Tag Info

New answers tagged

0

This type of attack done mostly using javascript via forms like comment form , textarea. It just replace your site index.php with bad code. Do not worry all other pages should be fine there. Kindly do following first : 1 - Change wp login ...


2

Brute force attacks seem to the be most common vulnerability on WP installs Brute force attacks are not WordPress vulnerability. They are password vulnerability, if bad passwords are used. They are common, but if they are "the most common" in occurrences and, more importantly, breaches is questionable. rate limiting ought to be relatively easy to ...


0

Well that depends on how you define secure. I assume your embed code is an iframe which means that you are putting something not under your control (that could in theory always change into something malicious) into your site. This isn't 100% secure itself. That is why esc_html strips that out. The question you have to ask yourself is how much of a risk ...


2

First, both of these things (updates and sane file permissions) are neither "OR" choice or optional. That is what you just do, because if you don't sooner or later (even if significantly later) you are going to have problems because of it. Relatively I would say updates are more important, because faulty file permissions tend to harm when in already ...


1

I know this is an old question, but it's worth adding contemporary information. There's a security announcement list provided for free by a company called WordFence. They send out relevant information on insecure extensions. Head to their website, and you'll see a signup field (currently it's at the bottom of their site). That company also makes a plugin ...


0

You don't say if is a multisite installation or two separate stand-alone ones. I'm going to suppose it isn't multisite because if so, the answer is trivial. In the other case, there isn't any problem. You have to configure ssl as usual in your apache vhost or nginx for each domain with your wilcard certificate. Aditionally, you can use the Wordpress HTTPS ...


0

Setting up MultiSite in one main domain, that you have SSL, and then use the other domain as custom sunrise domain settings. You have to setup the .htaccess or vhost(for NGiNX) though. But both site will need to have almost same type domain or plugin. Its one way. Other will be a bit complex one. I would setup two separate WordPress in two separate ...


0

To enable the Network Setup menu item, you must first define multisite in the wp-config.php file. Open up wp-config.php and add this line above where it says /* That's all, stop editing! Happy blogging. */. If it doesn't say that anywhere, then add the line somewhere above the first line that begins with require or include: /* Multisite */ define( ...


1

What I would do is this: Since wp_hash_password() is a "pluggable" function, create a simple plugin or MU-Plugin and define a function called wp_hash_password() in that plugin/mu-plugin. Wordpress will use your function instead of the core function. Just copy the original code into your plugin/mu-plugin and change the one relevant line.


1

I think your paradigm is not optimal. You are starting on premise of "WordPress Ajax endpoint is slow" and your solution is to "build alternate authentication scheme". This completely spells trouble. Anything security should be reused as much as possible and coded by people specializing in security. Trade-off of reimplementing security for the sake of ...


0

Thank you all for your answers! I can not hide and rename wp-admin, because I have a shop and there must login to registered customers. Hidden address easily know if the visitor is registered. This method is good for sites that do not use visitor registration. It seems to me that if the hacker knew that the page no authorization administrator, he would not ...


0

Login pages are not made of wood and continuous attacks do not weaken them. The whole point of having strong passwords is that however many attacks are performed against the user the probability of successful guess in your lifetime is zero. Best way to protect your user accounts are by having strong password. If you believe strong passwords are not ...



Top 50 recent answers are included