Tag Info

New answers tagged

2

No need to reinvent the wheel - put your editor support back and tweak the settings: function wpse_199918_wp_editor_settings( $settings, $editor_id ) { if ( $editor_id === 'content' && get_current_screen()->post_type === 'custom_post_type' ) { $settings['tinymce'] = false; $settings['quicktags'] = false; ...


2

Which concerns me that wordpress may be trying to evaluate the querystring parameter name in some way that is exploitable. Why this particular possibility? If you look at the source-- and the error suggests as much--, what is happening is that WordPress code is attempting to urlencode the redirect_to query parameter, which it expects to be a string. ...


2

I think this is nothing to worry about. The redirect target is sanitized and validated a lot. To be honest I think I haven't seen any part of the WordPress code where so many checks happen for the most obscure attack vectors. Finally when you cast an array to a string Array is returned which is what you've seen. Arrays are always converted to the ...


1

The post password cookie is set with: setcookie( 'wp-postpass_' . COOKIEHASH, $hasher->HashPassword( wp_unslash( $_POST['post_password'] ) ), $expire, COOKIEPATH, COOKIE_DOMAIN, $secure ); in the wp-login.php file. We can then use the clear_auth_cookie hook, in the wp_clear_auth_cookie() function, to clear it on ...


0

I have completely blocked user enumeration from WPScan by adding the following in htaccess # Stop wordpress username enumeration vulnerability RewriteCond %{REQUEST_URI} ^/$ RewriteCond %{QUERY_STRING} ^/?author=([0-9]*) RewriteRule ^(.*)$ http://yourdomain.com [L,R=301] RewriteCond %{QUERY_STRING} author=d RewriteRule ^ /? [L,R=301] My professional ...


0

So many high voted answers.... time to set the record straight, it is virtually impossible and even if it is,life is probably too short to put an effort into it. The problem is not the obvious wp-* urls, the generator meta etc. The hard problems are with patterns that are associated with wordpress that an home grown system will not bother to implement like ...


1

If you have access to the PHPMyAdmin login and access: The wp_users table from the list of tables. Then locate your username under the user_login column and click edit. The user_pass is a long list of numbers and letters which is the MD5 hash encrypted version of your password. Select and delete the hash and type in your new password (it is case ...


1

There are several options/plugins to do that but nothing can provide you with 100% security. Following good practices, daily/weekly backups and using themes/plugins that follow good code practices will usually help you to stay away of troubles. But again nothing will give you 100% security. As for plugins you can try several that will give you a little peace ...


0

A man-in-the-middle can eavesdrop all the HTTP requests to a non-secure (HTTP) website, in plain text. But one of the things that you need to consider is, do a wp_login_form() alone vulnerable to brute force attacks? If it is, then you need to limit the number of login attempts and implement a secure CAPTCHA. For more info visit Brute Force Attacks.


3

It doesn't matter what function you use to generate the form markup, if you write the code by hand, or if it's in a modal or not. For it to be secure, you absolutely need an SSL certificate.


1

This is pretty straightforward. You can use phpMyAdmin or MySQL Workbench to change the prefix on all the tables at once, or you can do it one-at-a-time with a tool like SequelPro. If you need to run the SQL by hand, the syntax is… RENAME TABLE `old_name` TO `new_name`; Once all the table names are updated, you simply update the $table_prefix value in ...



Top 50 recent answers are included