New answers tagged

0

For those which have multilingual site, function function wp_roles_array() { $editable_roles = get_editable_roles(); foreach ($editable_roles as $role => $details) { $sub['role'] = esc_attr($role); $sub['name'] = translate_user_role($details['name']); $roles[] = $sub; } return $roles; } returns localized array ...


1

Are you running your site on cPanel? If so, explore your control panel and you'll see a few great modules. hotlink protection leech protection Under Advanced tab, look for indexes. Once you click you can customize and "hide non public" resources very easily.


3

Whether or not you lock down a staging site really depends on how much you mind the public accidentally seeing a site that's a "work in progress". I'd usually consider it more of a branding decision than a security decision. (This of course wouldn't apply if you're in the middle of developing a secure application that might be buggy, but Wordpress theming - ...


3

You can use wpdb insert function. It's better in every way. It can care about data's escapeing itself and it's shorter. You can use your own query anyway but I would recommended this article for reading https://codex.wordpress.org/Data_Validation#Database


1

If you want to rename the wp-admin with the aim of adding additional layer of security to your WordPress installation, you can also try the Roots / Bedrock WordPress Boilerplate. It can help isolate the web root to limit access to non-web files. It can also help in organizing/securing the whole WordPress core by putting it in its own subdirectory like ...


0

I'd recommend setting up an API, and also ensuring the sites are HTTPS (have an SSL certificate) to encrypt communication between the servers. If you don't have one already, there are free certifiers such as https://letsencrypt.org/


-1

Great question. A couple of things: First, best practices tell us to always keep these types of assets outside of our Web server’s document root. PHP isn't limited by the same restrictions as a Web server, from a permissions perspective, so you can make a directory on the same level as your document root and place all of your sensitive data and code ...


2

If I understood correctly the situation described in the question and its comments, the user has capabilities to upload files and to edit your post type, so you shouldn't be fitering capabilities, the user already has the correct capabilities. The problem is that wp_editor() use the global $post by default, and in your context the global $post is for the ...


0

If you want to allow user to upload files. edit_post is wrong cap to check. Instead you will need to add cap upload_files to users and check against it. If you want to allow only images you may custom filer the allowed MIME type. See more at https://codex.wordpress.org/Roles_and_Capabilities#upload_files


-1

Only so much security can be added at the php layer. To gain even more security, modify the .htaccess file, disabling directory browsing, disabling XML-RPC, and deny access to WP-specific files. <files .htaccess> Order allow,deny Deny from all </files> <files readme.html> Order allow,deny Deny ...


0

If you have checked your database entry of the page/article, you will see that it is a issue on Database side, or by any means there was restoring going on because of the crash, that could be an issue or a restoring plugin/script with a bug why a simple character as ' gets messed up. And could you tell in how many cases the character ' got replaced by ...


0

If using it on your own server, I wouldnt recommend using a WP plugin as a base, try to configure fail2ban ( a brief tutorial - https://easyengine.io/tutorials/nginx/fail2ban/ ) , it will work like a charm.


0

I wanted to state, this happened to me a few times in the early WP 3.x days. Am using GoDaddy shared hsoting etc. My solution, i compiled my own HTaccess file(if ur using Apache) against RFI / LFI / SQL injects etc, just very basic ones, disabling the use of base64, bogus image hacks, finger printing and so on. Then you need to check your CHMOD aka ...



Top 50 recent answers are included