Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

2
votes
1answer
185 views

Which of WordPress's .php files need to be directly accessible via HTTP?

I'm trying to tighten up security on my WordPress installation, and one of the things that seems like it might be a good idea is preventing all of the internal-use .php files from being accessed ...
1
vote
1answer
19 views

Failed login attempts

I'm using WordFence for site monitoring and overall security. I'm seeing some failed login attempts from a couple of different locations with username "admin" and "companyname". I'm not familiar with ...
1
vote
1answer
27 views

Is it important to sanitize inputs in a shortcode that will be used in site that only I will post to?

Is there any security risk in not sanitizing shortcodes in a wordpress site if I am the only one who has access to the admin panel?
1
vote
1answer
55 views

Is it safe to allow non-admin users access to media uploader

Hi fellow Wordpress users :) I wanted to ask is it safe to allow non-admin users access to WordPress media uploader. Can they inject a virus while uploading media? How is WP system fighting against ...
3
votes
0answers
252 views

Disallow file edit not preventing plugin install

I have a little demo site (admin details are listed publicly), and I've configured the wp-config.php to disallow file edits, so in theory no one can install a theme / plugin. define( ...
2
votes
0answers
490 views

How to get WordPress to save upload file beyond web root

I am using nginx on a multisite install. I am trying to get WordPress to save uploads to a folder beyond the webroot : /home/mydomain/file_secure as opposed to ...
2
votes
0answers
350 views

comment_post_ID 0 (cannot remove from dashboard)

Ran across something a bit odd that I haven't seen before. A client has a pretty active blog and uses Akismet (paid) to protect against spam. At least once a day, they're reporting a spam comment that ...
1
vote
0answers
85 views

How do I get around “Sorry, this file type is not permitted for security reasons”?

I was wondering how I could allow .tiff files to be uploaded in my wordpress site. I get the message "Sorry this file type is not permitted for security reasons". This question has been asked in ...
1
vote
0answers
61 views

How to allow internal links using wp_kses filtration

I'm working on front end submission and of course I want to secure data by filtering before inserting to database. The form contains repeatable fields group data which I want filter by wp_kses ...
1
vote
0answers
144 views

How to escape custom css?

I'm creating a WordPress theme in which I've allowed users to add some custom css from the Theme Options. This css code then directly gets echoed out in the head section of the page, with the ...
1
vote
0answers
246 views

How can I safely use $_SERVER['REQUEST_URI'] to avoid XSS?

I've seen a lot of warnings about using $_SERVER['REQUEST_URI'] because it can open things up to XSS, but I haven't been able to find anything confirming a safe way to use it. Some people have ...
1
vote
0answers
42 views

Securing a multi-user permission structure

I'm currently working on a team that needs two distinct users from the same wpadmin group to be able to modify the wordpress files. Following the guide at Hardening WordPress (Codex), the following ...
1
vote
0answers
49 views

Strategies for coping with hyperagressive spambots?

A couple of my sites are getting slammed by a hyperagressive distributed spambot. It's just pure link spam. It all comes from one user name, but from a variety of IPs. Akismet is catching the spam, ...
1
vote
0answers
182 views

Renaming admin user on multisite install by MySQL

As part of a general tightening of security, I want to change the name of the admin user on my multisite install to something less commonly used. This user is admin on all five sites in the network ...
1
vote
0answers
207 views

Can I Remove xmlrpc.php completely?

My site is getting a lot of malicious traffic to domain.com/xmlrpc.php, to the point that the server is not being able to handle it. I tried to disable it via the wp-config.php, by adding this line: ...
1
vote
0answers
84 views

Are un-sanitized theme options more vulnerable to malicious scripts than the theme editor?

I'd like to put text areas in a theme options area to allow users to easily add analytics code, scripts, and css. Is it silly to worry about malicious code being inserted via un-sanitized theme ...
1
vote
0answers
65 views

Network Admin URL is shown to anyone before accessing a blog

I have a multisite setup and I noticed today that my security was not working properly. Each of my blogs has its own url : http://www.example1.com http://www.example2.com … My "main blog" is not ...
0
votes
0answers
14 views

esc_url within iFrame

I'm building a WordPress theme. To improve security, I'm escaping any URLs, like so: <?php $background = wp_get_attachment_image_src(get_post_thumbnail_id($post->ID), '' ); ?> <div ...
0
votes
0answers
18 views

Hide username discovery

How do I stop my usernames being leaked? To explain I tested my WordPress site on http://wprecon.com, and found that my admin username (that I have changed) was able to be discovered. User ...
0
votes
0answers
35 views

Single sign-on: wp_authenticate_user vs wp_authenticate

I have a wordpress site (lets call it site1) and another site with oauth2 (site2). When a new user is created, a record is created in both site1 and site2 databases with the same email as username, ...
0
votes
0answers
33 views

Post meta sanitization and escaping

I'm writing a plugin that adds a text meta box where user enters (supposedly) media URL, which then is displayed in posts with $featured_media = get_post_meta( $post_id, '_meta_key', true ); echo ...
0
votes
0answers
45 views

Collecting Sensitive Data in Wordpress?

I am in need of creating an online application form that collected a users SSN number and am therefore concerned with security. Is this possible to do on WP with existing plugins? My research thus ...
0
votes
0answers
45 views

Getting the current page post_id in function hooked to wp_ajax?

I have created a kind of a social network where when a user registration happens, I create a post (custom post type follower) for each user and assign its post_id to the user ( ...
0
votes
0answers
27 views

Security Plugin Blocks Access to theme folder?

I'm using some jquery to do an ajax request within my theme and it's spitting out a file 404 error even though the file exists. I"m guessing it has something to do with the security plugin. here's ...
0
votes
0answers
9 views

Security of using uploaded file across two admin submits

I'm writing a plugin that merges two files, based on user input about which file to draw each section from. This means that I have to get the user upload and display it before I can get the user input ...
0
votes
0answers
23 views

Is it good practice to use WordPress nonce values to restrict page access?

I'm working with a colleague on a WordPress plugin. Part of the plugin functionality is showing dynamic lists with links which allow you to open a new page. Depending on the user's role, they may or ...
0
votes
0answers
27 views

What is the best way to upload a temporary & sensitive file and then delete it when done

What is the best way to upload a temporary & sensitive file and then delete it when done. I'm writing a plugin (eventually for multisite) that allows users with a certain role to upload a .csv ...
0
votes
0answers
110 views

Why WordPress not logout after I have close my browser?

The default login cookie has expiry time as "session", so suppose when I close my browser, I need to login again when I visit wp-admin. But I've found that serveral time I've closed my browser (kill ...
0
votes
0answers
15 views

How would I have to change rewrite rules to use a custom ms-files.php

I've previously wondered about securing file access by non-logged in users who know the full URL in multisite. When ms-files was still used modifications to this file allowed a basic form of WP-run ...
0
votes
0answers
30 views

Storing Facebook page token in the options table

I developed on few wordpress sites, the ability to publish a post or page to facebook with custom values. I am on the process of turning my code into a plugin but I want to make it the good way. I ...
0
votes
0answers
294 views

Change Login URL Without Plugin

I want to change the login url of my Wordpress install away from /wp-admin.php I am aiming to do so and am looking at changing the .htaccess file to add in: RewriteRule ^login$ ...
0
votes
0answers
36 views

Remove user credentials from GET or POST on login

This may be a totally noob question but... I noticed that, with the standard Wordpress install, it seems like one can obtain the user's login credentials just by viewing the GET and/or POST vars ...
0
votes
0answers
46 views

Background Updates Not Happening

I have some sites which are not updating with the background updater. I installed the Background Update Tester plugin and everything looks fine. Currently they are at 3.9 but they are telling me that ...
0
votes
0answers
30 views

Folder Permissions + Security Concerns

I messed up bad guys. I while working on another part of my website I accidentally nuked my WordPress folder permissions. I was able to find/fix some problems and I got my site up and running but some ...
0
votes
0answers
28 views

How to get WP to run plugin code triggered by an external site hook?

I have written a plugin to sync data from a WP blog to an external website. Changes to made to the external site also sync back to the WP blog. Right now the external website executes a POST request ...
0
votes
0answers
211 views

WordPress it's cleaning a custom query_var to avoid sql injections?

I am using get_query_var function to get a custom query_var. This query_var will be used later in to query arguments to retrieve posts with: $the_query = new WP_Query( $args ); . My question is, ...
0
votes
0answers
130 views

SWF in wordpress post

My question is somewhat a two part question. First I embedded a SWF file into my blog post using Easy Flash Embed plugin. It shows up on my desktop computer but when I view the post on my mobile ...
0
votes
0answers
145 views

wp-config.php file and code injection

It looks like several my sites on BlueHost got code injection in the wp-config.php file. Injected code itself looks like Any clue where it comes from? BH malware scan doesn't recognize that code so ...
0
votes
0answers
324 views

Can I make an ajax response cross-domain?

I am trying to make a single ajax response cross-domain. Is that possible? I tried something like this, but that did not work: function my_call_callback() { header("Access-Control-Allow-Origin: ...
0
votes
0answers
81 views

Wordpress exploited theme is causing high io load on server

I used a Wordpress theme for a while that was causing high IO-load on my server. That was because there was some kind of exploits made/available for the theme: ...
0
votes
0answers
120 views

Why are xmlrpc.php and wp-cron.php being called so often?

I'm running a Wordpress website and I have found from the server logs that xmlrpc.php and wp-cron.php are being requested (POST requests, of course) very frequently--including some suspicious ips that ...
0
votes
0answers
292 views

Nonces and Cache

It's clear that form submissions and AJAX requests, especially sensible ones, need "nonces" to avoid certain exploits. However, with heavy use of caching systems it becomes harder to generate them ...
0
votes
0answers
246 views

Malware/Permission bug removal?

I'm facing a hell of a problem on a client's WP theme. Whenever I try to 'Activate' it, it gives me the following errors on a blank page: Warning: ...
0
votes
0answers
52 views

Allowing access to certain Wordpress created pages or posts with htaccess / htpasswd

Trying to figure out how to give access to a certain page, lets say http://mypage.com/page and not letting people access the main index via http://mypage.com. Or just simply disallow access to ...
0
votes
0answers
59 views

checking the form submit in right order

With help from experts on this site, I have been able to put together a plugin that allows to choose and submit categories from the front-end. Further, in order to make it a bit more secure I have ...
0
votes
0answers
94 views

Form That Submits Content Securely

I have built a WP site for a client. One of the pages has a form which my client's customers will use to submit material to my client, and one of the required fields is a file upload. My client ...
0
votes
0answers
40 views

False URL for shopping cart

OK. Re wording my question I have a digital product on a wordpress site Using a shopping cart I'm charging .99 cents for people to look at a video (going to charity) The cart directs them to a page ...
0
votes
0answers
35 views

Malware installation during plugin update?

I update my wordpress blog daily (current version: WordPress 3.5.2). Today I installed an update of "Search everything". After that, my webspace was infected by malware. Interestingly, my blog is ...
0
votes
0answers
483 views

Core files changed - site hacked?

Got a WordFence alert last night for one of our WordPress sites, saying that some WordPress core files had been changed: WordPress core file modified: wp-content/plugins/akismet/admin.php WordPress ...
0
votes
0answers
28 views

Is [admin / admin] acceptable for all local websites?

Are there security issues with using the same credentials [admin / admin] for all client websites on a working, local server ?