login Attempts installed for some weeks now, and the number of brute force attempts occurring on wp-admin/wp-login is pretty amazing. At first the attempts were all with the username ...
3
votes
3answers
343 views

How brute-forcer knows that the password is cracked for target username?

There are very many brute-force attacks (mostly for 'admin' username) on WordPress sites. All these attacks are made automatically via post requests. The question 1: how brute-forcer knows that the ...
3
votes
2answers
1k views

Is there a security risk giving someone temporary access to my blog's code?

My blog is painfully slow for the last few days, and I would like to pay someone (anyone?) 15 BitCoins to optimize it for me (I would do it myself, but I'm not sure I have the time right now). It's ...
3
votes
2answers
747 views

Can I force a password change?

When I create a new user, I would like to force that user to change their password on first log in, can this be done?
7
votes
3answers
552 views

Will there be security updates for 3.1 once 3.2 is released?

I am currently running WordPress 3.1.2 on PHP 5.1.6. The minimum requirement for WordPress 3.2 is going to be PHP 5.2.4 or greater. If I keep running WordPress 3.1.2 and there is a security issue will ...
6
votes
3answers
828 views

WordPress Ajax Data Security

I am aware of nonces to check for intentions but can't make any sense if I can use them to restrict for database reads somehow? I mean, I am fetching records from the database using AJAX but I don't ...
5
votes
1answer
640 views

Should I remove install.php and install-helper.php?

Is keeping wp-admin/install.php and wp-admin/install-helper.php a security leak on the newer versions of wordpress? By default file permission on those files are 644. If there is any leak, what kind ...
4
votes
3answers
706 views

Secure WordPress paid plug-in

I want to create a WordPress plug-in but also want to ensure that the plugin can only be used after it has been activated with a serial key that should be unique for each domain. What is the best way ...
3
votes
1answer
659 views

What's the difference between esc_* functions?

I've read Professional WordPress and it says: esc_html function is used for scrubbing data that contains HTML. This function encodes special characters into their HTML entities esc_attr ...
1
vote
1answer
5k views

Receiving “This content cannot be displayed in a frame” error on login page

I am using a new domain for my WordPress directory in different server. When I click the meta links such "Login" or "register", I get this page: This content cannot be displayed in a frame To ...
1
vote
1answer
3k views

Websites defaced by uploading script using theme editor

We've had several Wordpress sites defaced, all of them having the same pattern (at least the raw access log says so). From the logs it appears they directly login to Wordpress then go to theme editor ...
0
votes
4answers
974 views

No option “I would like my site to be private, visible only to users I choose” in Privacy Settings

I am running WordPress 3.3.2 self-hosted. I used to see the option "I would like my site to be private, visible only to users I choose" under Privacy Settings but I no longer see this option. Instead, ...
-1
votes
2answers
939 views

How to improve WordPress security by hiding non public facing files?

e.g. curl -I http://ma.tt/blog/wp-config.php 200 OK The wp-config.php is not public facing file, since it currently just return blank page, so why not return 404 instead. (so will not be cached by ...
8
votes
2answers
667 views

Are Nonces Useless?

This is probably a noob question BUT hear me out - isn't the point of using Nonce to protect from things like scrappers (phpcurl scrappers etc.)? But my Nonce prints out in the head of the document ...
4
votes
2answers
3k views

Can upload doc and pdf but not ppt - not permitted for security reasons

"Insert search engine here" was pretty useless for this one - I've had a look through wp-includes/functions.php, wp-admin/includes/file.php etc. but not found a reason for the behaviour I'm getting. ...
3
votes
3answers
924 views

Options for restricting access to wp-admin

So i've installed a plug-in which allows me to enable two-factor authentication for my users. The problem is that to enable the plug-in i have to log in as that user and enable it via their profile ...
2
votes
1answer
686 views

how can i embed wordpress backend in iframe

I have 2 websites http://www.aaa.com and http://www.bbb.com and need it show the same. now i put iframe in index.html and upload to aaa.com. it's ok for frontend but it's doesn't work for backend, ...
2
votes
3answers
6k views

How to change “wp-admin” to something else without search-replacing the core?

for example: foobar.com/wp/edit instead of foobar.com/wp/wp-admin How would I do that? I've tried using this in htaccess but it won't work: ##### ABOVE THIS POINT IS ALREADY INSERTED BY WORD PRESS ...
1
vote
1answer
358 views

How to block a category from one user and enable the category for the rest of the users

I have a site in which all categories are open to anyone, except for 2 categories that are password protected: Students, and Teachers. They are open only to specific users types, as follows: The ...
0
votes
1answer
92 views

Trying to understand nature of hacking

Today we saw suddenly two files created in root folder in one of our wordpress websites - file name owp.php and gmail.html On investigating the access logs following entries were found which seem to ...
0
votes
1answer
293 views

Does using a custom query_var create a security hole?

Say I put the following code in functions.php function add_my_query_vars($qvars) { $qvars[] = "new_var"; return $qvars; } add_filter('query_vars', 'add_my_query_vars'); If somebody requests ...
0
votes
2answers
655 views

What do spammers gain by signing up as a user?

The majority of new user signups I receive on my Wordpress blog look dodgy, with @someblog.com, @somearticle.com, or @gmail.com addresses. What do they gain by signing up as a new user?
0
votes
1answer
438 views

Does WP show me if I'm logged in from multiple locations?

Does word press show me if I'm logged in in another location? Related: Limiting sessions to one IP at a time