Tag Info

Hot answers tagged

3

Yes, it appears so. In my experience the best thing to do is re-upload a fresh WordPress core to ensure that all traces have been squashed. It happens... If you aren't already using security plugins I'd recommend Wordfence and BruteProtect to help keep brute force attacks out as well as checking your core WordPress files for changes.


1

Use wp_redirect() function instead of header(). Here is the code example: wp_redirect($redirect); Codex: https://codex.wordpress.org/Function_Reference/wp_redirect


1

Let's go and see what would core do. In default-filters.php here is what content output passes through: add_filter( 'the_content', 'wptexturize' ); add_filter( 'the_content', 'convert_smilies' ); add_filter( 'the_content', 'convert_chars' ); add_filter( 'the_content', 'wpautop' ); add_filter( 'the_content', 'shortcode_unautop' ); ...


1

This is just, how I understood the idea of the WordPress File API. If it is wrong, please downvote :) Okay. If you upload a file, this file has an owner. If you upload your file with FTP, you login and the file will be owned by the FTP user. Since you have the credentials, you can alter these files through FTP. The owner can usually execute, delete, alter ...


1

This isn’t a question of quantity. You have to understand what each plugin does to say if it is necessary. Let’s say we have three "security" plugins: One enforces strong passwords. One block aggressive log-in attempts. One sends you an email when your PHP version is behind the latest security release. Havin these three plugin running in parallel is ...


1

If you are printing the URL out, say to the front end... that is, it is to be displayed as a normal URL to a visitor etc. then: esc_url() If you are going to use the URL in, say, a WordPress redirect (or anything else that sends http header 'location', then you will need: esc_url_raw() This is actually the basis and fix of this recent security ...


1

One surprisingly useful solution to foil most spam-bots is to use a honeypot. Put an extra entry field into your comment forms, and then hide it with css. Normal users won't fill it in because they won't ever even see it. Based on that, you can safely assume that anytime an entry is made with that field filled, that it's a bot and you can just discard/mark ...



Only top voted, non community-wiki answers of a minimum length are eligible