Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

4
votes
0answers
82 views

Improve wordpress security by hiding non public resources

I'm new from wordpress and i want improve security of wordpress multisite by hiding non public resources, eg. wp-admin, wp-config etc. My setting seem to work, but i don't know if this setting can ...
2
votes
0answers
56 views

Does Wordpress contain “default” anti-SQL injection code that responds with a 404 error?

I've been through the “seven layers of the candy cane forest” on this one… :) Our plugin receives data via a POST request. On a particular site that has our plugin installed, we observed odd ...
2
votes
0answers
157 views

How to set up fail2ban with WordFence?

I found a blog post that talks about setting up Wordfence and fail2ban but it's quite useless as there is no mention of any technical activity. Only that it took the author a total of 5 hours. I ...
2
votes
0answers
418 views

How to escape custom css?

I'm creating a WordPress theme in which I've allowed users to add some custom css from the Theme Options. This css code then directly gets echoed out in the head section of the page, with the ...
2
votes
0answers
534 views

WordPress it's cleaning a custom query_var to avoid sql injections?

I am using get_query_var function to get a custom query_var. This query_var will be used later in to query arguments to retrieve posts with: $the_query = new WP_Query( $args ); . My question is, ...
2
votes
0answers
848 views

How to get WordPress to save upload file beyond web root

I am using nginx on a multisite install. I am trying to get WordPress to save uploads to a folder beyond the webroot : /home/mydomain/file_secure as opposed to ...
2
votes
0answers
382 views

comment_post_ID 0 (cannot remove from dashboard)

Ran across something a bit odd that I haven't seen before. A client has a pretty active blog and uses Akismet (paid) to protect against spam. At least once a day, they're reporting a spam comment that ...
1
vote
0answers
19 views

How do I authenticate WP users from a chrome extension?

I'm new to WordPress, and I need help. I am writing a chrome extension and intend to use wordpress as the user database. I intend that because I'm using a subscription management WP plugin that keeps ...
1
vote
0answers
13 views

Are there security risks in working directly in the themes folder that builds into a theme folder?

I'm wondering if there are any security risks in using the wp-content/themes/ folder as my project root and using wp-content/themes/my-theme as my build folder. Basically, in the themes folder I would ...
1
vote
0answers
31 views

Underscore Based Theme File Permissions in Git

I'm using underscores to develop my theme. For some reason git is saying that my file permissions are being changed from 10644 to 10744. I can override this in git's settings this but is it safe for ...
1
vote
0answers
232 views

How does the “authentication unique keys and salts” feature work?

I'm trying to find some information on how the authentication keys and salts work in WordPress, but unfortunately I wasn't able to find anything useful. All I got is that the keys should be random, ...
1
vote
0answers
185 views

Hide username discovery

How do I stop my usernames being leaked? To explain I tested my WordPress site on http://wprecon.com, and found that my admin username (that I have changed) was able to be discovered. User ...
1
vote
0answers
193 views

How do I get around “Sorry, this file type is not permitted for security reasons”?

I was wondering how I could allow .tiff files to be uploaded in my wordpress site. I get the message "Sorry this file type is not permitted for security reasons". This question has been asked in ...
1
vote
0answers
84 views

How to allow internal links using wp_kses filtration

I'm working on front end submission and of course I want to secure data by filtering before inserting to database. The form contains repeatable fields group data which I want filter by wp_kses ...
1
vote
0answers
45 views

Securing a multi-user permission structure

I'm currently working on a team that needs two distinct users from the same wpadmin group to be able to modify the wordpress files. Following the guide at Hardening WordPress (Codex), the following ...
1
vote
0answers
297 views

Renaming admin user on multisite install by MySQL

As part of a general tightening of security, I want to change the name of the admin user on my multisite install to something less commonly used. This user is admin on all five sites in the network ...
1
vote
0answers
276 views

Can I Remove xmlrpc.php completely?

My site is getting a lot of malicious traffic to domain.com/xmlrpc.php, to the point that the server is not being able to handle it. I tried to disable it via the wp-config.php, by adding this line: ...
1
vote
0answers
92 views

Are un-sanitized theme options more vulnerable to malicious scripts than the theme editor?

I'd like to put text areas in a theme options area to allow users to easily add analytics code, scripts, and css. Is it silly to worry about malicious code being inserted via un-sanitized theme ...
1
vote
0answers
66 views

Network Admin URL is shown to anyone before accessing a blog

I have a multisite setup and I noticed today that my security was not working properly. Each of my blogs has its own url : http://www.example1.com http://www.example2.com … My "main blog" is not ...
0
votes
0answers
9 views

Send media uploads to different directories

I am making a website for my local primary school, and I have each class page as a separate page template. Rather than have all their uploads go into the general /uploads/ folder I'd like to direct ...
0
votes
0answers
23 views

Sanitization Function in Wordpress (Example Twentyfifteen.1.4 Default WP Theme)

The ThemeForest Submission Requires some sanitization functions that should be incorporated in the theme - This page says this. The WordPress theme should make use of the following inbuilt ...
0
votes
0answers
22 views

About plugin security

I'm developping a couple of simple plugins for specific use, and want to do it right. I've read multiple pages about plugin security, including those. Now, considering that my plugins have for ...
0
votes
0answers
12 views

Logout via Subdomain, non-wordpress page on a different server?

Similar to the question over at Get wp_logout_url function to work on external (non-Wordpress) page The problem I am facing is the fact the subdomain is on a different server so I am unable to ...
0
votes
0answers
22 views

Upload file via settings page

Question: Is there a secure way to upload files via a plugin settings page? Context: Hello world! A feature of my plugin requires the user to upload one or more files. More precisely, JSON files ...
0
votes
0answers
15 views

Cross site domain cookies in Wordpress (v4.x)

I have a plugin that executes an external script (outside of Wordpress) that i'd like to make 'more secure'. I'd like to make this script only accessible/executable when logged in as the Wordpress ...
0
votes
0answers
19 views

Vanilla Wordpress install, what can/should I put in disable_functions?

I would like to take steps to limit the damage a compromised Wordpress install can cause on the rest of my system. What system calls does Wordpress need? What can I put in the disable_functions ...
0
votes
0answers
41 views

PHP Code Sniffer - WordPress VIP Coding Standards

I'm trying to fix up my code to meet the WordPress VIP Coding Standards. I'm getting a couple of issues that I'd like to see go away, but i'm not sure what the best strategy is. The first issue is ...
0
votes
0answers
17 views

Access passworded post with URL

I'm using Woocommerce to sell memberships which users must apply for and I've passworded them all to prevent unauthorized purchases. The best solution for me would be to have a link which 'unlocks' ...
0
votes
0answers
41 views

AJAX - nonce verification fails

I have a simple add-to-newsletter widge. I created a hidden input with nonce: $nlnonce = wp_create_nonce("add-newsletter"); echo '<input type="hidden" id="nlnonce" value="'.$nlnonce.'" />'; ...
0
votes
0answers
13 views

Download security

I would like to create a secure download link for digital content e.g. PDFs, Zips etc. There's a few plugins that offer "secure downloads" but they just block the download page. I need it so the ...
0
votes
0answers
30 views

Some crawlers/bots attempting to login with very good guesses. How?

I am trying to figure out if wordpress exposes the user e-mail or any other user information to crawlers/bots? I have a couple of security plugins that have been blocking these bots IPs on the third ...
0
votes
0answers
227 views

wp_verify_nonce fails always

I have created nonce fro my plugin and trying to verify it with another plugin pages. it fails always. both we are creating nonce with same parameter. why it fails. Plugin name : Wordfence it creates ...
0
votes
0answers
29 views

Server misconfiguration- Protect WordPress core files correctly from being called directly?

With a fresh WordPress 4.3 installation I have the following problem: If I call URLs like http://www.example.com/wp-admin/menu.php the script is executed directly. Is this a security issue which ...
0
votes
0answers
24 views

wordfence reports exploited files but nothing visible when I edit file on server

Wordfence is reporting exploit code on some of the empty idnex.php files asswell as wp-config.php but when I access these files via ssh I see no malicious code. Wordfence reports this malicious code ...
0
votes
0answers
30 views

Is wp_kses safe against XSS

Is this code safe against complex types of XSS attack? $v = wp_kses(esc_attr( $bad_input ), $allowed); where $allowed = array( 'a' => array( 'href' => array(), 'title' ...
0
votes
0answers
10 views

What is wp-admin/strebam_filter_register.php file?

I ran Sucuri Security integrity check for one of my wordpress websites which had been compromised by malware. I found two suspicious files: wp-admin/strebam_filter_register.php and ...
0
votes
0answers
22 views

WordPress and user security

When we talk about Information Security, many things come into mind and people tend to use CMS to be clear on security as CMS people do the job for you, in terms on hashing passwords, encryption etc. ...
0
votes
0answers
49 views

Force reauthentication/login for specific page for currently logged in users

I have a page that searches user information. The site is a record keeping site. I want it so that when people click the "View Records" link that they mus re-authenticate before proceeding. I'm not ...
0
votes
0answers
18 views

XSS Scripting in Cache files

On one of my client's sites I was going through a few of the pages ann noticed a popup appear with a spam advert on it. Finding this highly unusual I inspected the page source and found a bunch of ...
0
votes
0answers
18 views

Get an email from a potential customer via Wordpress email function - And get a response for that email which isn't me!

I got an email via wp_mail function - that looks like a response to a customer asking foe a telephone number (using the email wordpress@exmaple.com). What are the odds that there might be hackers on ...
0
votes
0answers
98 views

Best way to handle unregistered users as a unique idenitifier

I have a voting system for specific type of posts (site), similar to reddit, and I want to allow unregistered users to vote. In order to keep the voting count as valid as possible, I am thinking ...
0
votes
0answers
31 views

Output Encoding - Required or not for Security Reasons

I am using a very popular commercial theme and discovered, that they do no output encoding with esc_html/esc_attr/esc_url and so on on the "User Profil/Author" (when listing the authors on a ...
0
votes
0answers
339 views

Collecting Sensitive Data in Wordpress?

I am in need of creating an online application form that collected a users SSN number and am therefore concerned with security. Is this possible to do on WP with existing plugins? My research thus ...
0
votes
0answers
57 views

What is the best way to upload a temporary & sensitive file and then delete it when done

What is the best way to upload a temporary & sensitive file and then delete it when done. I'm writing a plugin (eventually for multisite) that allows users with a certain role to upload a .csv ...
0
votes
0answers
492 views

Why WordPress not logout after I have close my browser?

The default login cookie has expiry time as "session", so suppose when I close my browser, I need to login again when I visit wp-admin. But I've found that serveral time I've closed my browser (kill ...
0
votes
0answers
53 views

Background Updates Not Happening

I have some sites which are not updating with the background updater. I installed the Background Update Tester plugin and everything looks fine. Currently they are at 3.9 but they are telling me that ...
0
votes
0answers
35 views

Folder Permissions + Security Concerns

I messed up bad guys. I while working on another part of my website I accidentally nuked my WordPress folder permissions. I was able to find/fix some problems and I got my site up and running but some ...
0
votes
0answers
39 views

How to get WP to run plugin code triggered by an external site hook?

I have written a plugin to sync data from a WP blog to an external website. Changes to made to the external site also sync back to the WP blog. Right now the external website executes a POST request ...
0
votes
0answers
161 views

SWF in wordpress post

My question is somewhat a two part question. First I embedded a SWF file into my blog post using Easy Flash Embed plugin. It shows up on my desktop computer but when I view the post on my mobile ...
0
votes
0answers
185 views

wp-config.php file and code injection

It looks like several my sites on BlueHost got code injection in the wp-config.php file. Injected code itself looks like Any clue where it comes from? BH malware scan doesn't recognize that code so ...