Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

3
votes
0answers
305 views

Disallow file edit not preventing plugin install

I have a little demo site (admin details are listed publicly), and I've configured the wp-config.php to disallow file edits, so in theory no one can install a theme / plugin. define( ...
2
votes
0answers
561 views

How to get WordPress to save upload file beyond web root

I am using nginx on a multisite install. I am trying to get WordPress to save uploads to a folder beyond the webroot : /home/mydomain/file_secure as opposed to ...
2
votes
0answers
352 views

comment_post_ID 0 (cannot remove from dashboard)

Ran across something a bit odd that I haven't seen before. A client has a pretty active blog and uses Akismet (paid) to protect against spam. At least once a day, they're reporting a spam comment that ...
1
vote
0answers
18 views

What is the purpose of having a token in cookies?

WordPress utilizes cookies for better security, and I've been trying to understand how exactly this could make a WordPress website more secure, and I found this article . There's a pretty decent ...
1
vote
0answers
39 views

How does the “authentication unique keys and salts” feature work?

I'm trying to find some information on how the authentication keys and salts work in WordPress, but unfortunately I wasn't able to find anything useful. All I got is that the keys should be random, ...
1
vote
0answers
116 views

How do I get around “Sorry, this file type is not permitted for security reasons”?

I was wondering how I could allow .tiff files to be uploaded in my wordpress site. I get the message "Sorry this file type is not permitted for security reasons". This question has been asked in ...
1
vote
0answers
67 views

How to allow internal links using wp_kses filtration

I'm working on front end submission and of course I want to secure data by filtering before inserting to database. The form contains repeatable fields group data which I want filter by wp_kses ...
1
vote
0answers
190 views

How to escape custom css?

I'm creating a WordPress theme in which I've allowed users to add some custom css from the Theme Options. This css code then directly gets echoed out in the head section of the page, with the ...
1
vote
0answers
44 views

Securing a multi-user permission structure

I'm currently working on a team that needs two distinct users from the same wpadmin group to be able to modify the wordpress files. Following the guide at Hardening WordPress (Codex), the following ...
1
vote
0answers
221 views

Renaming admin user on multisite install by MySQL

As part of a general tightening of security, I want to change the name of the admin user on my multisite install to something less commonly used. This user is admin on all five sites in the network ...
1
vote
0answers
222 views

Can I Remove xmlrpc.php completely?

My site is getting a lot of malicious traffic to domain.com/xmlrpc.php, to the point that the server is not being able to handle it. I tried to disable it via the wp-config.php, by adding this line: ...
1
vote
0answers
86 views

Are un-sanitized theme options more vulnerable to malicious scripts than the theme editor?

I'd like to put text areas in a theme options area to allow users to easily add analytics code, scripts, and css. Is it silly to worry about malicious code being inserted via un-sanitized theme ...
1
vote
0answers
65 views

Network Admin URL is shown to anyone before accessing a blog

I have a multisite setup and I noticed today that my security was not working properly. Each of my blogs has its own url : http://www.example1.com http://www.example2.com … My "main blog" is not ...
0
votes
0answers
15 views

How to set up fail2ban with WordFence?

I found a blog post that talks about setting up Wordfence and fail2ban but it's quite useless as there is no mention of any technical activity. Only that it took the author a total of 5 hours. I ...
0
votes
0answers
8 views

XSS Scripting in Cache files

On one of my client's sites I was going through a few of the pages ann noticed a popup appear with a spam advert on it. Finding this highly unusual I inspected the page source and found a bunch of ...
0
votes
0answers
13 views

Get an email from a potential customer via Wordpress email function - And get a response for that email which isn't me!

I got an email via wp_mail function - that looks like a response to a customer asking foe a telephone number (using the email wordpress@exmaple.com). What are the odds that there might be hackers on ...
0
votes
0answers
36 views

Best way to handle unregistered users as a unique idenitifier

I have a voting system for specific type of posts (site), similar to reddit, and I want to allow unregistered users to vote. In order to keep the voting count as valid as possible, I am thinking ...
0
votes
0answers
21 views

Output Encoding - Required or not for Security Reasons

I am using a very popular commercial theme and discovered, that they do no output encoding with esc_html/esc_attr/esc_url and so on on the "User Profil/Author" (when listing the authors on a ...
0
votes
0answers
31 views

esc_url within iFrame

I'm building a WordPress theme. To improve security, I'm escaping any URLs, like so: <?php $background = wp_get_attachment_image_src(get_post_thumbnail_id($post->ID), '' ); ?> <div ...
0
votes
0answers
33 views

Hide username discovery

How do I stop my usernames being leaked? To explain I tested my WordPress site on http://wprecon.com, and found that my admin username (that I have changed) was able to be discovered. User ...
0
votes
0answers
47 views

Post meta sanitization and escaping

I'm writing a plugin that adds a text meta box where user enters (supposedly) media URL, which then is displayed in posts with $featured_media = get_post_meta( $post_id, '_meta_key', true ); echo ...
0
votes
0answers
98 views

Collecting Sensitive Data in Wordpress?

I am in need of creating an online application form that collected a users SSN number and am therefore concerned with security. Is this possible to do on WP with existing plugins? My research thus ...
0
votes
0answers
66 views

Getting the current page post_id in function hooked to wp_ajax?

I have created a kind of a social network where when a user registration happens, I create a post (custom post type follower) for each user and assign its post_id to the user ( ...
0
votes
0answers
29 views

Security Plugin Blocks Access to theme folder?

I'm using some jquery to do an ajax request within my theme and it's spitting out a file 404 error even though the file exists. I"m guessing it has something to do with the security plugin. here's ...
0
votes
0answers
9 views

Security of using uploaded file across two admin submits

I'm writing a plugin that merges two files, based on user input about which file to draw each section from. This means that I have to get the user upload and display it before I can get the user input ...
0
votes
0answers
24 views

Is it good practice to use WordPress nonce values to restrict page access?

I'm working with a colleague on a WordPress plugin. Part of the plugin functionality is showing dynamic lists with links which allow you to open a new page. Depending on the user's role, they may or ...
0
votes
0answers
38 views

What is the best way to upload a temporary & sensitive file and then delete it when done

What is the best way to upload a temporary & sensitive file and then delete it when done. I'm writing a plugin (eventually for multisite) that allows users with a certain role to upload a .csv ...
0
votes
0answers
188 views

Why WordPress not logout after I have close my browser?

The default login cookie has expiry time as "session", so suppose when I close my browser, I need to login again when I visit wp-admin. But I've found that serveral time I've closed my browser (kill ...
0
votes
0answers
22 views

How would I have to change rewrite rules to use a custom ms-files.php

I've previously wondered about securing file access by non-logged in users who know the full URL in multisite. When ms-files was still used modifications to this file allowed a basic form of WP-run ...
0
votes
0answers
32 views

Storing Facebook page token in the options table

I developed on few wordpress sites, the ability to publish a post or page to facebook with custom values. I am on the process of turning my code into a plugin but I want to make it the good way. I ...
0
votes
0answers
391 views

Change Login URL Without Plugin

I want to change the login url of my Wordpress install away from /wp-admin.php I am aiming to do so and am looking at changing the .htaccess file to add in: RewriteRule ^login$ ...
0
votes
0answers
38 views

Remove user credentials from GET or POST on login

This may be a totally noob question but... I noticed that, with the standard Wordpress install, it seems like one can obtain the user's login credentials just by viewing the GET and/or POST vars ...
0
votes
0answers
49 views

Background Updates Not Happening

I have some sites which are not updating with the background updater. I installed the Background Update Tester plugin and everything looks fine. Currently they are at 3.9 but they are telling me that ...
0
votes
0answers
31 views

Folder Permissions + Security Concerns

I messed up bad guys. I while working on another part of my website I accidentally nuked my WordPress folder permissions. I was able to find/fix some problems and I got my site up and running but some ...
0
votes
0answers
31 views

How to get WP to run plugin code triggered by an external site hook?

I have written a plugin to sync data from a WP blog to an external website. Changes to made to the external site also sync back to the WP blog. Right now the external website executes a POST request ...
0
votes
0answers
283 views

WordPress it's cleaning a custom query_var to avoid sql injections?

I am using get_query_var function to get a custom query_var. This query_var will be used later in to query arguments to retrieve posts with: $the_query = new WP_Query( $args ); . My question is, ...
0
votes
0answers
139 views

SWF in wordpress post

My question is somewhat a two part question. First I embedded a SWF file into my blog post using Easy Flash Embed plugin. It shows up on my desktop computer but when I view the post on my mobile ...
0
votes
0answers
157 views

wp-config.php file and code injection

It looks like several my sites on BlueHost got code injection in the wp-config.php file. Injected code itself looks like Any clue where it comes from? BH malware scan doesn't recognize that code so ...
0
votes
0answers
394 views

Can I make an ajax response cross-domain?

I am trying to make a single ajax response cross-domain. Is that possible? I tried something like this, but that did not work: function my_call_callback() { header("Access-Control-Allow-Origin: ...
0
votes
0answers
84 views

Wordpress exploited theme is causing high io load on server

I used a Wordpress theme for a while that was causing high IO-load on my server. That was because there was some kind of exploits made/available for the theme: ...
0
votes
0answers
132 views

Why are xmlrpc.php and wp-cron.php being called so often?

I'm running a Wordpress website and I have found from the server logs that xmlrpc.php and wp-cron.php are being requested (POST requests, of course) very frequently--including some suspicious ips that ...
0
votes
0answers
334 views

Nonces and Cache

It's clear that form submissions and AJAX requests, especially sensible ones, need "nonces" to avoid certain exploits. However, with heavy use of caching systems it becomes harder to generate them ...
0
votes
0answers
265 views

Malware/Permission bug removal?

I'm facing a hell of a problem on a client's WP theme. Whenever I try to 'Activate' it, it gives me the following errors on a blank page: Warning: ...
0
votes
0answers
53 views

Allowing access to certain Wordpress created pages or posts with htaccess / htpasswd

Trying to figure out how to give access to a certain page, lets say http://mypage.com/page and not letting people access the main index via http://mypage.com. Or just simply disallow access to ...
0
votes
0answers
61 views

checking the form submit in right order

With help from experts on this site, I have been able to put together a plugin that allows to choose and submit categories from the front-end. Further, in order to make it a bit more secure I have ...
0
votes
0answers
104 views

Form That Submits Content Securely

I have built a WP site for a client. One of the pages has a form which my client's customers will use to submit material to my client, and one of the required fields is a file upload. My client ...
0
votes
0answers
40 views

False URL for shopping cart

OK. Re wording my question I have a digital product on a wordpress site Using a shopping cart I'm charging .99 cents for people to look at a video (going to charity) The cart directs them to a page ...
0
votes
0answers
35 views

Malware installation during plugin update?

I update my wordpress blog daily (current version: WordPress 3.5.2). Today I installed an update of "Search everything". After that, my webspace was infected by malware. Interestingly, my blog is ...
0
votes
0answers
529 views

Core files changed - site hacked?

Got a WordFence alert last night for one of our WordPress sites, saying that some WordPress core files had been changed: WordPress core file modified: wp-content/plugins/akismet/admin.php WordPress ...
0
votes
0answers
28 views

Is [admin / admin] acceptable for all local websites?

Are there security issues with using the same credentials [admin / admin] for all client websites on a working, local server ?