Tag Info

New answers tagged

1

This is just, how I understood the idea of the WordPress File API. If it is wrong, please downvote :) Okay. If you upload a file, this file has an owner. If you upload your file with FTP, you login and the file will be owned by the FTP user. Since you have the credentials, you can alter these files through FTP. The owner can usually execute, delete, alter ...


1

Let's go and see what would core do. In default-filters.php here is what content output passes through: add_filter( 'the_content', 'wptexturize' ); add_filter( 'the_content', 'convert_smilies' ); add_filter( 'the_content', 'convert_chars' ); add_filter( 'the_content', 'wpautop' ); add_filter( 'the_content', 'shortcode_unautop' ); ...


1

Use wp_redirect() function instead of header(). Here is the code example: wp_redirect($redirect); Codex: https://codex.wordpress.org/Function_Reference/wp_redirect


0

Probably a plugin conflict. Rename your plugin folder to disable all plugins and see if the problem still persists. If the proplem is gone reactivate the plugins one by one to see which one is causing the problem.


3

Yes, it appears so. In my experience the best thing to do is re-upload a fresh WordPress core to ensure that all traces have been squashed. It happens... If you aren't already using security plugins I'd recommend Wordfence and BruteProtect to help keep brute force attacks out as well as checking your core WordPress files for changes.


0

I've had this problem because I host a few Wordpress sites on a few servers. Apache should own everything because Wordpress creates folders and files as it runs. If you want the user to make changes to Wordpress files then add the user to the group apache and change the permissions to 775.


0

I'm currently working on a plugin to do this on a large scale, since I have multiple sites that I want to sync; but I don't mind sharing the info with you. I understood [from what you said] that the user's credentials have already been verified on site2 - so there's no need to use any of those functions to verify them again. All you need to do now is create ...


0

Placing the htaccess file in the wp-admin directory did not work for me so I went a different route and it seems to be working very well. Below is what I have in my main htaccess file: <files wp-login.php> # set up rule order order deny,allow # default deny deny from all allow from x.x.x.x allow from y.y.y.y allow from z.z.z.z </files> ...


0

Remove the website URL field Remove any comment form allowed tags Configure discussion settings so all comments must be approved by admin Disable anyone can register setting Add a captcha to your comment form as a last resort I think they are looking for forms which include the words email, website and comments so if you remove all those words you should ...


1

One surprisingly useful solution to foil most spam-bots is to use a honeypot. Put an extra entry field into your comment forms, and then hide it with css. Normal users won't fill it in because they won't ever even see it. Based on that, you can safely assume that anytime an entry is made with that field filled, that it's a bot and you can just discard/mark ...


-1

The Simple Security Firewall has 100% catch rate on automated spambots without analysing the contents of the spam or any IP addresses etc. It doesn't need to. Plugin: https://wordpress.org/plugins/wp-simple-firewall/ Enable the Comments Filter feature, and then turn on the spambot anti-spam. Within that section, you can set it to outright reject the spam ...


1

If you are printing the URL out, say to the front end... that is, it is to be displayed as a normal URL to a visitor etc. then: esc_url() If you are going to use the URL in, say, a WordPress redirect (or anything else that sends http header 'location', then you will need: esc_url_raw() This is actually the basis and fix of this recent security ...



Top 50 recent answers are included