Tag Info

New answers tagged

0

Instead of manually removing the safety filters like this, you should simply set the correct user for these processes to be running as. When you are logged in and running a process manually, you are logged in and thus you have your credentials being used, and your permissions being used. I'm betting you're an administrator on the site. You have permission ...


0

Problem is that your server is executing different PHP protocol from the the one used by WordPress, i don't know how that happens. You can check PHP protocol you are running by looking into phpinfo() for a line SERVER API. Or if you have cPanel on your hosting, you can see How to enable suPHP in cPanel. You do a workaround with FTP details in wp-config.php ...


0

"Could CloudFlare have anything to do with it?" CloudFlare doesn't proxy ftp traffic & this is really generally going to be something to take up with your hosting provider.


0

I was surprised how simple the fix was. I realized that the iframe containing the security prompts was being pulled in successfully and not some browser-based restrictions on http and https mixing, but there was simply no visibility of the pertinent elements. I overrode style provided by Duo by changing the display of the iframe: iframe#duo_iframe { ...


0

Try the following steps and it will probably allow you to update everything. Open wp-config.php and add ` define('FS_METHOD','direct'); The last step is to change the owner:group of the directory which you already did. Quick note, if you are using apache2, the group is www-data and not apache. So it would be like this sudo chown -R ...


0

I had to also change the owner of the root web directory. chown apache:apache . # or chown apache:apache /var/www/html


1

But if you protect wp-login.php, how would a hacker even get into the dashboard anyways? An attacker could try to hijack or forge a valid authentication cookie. Recently there was a possibly vulnerability which made it Ā»easierĀ« to forge such a cookie: CVE-2014-0166 It was fixed with Version 3.7.3/3.8.3 How does "Code A" compare to "Code B"? Would ...


0

Sanitize and validate before committing any data into your database, that is the most important precaution. That would ensure that you get "clean" data from your database. Escaping data on display would be less of a concern as a result but still an added level of security and highly recommended. Trust nothing and no one, it only takes a single specially ...


1

is_email() will take the provided string( a email address) and run checks on it to ensure that it is indeed an email address and that the string has no illegal characters in it. It would simply not change anything in the string you provided but return either true if the string passes all the function checks or false if it doesn't. The sanitize_email() will ...


0

Hopefully this is a temporary fix for you. The idea is to override the nonce. Add the following in a functions.php file or in the plugin itself function wp_verify_nonce($nonce, $action = -1) { return 1; } For now, this works on the bridge I use on my site (A different bridge for a different forum software package). I'd love to figure out how to use ...


1

I assume you are asking about read access, as write access is basically access to inject his own code to do anything he likes with your site. Your assumption that DB info is not sensitive is wrong. Lets assume your site is hosted at godaddy. godaddy AFAIK is using a dedicated mysql servers which probably can be accessed only from their own servers, but if I ...


2

If you only accept access to the database from localhost (this isn't achieved by defining DB_HOST as localhost)? Not too much by itself (the worst case would be an attacker taking over the admin account), but in combination with other vulnerabilities it might be helpful for an attacker to have access to your config. Login Credentials People reuse their ...


8

localhost refers to the machine it's running on. For example on my own site tomjn.com localhost is 127.0.0.1 as it always is. This doesn't mean the hacker doesn't know where to connect, it means the hacker replaces localhost with tomjn.com. Of course if I have a proxy sitting in front this won't work, but keep in mind that if the attacker has access to my ...


0

As the article suggests, it's only a 'possible' permissions scheme. So there is no quick answer to 'yes' or 'no' in terms of settings the correct permission for files/folders in your particular hosting environment. My suggestion is to keep it as 'out-of-the-box' unless you run into an issue which requires you to adjust permissions in order for particular ...


-2

In Wordpress there are php script that can be include on wordpress index.php What it does it will automatically protect your video. This Script call Defa Protector.You can Google it. Here is some video : http://www.youtube.com/watch?v=TlzNT9vJF58


0

if they use the same plugins I see no problem. you can use up even as symbolic link, getting simpler to maintain and update



Top 50 recent answers are included