The security tag has no wiki summary.
0
votes
2answers
76 views
File permissions for wp-minify plugin
I am worried on installing Wp-Minify plugin. But it needs 777 permission for the cache directory located inside wp-uploads directory. Isn't it a security issue?
-2
votes
2answers
80 views
Is there a secure way for the public to submit images, videos, and documents using WordPress?
I want the public to submit images, photo simulations, models, video, animation, illustrated narration, papers and other publications and multimedia. images - 30" x 42" 300 dpi . pdf format file size. ...
1
vote
1answer
28 views
correct tags for validating input types
I have following types of theme options inputs, which I need to validate.
$numbers = "#1234";
$email = "abc@example.com";
$simeple_text = "How's going?";
$code = "<script ...
1
vote
1answer
111 views
Which of WordPress's .php files need to be directly accessible via HTTP?
I'm trying to tighten up security on my WordPress installation, and one of the things that seems like it might be a good idea is preventing all of the internal-use .php files from being accessed ...
0
votes
1answer
35 views
How to protect wp-admin through .htaccess?
I'd like to protect the /wp-admin/ directory at the server level. This means two logins. One through the server and another through WordPress.
I believe this can be handled through .htaccess. Does ...
0
votes
1answer
47 views
Trying to understand nature of hacking
Today we saw suddenly two files created in root folder in one of our wordpress websites - file name owp.php and gmail.html
On investigating the access logs following entries were found which seem to ...
0
votes
1answer
49 views
If I use an alternative login (e.g. CAS or other SSO) plugin, is my site protected from the recent brute force login attempts?
I've been hearing about the recent increase in brute-force WordPress login attempts due to a massive botnet attack. Everything I've read so far indicates that the attack works by just trying different ...
0
votes
1answer
53 views
Data Validation, dynamically generated fields (select for example)
Working to secure my plugin, I'm not sure what (if anything) to do about output such as dynamically generated select fields. For example, I have a country code select generated on the backend via PHP ...
0
votes
1answer
72 views
Basic File/Post restriction plugin
I am looking for a plugin that allows me to restrict access for a individual post/page to a specific role or individual. It also needs to restrict files attached to that post. I have tried several ...
-1
votes
1answer
98 views
Default installation permissions for wp-config.php
Recently I've noticed that many of the wordpress installations we have on our servers where being attacked and ifected by this thing
...
2
votes
0answers
222 views
comment_post_ID 0 (cannot remove from dashboard)
Ran across something a bit odd that I haven't seen before. A client has a pretty active blog and uses Akismet (paid) to protect against spam. At least once a day, they're reporting a spam comment that ...
1
vote
0answers
63 views
How can I secure a WordPress blog using OpenID from a single provider?
We're about to launch an internal blog for the company I work at. Much of the blog will be available to the public, but certain posts will be for employees only.
Our intranet/extranet has an OpenID ...
1
vote
0answers
55 views
Disallow file edit not preventing plugin install
I have a little demo site (admin details are listed publicly), and I've configured the wp-config to disallow file edits, so in theory no one can install a theme / plugin.
...
1
vote
0answers
59 views
using rewrites to secure login page
I'm trying to be sneaky with iis to secure a wordpress login page (not my choice to run a windows server, but that's the reality of things). It's worked so far, only the login page itself loads itself ...
1
vote
0answers
45 views
Are un-sanitized theme options more vulnerable to malicious scripts than the theme editor?
I'd like to put text areas in a theme options area to allow users to easily add analytics code, scripts, and css.
Is it silly to worry about malicious code being inserted via un-sanitized theme ...
1
vote
0answers
46 views
Network Admin URL is shown to anyone before accessing a blog
I have a multisite setup and I noticed today that my security was not working properly.
Each of my blogs has its own url :
http://www.example1.com
http://www.example2.com
…
My "main blog" is not ...
0
votes
0answers
18 views
Core files changed - site hacked?
Got a WordFence alert last night for one of our WordPress sites, saying that some WordPress core files had been changed:
WordPress core file modified: wp-content/plugins/akismet/admin.php
WordPress ...
0
votes
0answers
24 views
Is [admin / admin] acceptable for all local websites?
Are there security issues with using the same credentials [admin / admin] for all client websites on a working, local server ?
0
votes
0answers
11 views
Security permissions on controls added under Page Option
I am a total wordpress n00b, and am having issues understanding how the page security is applied.
I have a page where I want to secure the content, so, in the page editor, I have ticked certain ...
0
votes
0answers
20 views
Page missing: tiger-m@te
I recently took a site live, installed WP Better Security, and noticed immediately that this site was facing a lot of hacking attempts.
About a day later I realized that one of the pages refuses to ...
0
votes
0answers
79 views
Prevent PHP execution via htaccess but disables thesis theme?
So I'm trying to secure my wordpress site because it's been infected multiple times with malware. One of the suggested steps is to basically prevent php execution in the wp-content directory via ...
0
votes
0answers
41 views
Insecure content loading on a secured site, how to force https?
I have a seemingly odd issue where when logged in as an admin on a site I can load all content and assets just fine. When I logout to view the site entirely as a user would see it, the html content ...
