Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

3
votes
1answer
53 views

Run WordPress frontend and backend in different domains

I want to run my WP frontend as www.example.com and my backend (i.e. wp-admin) as user1.example.org, is it possible? The reason is I want to host lot of sites in a single server which has only 1 IP ...
2
votes
1answer
168 views

Which of WordPress's .php files need to be directly accessible via HTTP?

I'm trying to tighten up security on my WordPress installation, and one of the things that seems like it might be a good idea is preventing all of the internal-use .php files from being accessed ...
1
vote
1answer
32 views

Is it safe to hand over the admin rights?

I have a shared web hosting account where I have several different websites running on WordPress. I want to hand over the admin rights for one of my WordPress installs to someone and I am wondering ...
1
vote
1answer
100 views

Is there a way to create a URL (new WP page) that can only be accessed from a specific source?

To explain further, here's what I"m looking to do: Create a WP page Use the URL and implement it in a reader service that is hosted (not downloadable) that in order to read (& access the URL) ...
1
vote
1answer
118 views

How can I secure a WordPress blog using OpenID from a single provider?

We're about to launch an internal blog for the company I work at. Much of the blog will be available to the public, but certain posts will be for employees only. Our intranet/extranet has an OpenID ...
1
vote
1answer
107 views

using rewrites to secure login page

I'm trying to be sneaky with iis to secure a wordpress login page (not my choice to run a windows server, but that's the reality of things). It's worked so far, only the login page itself loads itself ...
1
vote
1answer
30 views

correct tags for validating input types

I have following types of theme options inputs, which I need to validate. $numbers = "#1234"; $email = "abc@example.com"; $simeple_text = "How's going?"; $code = "<script ...
2
votes
0answers
177 views

How to get WordPress to save upload file beyond web root

I am using nginx on a multisite install. I am trying to get WordPress to save uploads to a folder beyond the webroot : /home/mydomain/file_secure as opposed to ...
2
votes
0answers
300 views

comment_post_ID 0 (cannot remove from dashboard)

Ran across something a bit odd that I haven't seen before. A client has a pretty active blog and uses Akismet (paid) to protect against spam. At least once a day, they're reporting a spam comment that ...
1
vote
0answers
35 views

How to allow internal links using wp_kses filtration

I'm working on front end submission and of course I want to secure data by filtering before inserting to database. The form contains repeatable fields group data which I want filter by wp_kses ...
1
vote
0answers
18 views

Securing a multi-user permission structure

I'm currently working on a team that needs two distinct users from the same wpadmin group to be able to modify the wordpress files. Following the guide at Hardening WordPress (Codex), the following ...
1
vote
0answers
40 views

Strategies for coping with hyperagressive spambots?

A couple of my sites are getting slammed by a hyperagressive distributed spambot. It's just pure link spam. It all comes from one user name, but from a variety of IPs. Akismet is catching the spam, ...
1
vote
0answers
150 views

Can I Remove xmlrpc.php completely?

My site is getting a lot of malicious traffic to domain.com/xmlrpc.php, to the point that the server is not being able to handle it. I tried to disable it via the wp-config.php, by adding this line: ...
1
vote
0answers
120 views

Disallow file edit not preventing plugin install

I have a little demo site (admin details are listed publicly), and I've configured the wp-config to disallow file edits, so in theory no one can install a theme / plugin. ...
1
vote
0answers
73 views

Are un-sanitized theme options more vulnerable to malicious scripts than the theme editor?

I'd like to put text areas in a theme options area to allow users to easily add analytics code, scripts, and css. Is it silly to worry about malicious code being inserted via un-sanitized theme ...
1
vote
0answers
60 views

Network Admin URL is shown to anyone before accessing a blog

I have a multisite setup and I noticed today that my security was not working properly. Each of my blogs has its own url : http://www.example1.com http://www.example2.com … My "main blog" is not ...
0
votes
0answers
17 views

Remove user credentials from GET or POST on login

This may be a totally noob question but... I noticed that, with the standard Wordpress install, it seems like one can obtain the user's login credentials just by viewing the GET and/or POST vars ...
0
votes
0answers
21 views

How to escape custom css?

I'm creating a WordPress theme in which I've allowed users to add some custom css from the Theme Options. This css code then directly gets echoed out in the head section of the page, with the ...
0
votes
0answers
26 views

Background Updates Not Happening

I have some sites which are not updating with the background updater. I installed the Background Update Tester plugin and everything looks fine. Currently they are at 3.9 but they are telling me that ...
0
votes
0answers
19 views

Folder Permissions + Security Concerns

I messed up bad guys. I while working on another part of my website I accidentally nuked my WordPress folder permissions. I was able to find/fix some problems and I got my site up and running but some ...
0
votes
0answers
15 views

How to get WP to run plugin code triggered by an external site hook?

I have written a plugin to sync data from a WP blog to an external website. Changes to made to the external site also sync back to the WP blog. Right now the external website executes a POST request ...
0
votes
0answers
43 views

WordPress it's cleaning a custom query_var to avoid sql injections?

I am using get_query_var function to get a custom query_var. This query_var will be used later in to query arguments to retrieve posts with: $the_query = new WP_Query( $args ); . My question is, ...
0
votes
0answers
57 views

How can I safely use $_SERVER['REQUEST_URI'] to avoid XSS?

I've seen a lot of warnings about using $_SERVER['REQUEST_URI'] because it can open things up to XSS, but I haven't been able to find anything confirming a safe way to use it. Some people have ...
0
votes
0answers
56 views

SWF in wordpress post

My question is somewhat a two part question. First I embedded a SWF file into my blog post using Easy Flash Embed plugin. It shows up on my desktop computer but when I view the post on my mobile ...
0
votes
0answers
64 views

wp-config.php file and code injection

It looks like several my sites on BlueHost got code injection in the wp-config.php file. Injected code itself looks like Any clue where it comes from? BH malware scan doesn't recognize that code so ...
0
votes
0answers
30 views

How to force two-step authentication with Jetpack?

I'm using Jetpack's SSO module for two-step authentication, but it's not what I thought. I can still simply login via the login form withing going into authentication. It's only calling for two-step ...
0
votes
0answers
85 views

Can I make an ajax response cross-domain?

I am trying to make a single ajax response cross-domain. Is that possible? I tried something like this, but that did not work: function my_call_callback() { header("Access-Control-Allow-Origin: ...
0
votes
0answers
52 views

Wordpress exploited theme is causing high io load on server

I used a Wordpress theme for a while that was causing high IO-load on my server. That was because there was some kind of exploits made/available for the theme: ...
0
votes
0answers
41 views

reCAPTCHA is not visible on comments loaded via ajax

I've a php template loaded on a popup and this template should contain on the bottom the possibility for a user -logged in or not- to write comments. for security reasons it was installed the plugin ...
0
votes
0answers
37 views

Changing WP location and wp-content folder name witouth loosing SEO

I'm trying to make my site the most efficient way as possible, and I find out thant changing lot of things in permalinks , security folders , etc, works pretty well. But what happen if the WP, is ...
0
votes
0answers
106 views

wordpress: only admin can access wp-content folder

as wp-content/ upload folder has public access and is accessible through url. for example: http://site.com/wp-content/uploads/2014/02/test.pdf i want to make it accessible by admin only.. it can ...
0
votes
0answers
30 views

What kind of security does wp_handle_upload() provide?

According to the docs, wp_handle_upload(), will: Handle PHP uploads in WordPress, sanitizing file names, checking extensions for mime type, and moving the file to the appropriate directory within ...
0
votes
0answers
72 views

Why are xmlrpc.php and wp-cron.php being called so often?

I'm running a Wordpress website and I have found from the server logs that xmlrpc.php and wp-cron.php are being requested (POST requests, of course) very frequently--including some suspicious ips that ...
0
votes
0answers
51 views

Renaming admin user on multisite install by MySQL

As part of a general tightening of security, I want to change the name of the admin user on my multisite install to something less commonly used. This user is admin on all five sites in the network ...
0
votes
0answers
54 views

Inserting HTML elements into table with TinyMCE, security

I am working on a wordpress plugin where the administrator can fill out a form that adds products to a table. For most inputs I am using sanitize_text_field(), and then inserting the data. But for ...
0
votes
0answers
36 views

How can I establish the credibility of a theme/plugin author?

As prompted by the question "Are WordPress Plugins Necessary?", through what practices can administrators of self-hosted WordPress installations establish the credibility of a theme/plugin author ...
0
votes
0answers
19 views

Does it make sense to use two factor authentication with password protected wp-admin folder?

I've finished building my wordpress website and now, I'm concerned about the security of the website. To improve security, I'm using Google two factor authentication plugin while also ...
0
votes
0answers
104 views

wordpress powered site's google search excerpt showing casino links

I have wordpress blog i just checked Google search result of my site, they are showing excerpt containing text like below "best site should try out for demo mode of gaming variants to adopt good ...
0
votes
0answers
52 views

Safe way to allow sample HTML code in comments?

I see that post comments do not allow short snippets of sample HTML code to be entered for safety reasons. But if you have a blog where you expect to have conversations about code, how do you handle ...
0
votes
0answers
35 views

How to escape shortcode content? Do I even need to escape or validate?

I've written a small shortcode that wraps it's content into a HTML element, like so: [my_shortcode]The sun is shining today.[/my_shortcode] In my shortcode function, I basically return the string ...
0
votes
0answers
116 views

Nonces and Cache

It's clear that form submissions and AJAX requests, especially sensible ones, need "nonces" to avoid certain exploits. However, with heavy use of caching systems it becomes harder to generate them ...
0
votes
0answers
116 views

Malware/Permission bug removal?

I'm facing a hell of a problem on a client's WP theme. Whenever I try to 'Activate' it, it gives me the following errors on a blank page: Warning: ...
0
votes
0answers
63 views

Encrypt Email Addresses at Rest

Some enterprise clients require that all email addresses be encrypted at rest (i.e., the actual values stored in the database must be encrypted). I've put together something that seems to do the ...
0
votes
0answers
48 views

Allowing access to certain Wordpress created pages or posts with htaccess / htpasswd

Trying to figure out how to give access to a certain page, lets say http://mypage.com/page and not letting people access the main index via http://mypage.com. Or just simply disallow access to ...
0
votes
0answers
51 views

checking the form submit in right order

With help from experts on this site, I have been able to put together a plugin that allows to choose and submit categories from the front-end. Further, in order to make it a bit more secure I have ...
0
votes
0answers
73 views

Form That Submits Content Securely

I have built a WP site for a client. One of the pages has a form which my client's customers will use to submit material to my client, and one of the required fields is a file upload. My client ...
0
votes
0answers
32 views

False URL for shopping cart

OK. Re wording my question I have a digital product on a wordpress site Using a shopping cart I'm charging .99 cents for people to look at a video (going to charity) The cart directs them to a page ...
0
votes
0answers
28 views

Malware installation during plugin update?

I update my wordpress blog daily (current version: WordPress 3.5.2). Today I installed an update of "Search everything". After that, my webspace was infected by malware. Interestingly, my blog is ...
0
votes
0answers
330 views

Core files changed - site hacked?

Got a WordFence alert last night for one of our WordPress sites, saying that some WordPress core files had been changed: WordPress core file modified: wp-content/plugins/akismet/admin.php WordPress ...
0
votes
0answers
28 views

Is [admin / admin] acceptable for all local websites?

Are there security issues with using the same credentials [admin / admin] for all client websites on a working, local server ?