The security tag has no wiki summary.
55
votes
12answers
6k views
Verifying that I have fully removed a WordPress hack?
My for-fun WordPress blog at http://fakeplasticrock.com (running WordPress 3.1.1) got hacked -- it was showing an <iframe> on every page like so:
<iframe ...
51
votes
7answers
12k views
Steps to Take to Hide the Fact a Site is Using WordPress?
I have a website for which we are trying to be discreet about the fact that we are using WordPress. What steps can we take to make it less obvious?
35
votes
8answers
7k views
Is moving wp-config outside the web root really beneficial?
One of the most common security best practices these days seems to be moving wp-config.php one directory higher than the vhost's document root. I've never really found a good explanation for that, but ...
24
votes
10answers
11k views
Can I rename the wp-admin folder?
Is it possible to rename the wp-admin folder?
I know I could just rename it, but unless it's supported by the code lots of things would break.
If I use a custom folder name, it will make it slightly ...
15
votes
2answers
3k views
Increase of failed login attempts, brute force attacks?
I Installed the plugin Simple Login Lockdown and since a couple of days ago the database is recording over 200 records by day.
I think that is not possible to have my site attacked by so many IP's
...
14
votes
13answers
1k views
What Are Security Best Practices for WordPress Plugins and Themes? [closed]
As suggested in this question, I am adding this topic as a new question, for community discussion/voting regarding best-practices for Plugin/Theme security.
Here is the starting checklist, based on ...
12
votes
2answers
4k views
How to Protect Uploads, if User is not Logged In?
I use wordpress for a private site where users upload files.
I use the "Private WordPress" to prevent access in to the site if the user is not logged in.
I would like to do the same to the files ...
12
votes
2answers
336 views
In Which Contexts are Plugins Responsible for Data Validation/Sanitization?
I want to make sure all of the data in my plugins/themes is handled securely before entering the database and before being output to the browser. My problem is that there are situations where the API ...
11
votes
3answers
311 views
What are the common security flaws I need to look for? [closed]
As a wannabe WP plugin developper, what are the main security flaws/holes I should look for?
I'm about to create a new plugin with a configuration panel (ie input fields and stuff). What should I be ...
9
votes
2answers
3k views
Getting a List of Currently Available Roles on a WordPress Site?
When writing WordPress plugins there is often a need to set up options for which roles on the site have access to certain functionality or content. To do this a plugin dev needs to fetch the list of ...
9
votes
2answers
159 views
How Can I Securely Implement a Password-less Login Feature?
Just posted a new plugin: No More Passwords
I currently have it tagged beta because logging into a platform is a sensitive issue and I don't want to release something that may have security holes. So ...
8
votes
4answers
625 views
What's the easiest way to stop WP from ever logging me out
After a certain amount of time WP logs out all users and forces them to log back in again. For development environments on my local machine this is obnoxious and absolutely unnecessary.
Is there an ...
8
votes
1answer
506 views
Worthwhile to restrict direct access of theme files?
I've run across the following snippet in themes from time to time:
if ( ! defined('ABSPATH')) exit('restricted access');
It's at the beginning of some (all?) PHP files in a theme and it's supposed ...
8
votes
1answer
545 views
wp_verify_nonce vs check_admin_referer
What is the difference, which one should I use?
I know that wp_verify_nonce checks the time limit, and check_admin_referer I think calls wp_verify_nonce as well as checking for an admin url segment, ...
7
votes
3answers
493 views
Will there be security updates for 3.1 once 3.2 is released?
I am currently running WordPress 3.1.2 on PHP 5.1.6. The minimum requirement for WordPress 3.2 is going to be PHP 5.2.4 or greater. If I keep running WordPress 3.1.2 and there is a security issue will ...
7
votes
2answers
411 views
Are Nonces Useless?
This is probably a noob question BUT hear me out - isn't the point of using Nonce to protect from things like scrappers (phpcurl scrappers etc.)? But my Nonce prints out in the head of the document ...
7
votes
2answers
1k views
Handling front-end file uploads, considering safety and ease of use
I'm looking to adapt an existing forum-like plugin which has no facility for attaching media.
The plugin works as a Custom Post Type, so it would be as "simple" as attaching an image to a post.
I am ...
6
votes
2answers
452 views
Should I escape wordpress functions like the_title, the_excerpt, the_content
I had look at the code but I couldnt see any escaping on funcions like the_title the_content the_excerptetc. I might not be reading it right. Do I need to escape these functions in theme development ...
6
votes
1answer
146 views
From a security standpoint, should bloginfo() or get_bloginfo() be escaped?
I've been reviewing a lot of information about WP theme and plugin security and understand the concept that you should escape attributes and HTML values in themes and plugins. I've seen bloginfo() and ...
6
votes
2answers
210 views
Securing Admin Accounts - Username Discovery
We've had Limit Login Attempts installed for some weeks now, and the number of brute force attempts occurring on wp-admin/wp-login is pretty amazing. At first the attempts were all with the username ...
6
votes
2answers
441 views
How can I lock down an old wordpress install I don't intend to update?
I am starting a new wordpress blog, and no longer updating an old one.
The old one still gets 400-500 hits a day, so I would like to keep it up for archival purposes, as people still link to its ...
6
votes
1answer
65 views
Is it safe to store a user setting you don't want the user to ever modify as a user option?
I have added some custom user options to the profile page on my site, and most are all OK for the user to modify themselves. These options live in their own section. The users have read access and ...
6
votes
1answer
296 views
How safe / sanitized is wp_insert_posts()?
Looking at the Codex for wp_insert_post() it states that this function "...sanitizes variables, does some checks, fills in missing variables like date/time, etc. " (EDIT: I updated the Codex entry to ...
5
votes
3answers
450 views
Filter any HTTP request URI?
I want to filter any HTTP request URI done through the HTTP API.
Use cases:
The WordPress update check goes to http://api.wordpress.org/core/version-check/1.6/, but ...
5
votes
3answers
724 views
Moving wp-config.php: Can this be done after site launch?
For additional security, the suggestion is made to move the wp-config.php up one level. Can this be done after the site has already been launched? Any potential issues in doing this? Are there an ...
5
votes
2answers
989 views
Prevent access or auto-delete readme.html, license.txt, wp-config-sample.php
Just a quick question that might help a tad bit with security. I noticed that the readme.html file has the version number listed. It reappears after each upgrade and so do the licence.txt, and ...
5
votes
4answers
1k views
Security and .htaccess
About a month ago I started a WordPress blog on a hosted server related to a hobby. So, I am new to this at present.
Since I'm concerned about security, one thing I did was to install the plugin WP ...
5
votes
3answers
549 views
WordPress Ajax Data Security
I am aware of nonces to check for intentions but can't make any sense if I can use them to restrict for database reads somehow? I mean, I am fetching records from the database using AJAX but I don't ...
5
votes
2answers
423 views
File and directory permissions
I installed latest WordPress 3.5 in my CentOS server. When I tried accessing http://example.com/wp-includes/, I received a listing of the directory: (Index of wp-includes).
I added the following code ...
5
votes
3answers
978 views
How to hide admin account in BuddyPress? (for security reasons)
I have been working with WordPress for the past 3-4 years, but I am new to BuddyPress.
I would like to hide the admin account completely from BuddyPress for security reasons. For example with a ...
5
votes
1answer
135 views
multi page password protection
Is it possible to have the "password protected page" feature of WordPress apply to more than one page? I have dozens of pages which I wish to protect with the same password, but I don't want people to ...
5
votes
2answers
951 views
How to store username and password to API in wordpress option DB?
I'm currently developing a plugin and the chances are that I will more than likely release it on the public plugin repository so others can use it.
The plugin will be using an API and to use this API ...
5
votes
1answer
221 views
Which KSES should be used and when?
The WP source shows that wp_filter_kses and wp_filter_post_kses are passed data that's "expected to be escaped with slashes."
On the other hand, wp_kses_data is passed data that's "expected to not be ...
4
votes
2answers
266 views
What is the ideal setup to address security concerns?
I'm aware of the requirements WP has for certain directories and files to be writable. I'm also aware that making permissions too loose can open security holes. Finally, I know that the user that ...
4
votes
2answers
197 views
What does a security risk in a plugin look like?
My server was hacked this weekend. By the Russians! Of the 50+ domains on my server, every single one had a hacked .htaccess file which was redirecting search results and a few other things to a ...
4
votes
2answers
452 views
How Attackers write script into my php files?
I have a blog created with wordpress, now i have a problem. Attackers writes javascript codes into my files.
Let's assume i have holes in my plugin scripts, but how can they write into php files?
...
4
votes
1answer
66 views
Should I remove install.php and install-helper.php?
Is keeping wp-admin/install.php and wp-admin/install-helper.php a security leak on the newer versions of wordpress? By default file permission on those files are 644.
If there is any leak, what kind ...
4
votes
3answers
103 views
Regular security checks - what steps should be included?
There are heaps of tutorials explaining how to secure a WordPress installation, but I couldn't find any that listed out steps for weekly or monthly security checks. What are some steps that you ...
4
votes
1answer
171 views
What is the most secure way to store post meta data in WP?
Sony's recent security "holes" showed how unsafe it can be to store data unencrypted. As some of you may know, I 'm working on re-releasing the free CRM theme Driftwood.
What is the most secure way ...
4
votes
1answer
1k views
Limiting sessions to one IP at a time
On a site with premium user account subscriptions, I'd like to be able to limit logins to one computer at a time. The most straightforward way to accomplish this would be to limit by IP, but I haven't ...
4
votes
1answer
385 views
What is the difference between esc_html and wp_filter_nohtml_kses?
What is the exact difference between esc_html and wp_filter_nohtml_kses. Everywhere I look says that both strip all the html, the only difference I can see is to do with exactly how they do this. Does ...
3
votes
5answers
423 views
3
votes
5answers
3k views
Is there a way to force ssl on certain pages
I want to force a secure connection on some of my pages (ones with forms), but I don't want the whole site to work with ssl (slows it down)
Is there a way to configure specific pages to require ssl?
3
votes
3answers
539 views
Secure WordPress paid plug-in
I want to create a WordPress plug-in but also want to ensure that the plugin can only be used after it has been activated with a serial key that should be unique for each domain.
What is the best way ...
3
votes
2answers
156 views
Brute force attack?
I'm seeing this quite often:
No OS, same Browser, weird hostname -- they're definitely not real users. Can I do anything to take precautions before they do something?
Thanks!
3
votes
2answers
620 views
Is there a security risk giving someone temporary access to my blog's code?
My blog is painfully slow for the last few days, and I would like to pay someone (anyone?) 15 BitCoins to optimize it for me (I would do it myself, but I'm not sure I have the time right now).
It's ...
3
votes
2answers
70 views
Any reason to be concerned by a wave of “zombie” blog signups?
I maintain a blog for a friend of mine. It's basically an aggregater of videos from other embeddable video sites, and provides a way for users to comment on those videos. Not really high-value ...
3
votes
2answers
46 views
Is it safe to assume that a nonce may be validated more than once?
From what I have gathered, once a nonce is generated it is valid for reuse for the next 48 hours.
Is it safe to code with this in mind? I'm writing a plugin that does a bit of toing and froing with ...
3
votes
1answer
138 views
When to use esc_url, esc_html, esc_attr, and friends?
Discovered esc_url today while customizing an _s theme. I understand what the function does (sanitizes the URL inside), but what I'm unsure of is the scope of its use.
It makes sense to me that if ...
3
votes
2answers
2k views
Can upload doc and pdf but not ppt - not permitted for security reasons
"Insert search engine here" was pretty useless for this one - I've had a look through wp-includes/functions.php, wp-admin/includes/file.php etc. but not found a reason for the behaviour I'm getting.
...
