New answers tagged

0

Loading almost any (if not all) WordPress files directly will give nothing more than a white screen of death if you have your error reporting set properly. This is because it will trigger a fatal PHP error stopping the execution, and the correct public settings for error display is to not show them. However, if you are trying to mask that you are using ...


5

Does it need it? Probably not (other than this edge case, props @bravokeyl). Should you add it? In my opinion, yes: From a coding/architecture POV, you're declaring "this file needs WordPress". Any direct hit to one of your theme's files (curious users, bots, "script kiddies" etc.) has the potential to leak a little bit of info (most likely filesystem) and/...


2

No, functions.php would generate PHP fatals if loaded directly as it uses the WordPress API. If functions.php tried to bootstrap and load WordPress however, then yes, it would be necessary, but if you've done that then something has gone horribly wrong and you need to start from scratch


2

Most of the times there is no need to check for defined( 'ABSPATH' ) in the child theme.


0

There is very little difference, security wise, between using a code that was developed somewhere else, or give a direct FTP access. Unless you are going to audit the code (which is unlikely) any developer can take control of your site, and maybe more, from the code and no FTP access is needed for that. In real life, people that install a plugin which they (...


0

Yes. It is entirely possible. Ideally, you have good backups of your site and you have hired a developer that you trust, and you have not finalized payment until the work is completed and tested. Assuming you are not able to fully trust this developer, have them send you the completed theme for you to install. You do not need to provide FTP access with ...


0

WordPress stores all the theme packages under the wp-content/themes folder. If your developer needs to work on his theme, you can simply allow him to access the specific theme folder inside the wp-content/themes folder. If you are afraid that the site may fail due to his changes, you can switch to another theme in the meantime from WP appearance options. ...


1

You don't want to be messing around with that. Look at the following hook: https://codex.wordpress.org/Plugin_API/Action_Reference/wp_login You should do something like: function check_test_user() { // Your code here } add_action('wp_login', 'check_test_user'); The hook will run as part of the Login process and saves you modifying core Wordpress files.


1

After upvoting @pieter's answer.... In recent time I came to the realization that it is much better to handle "bad" data gracefully when it is used (usually it means escaping, but also validation) than at input time. Data corruption can happen not only because of some rouge process "shitting" over your data, but also when the enviroment has changed and the ...


1

Never leave anything to chance, always sanitize, escape and validate all data coming from forms and super globals like $_GET and $_POST according to your requirements and the data type you are expecting. It is always good to set your code up in a way so that should your validation fail, you do not unnecessarily run scripts and functions. Have some kind of ...


1

Using remove_action() can be remove unnecessary links for example: remove_action('wp_head', 'rsd_link'); //removes EditURI/RSD (Really Simple Discovery) link. remove_action('wp_head', 'wlwmanifest_link'); //removes wlwmanifest (Windows Live Writer) link. remove_action('wp_head', 'wp_generator'); //removes meta name generator. remove_action('wp_head', '...


1

I had some problem with Mod_Security, login , Rest API (mobile app access), ... You can change roles of Mod_Security


0

This can also happen if WordPress is hosted behind a reverse proxy that provides SSL. Paste the following in your theme's functions.php: define('FORCE_SSL_ADMIN', true); // a comma-separated list e.g. http,https if (strpos($_SERVER['HTTP_X_FORWARDED_PROTO'], 'https') !== false) $_SERVER['HTTPS']='on';


1

PHP files in the wp-includes directory should not be accessible from the outside, they should only be included by wordpress code. Therefor an easy fix to this is to use .htaccess rules to block access to *.php files that are under the wp-includes directory


0

Running forms through the_content filter should be fine.



Top 50 recent answers are included