The security tag has no wiki summary.
55
votes
12answers
6k views
Verifying that I have fully removed a WordPress hack?
My for-fun WordPress blog at http://fakeplasticrock.com (running WordPress 3.1.1) got hacked -- it was showing an <iframe> on every page like so:
<iframe ...
50
votes
7answers
12k views
Steps to Take to Hide the Fact a Site is Using WordPress?
I have a website for which we are trying to be discreet about the fact that we are using WordPress. What steps can we take to make it less obvious?
12
votes
2answers
4k views
How to Protect Uploads, if User is not Logged In?
I use wordpress for a private site where users upload files.
I use the "Private WordPress" to prevent access in to the site if the user is not logged in.
I would like to do the same to the files ...
23
votes
10answers
11k views
Can I rename the wp-admin folder?
Is it possible to rename the wp-admin folder?
I know I could just rename it, but unless it's supported by the code lots of things would break.
If I use a custom folder name, it will make it slightly ...
7
votes
2answers
1k views
Handling front-end file uploads, considering safety and ease of use
I'm looking to adapt an existing forum-like plugin which has no facility for attaching media.
The plugin works as a Custom Post Type, so it would be as "simple" as attaching an image to a post.
I am ...
5
votes
3answers
437 views
Filter any HTTP request URI?
I want to filter any HTTP request URI done through the HTTP API.
Use cases:
The WordPress update check goes to http://api.wordpress.org/core/version-check/1.6/, but ...
35
votes
8answers
6k views
Is moving wp-config outside the web root really beneficial?
One of the most common security best practices these days seems to be moving wp-config.php one directory higher than the vhost's document root. I've never really found a good explanation for that, but ...
11
votes
3answers
309 views
What are the common security flaws I need to look for? [closed]
As a wannabe WP plugin developper, what are the main security flaws/holes I should look for?
I'm about to create a new plugin with a configuration panel (ie input fields and stuff). What should I be ...
5
votes
2answers
982 views
Prevent access or auto-delete readme.html, license.txt, wp-config-sample.php
Just a quick question that might help a tad bit with security. I noticed that the readme.html file has the version number listed. It reappears after each upgrade and so do the licence.txt, and ...
8
votes
4answers
617 views
What's the easiest way to stop WP from ever logging me out
After a certain amount of time WP logs out all users and forces them to log back in again. For development environments on my local machine this is obnoxious and absolutely unnecessary.
Is there an ...
3
votes
5answers
3k views
Is there a way to force ssl on certain pages
I want to force a secure connection on some of my pages (ones with forms), but I don't want the whole site to work with ssl (slows it down)
Is there a way to configure specific pages to require ssl?
2
votes
0answers
222 views
comment_post_ID 0 (cannot remove from dashboard)
Ran across something a bit odd that I haven't seen before. A client has a pretty active blog and uses Akismet (paid) to protect against spam. At least once a day, they're reporting a spam comment that ...
12
votes
2answers
334 views
In Which Contexts are Plugins Responsible for Data Validation/Sanitization?
I want to make sure all of the data in my plugins/themes is handled securely before entering the database and before being output to the browser. My problem is that there are situations where the API ...
15
votes
2answers
3k views
Increase of failed login attempts, brute force attacks?
I Installed the plugin Simple Login Lockdown and since a couple of days ago the database is recording over 200 records by day.
I think that is not possible to have my site attacked by so many IP's
...
1
vote
4answers
14k views
Is there any way to rename or hide wp-login.php?
Any way to change the wp-login.php url? It seems insecure that everyone that's ever used Wordpress could easily see if your site is using it, and get right to the login page.
There used to be a ...
8
votes
2answers
3k views
Getting a List of Currently Available Roles on a WordPress Site?
When writing WordPress plugins there is often a need to set up options for which roles on the site have access to certain functionality or content. To do this a plugin dev needs to fetch the list of ...
6
votes
2answers
440 views
How can I lock down an old wordpress install I don't intend to update?
I am starting a new wordpress blog, and no longer updating an old one.
The old one still gets 400-500 hits a day, so I would like to keep it up for archival purposes, as people still link to its ...
4
votes
1answer
1k views
Limiting sessions to one IP at a time
On a site with premium user account subscriptions, I'd like to be able to limit logins to one computer at a time. The most straightforward way to accomplish this would be to limit by IP, but I haven't ...
3
votes
2answers
612 views
Is there a security risk giving someone temporary access to my blog's code?
My blog is painfully slow for the last few days, and I would like to pay someone (anyone?) 15 BitCoins to optimize it for me (I would do it myself, but I'm not sure I have the time right now).
It's ...
3
votes
2answers
693 views
Can I force a password change?
When I create a new user, I would like to force that user to change their password on first log in, can this be done?
7
votes
3answers
493 views
Will there be security updates for 3.1 once 3.2 is released?
I am currently running WordPress 3.1.2 on PHP 5.1.6. The minimum requirement for WordPress 3.2 is going to be PHP 5.2.4 or greater. If I keep running WordPress 3.1.2 and there is a security issue will ...
6
votes
2answers
208 views
Securing Admin Accounts - Username Discovery
We've had Limit Login Attempts installed for some weeks now, and the number of brute force attempts occurring on wp-admin/wp-login is pretty amazing. At first the attempts were all with the username ...
5
votes
3answers
543 views
WordPress Ajax Data Security
I am aware of nonces to check for intentions but can't make any sense if I can use them to restrict for database reads somehow? I mean, I am fetching records from the database using AJAX but I don't ...
4
votes
1answer
60 views
Should I remove install.php and install-helper.php?
Is keeping wp-admin/install.php and wp-admin/install-helper.php a security leak on the newer versions of wordpress? By default file permission on those files are 644.
If there is any leak, what kind ...
0
votes
1answer
878 views
Receiving “This content cannot be displayed in a frame” error on login page
I am using a new domain for my WordPress directory in different server. When I click the meta links such "Login" or "register", I get this page:
This content cannot be displayed in a frame
To ...
0
votes
1answer
2k views
Websites defaced by uploading script using theme editor
We've had several Wordpress sites defaced, all of them having the same pattern (at least the raw access log says so). From the logs it appears they directly login to Wordpress then go to theme editor ...
-1
votes
2answers
337 views
How to improve WordPress security by hiding non public facing files?
e.g.
curl -I http://ma.tt/blog/wp-config.php
200 OK
The wp-config.php is not public facing file, since it currently just return blank page, so why not return 404 instead. (so will not be cached by ...
7
votes
2answers
403 views
Are Nonces Useless?
This is probably a noob question BUT hear me out - isn't the point of using Nonce to protect from things like scrappers (phpcurl scrappers etc.)? But my Nonce prints out in the head of the document ...
3
votes
1answer
631 views
How to make media upload private? [duplicate]
Possible Duplicate:
How to Protect Uploads, if User is not Logged In?
I know how to mark a Page or Post as visible only to members, using the Member Access plugin. This way, the public ...
3
votes
2answers
2k views
Can upload doc and pdf but not ppt - not permitted for security reasons
"Insert search engine here" was pretty useless for this one - I've had a look through wp-includes/functions.php, wp-admin/includes/file.php etc. but not found a reason for the behaviour I'm getting.
...
3
votes
3answers
831 views
Options for restricting access to wp-admin
So i've installed a plug-in which allows me to enable two-factor authentication for my users. The problem is that to enable the plug-in i have to log in as that user and enable it via their profile ...
2
votes
3answers
116 views
How brute-forcer knows that the password is cracked for target username?
There are very many brute-force attacks (mostly for 'admin' username) on WordPress sites.
All these attacks are made automatically via post requests.
The question 1: how brute-forcer knows that the ...
2
votes
2answers
5k views
How to change “wp-admin” to something else without search-replacing the core?
for example: foobar.com/wp/edit instead of foobar.com/wp/wp-admin
How would I do that?
I've tried using this in htaccess but it won't work:
##### ABOVE THIS POINT IS ALREADY INSERTED BY WORD PRESS
...
1
vote
1answer
284 views
How to block a category from one user and enable the category for the rest of the users
I have a site in which all categories are open to anyone, except for 2 categories that are password protected: Students, and Teachers. They are open only to specific users types, as follows:
The ...
1
vote
1answer
427 views
whats the difference between esc_* functions
i read professional wordpress and
esc_html function is used for
scrubbing data that contains HTML.
This function encodes special
characters into their HTML entities
esc_attr function ...
0
votes
1answer
247 views
Does WP show me if I'm logged in from multiple locations?
Does word press show me if I'm logged in in another location?
Related: Limiting sessions to one IP at a time
-1
votes
1answer
81 views
Overwhelming code injection [closed]
My WP site was plagued with code injection such as this:
68c8c7
echo "
asgq=[0x28,0x66,0x75,0x6e,0x63,0x7d, .......
...
-1
votes
1answer
2k views
How to secure WordPress XMLRPC?
XMLRPC is great for remote publishing to WordPress, but there has been many security issues attributed to it. How do it make it more secure?
More specifically, only user from the intranet will be ...
-1
votes
2answers
360 views
What do spammers gain by signing up as a user?
The majority of new user signups I receive on my Wordpress blog look dodgy, with @someblog.com, @somearticle.com, or @gmail.com addresses.
What do they gain by signing up as a new user?
