Tag Info

Hot answers tagged

8

localhost refers to the machine it's running on. For example on my own site tomjn.com localhost is 127.0.0.1 as it always is. This doesn't mean the hacker doesn't know where to connect, it means the hacker replaces localhost with tomjn.com. Of course if I have a proxy sitting in front this won't work, but keep in mind that if the attacker has access to my ...


3

To disable WordPress Cron Jobs, place this in wp-config.php: define('DISABLE_WP_CRON', true); To schedule a cron job in Linux with cPanel for example... This is the command you might run: wget -q -O - http://www.your-domain.org/wp-cron.php?doing_wp_cron >/dev/null 2>&1 The end of the above command just suppresses any output. Just pick the ...


3

You don't. The get_option() function is a WordPress function. You cannot use it without loading WordPress. More to the point, you should not be calling a file in your plugin directly. You should make your form or whatever is directly linking to that file link to a normal WordPress endpoint instead, and have additional parameters in your plugin to load that ...


3

Thanks @kaiser but not need to go through your solution I found a easy one and I'll share here for newbie likes me. If you're working on a WP Network site then the steps are: At the top, hover over My Sites and then click Network Admin. At the left, hover over Settings and then click Network Settings. Scroll to the bottom of the page and change the Max ...


3

Yes, it appears so. In my experience the best thing to do is re-upload a fresh WordPress core to ensure that all traces have been squashed. It happens... If you aren't already using security plugins I'd recommend Wordfence and BruteProtect to help keep brute force attacks out as well as checking your core WordPress files for changes.


3

I would be careful doing this, because you are assuming all your database modifications will only happen within the admin backend, but that might not always be the case. The wp-cron comes to mind, but there are also some plugins that use front-end writes. So you might get nasty sync problems with your two databases, using this method. There are many things ...


2

Yes, you can set the WPMU_PLUGIN_DIR constant in the config file of each of the sites (and WPMU_PLUGIN_URL for the url). By default it is defined as: WP_CONTENT_DIR . '/mu-plugins'


2

try to use get_temp_dir() to see if wordpress is using your WP_TEMP_DIR constant. i've tried this code in wp-config.php and it works define('WP_TEMP_DIR', dirname(__FILE__) . '/wp-content/temp/'); but you have to put it before the /* That's all, stop editing! Happy blogging. */ in your wp-config.php file.


2

Modify your installation such that your custom Farsi language files are associated with a non-standard WPLANG value. For example, instead of the standard 'fa_IR', maybe try something non-standard like 'farsi_IR' (or even 'myCustomFarsi_IR'). This way, when new WordPress versions are released for the "official" Farsi version, you will no longer get ...


2

You can apply the language_attributes filter to language_attributes() function (source). Basically you can do this by adding something like this to your functions.php: add_filter('language_attributes', 'custom_lang_attr'); function custom_lang_attr() { return 'lang="en-US"'; } Note: Keep in mind, that you're overwriting the language parameter; the ...


2

The best way is to not do that. There's no need for a plugin file to ever include the wp-config.php. You're doing it backwards. WordPress loads plugins. Plugins don't load WordPress.


2

If you only accept access to the database from localhost (this isn't achieved by defining DB_HOST as localhost)? Not too much by itself (the worst case would be an attacker taking over the admin account), but in combination with other vulnerabilities it might be helpful for an attacker to have access to your config. Login Credentials People reuse their ...


2

Consider everything that comes with a vanilla WordPress installation a core file. Core files will be overwritten on updates, so it's not safe to edit them. E.g. wp-config.php isn't a core file, because the vanilla installation comes only with the sample version of that file.


1

The official reply is that ABSPATH is more for backward compatibility with code which was written when plugins were including wp-config.php and overriding WP_CONTENT_DIR should be enough. https://core.trac.wordpress.org/ticket/29626#comment:3 https://core.trac.wordpress.org/ticket/26592#comment:8


1

I assume you are asking about read access, as write access is basically access to inject his own code to do anything he likes with your site. Your assumption that DB info is not sensitive is wrong. Lets assume your site is hosted at godaddy. godaddy AFAIK is using a dedicated mysql servers which probably can be accessed only from their own servers, but if I ...


1

In WordPress error reporting is primarily controlled by WP_DEBUG and other related constants in wp-config.php file. Typically they are completely independent of theme and plugins, although some (well coded) extensions adjust their behavior accordingly with debug settings.


1

That message means that the php engine tried and failed to find a directory to which to temporarily store the uploaded file until l they are process by php scripts. Since it is happening before any script is being run it is very unlikely that you will be able to solve this by writing any php code. You might be able to change the php upload_tmp_dir setting ...


1

You'll want to add these to your wp-config.php file: define( 'NOBLOGREDIRECT', '' ); define( 'WP_HOME', 'http://dev.domain.com' ); define( 'WP_SITEURL', 'http://dev.domain.com' ); So in its entirety, you'll have: $base = '/'; /** Multisite / Wordpress Network **/ define( 'WP_HOME', 'http://dev.domain.com' ); define( 'WP_SITEURL', ...


1

So in the old days when WordPress updated you got the whole shebang and deleting Akismet after every time was deadly boring. Things had slightly improved since then (partially driven by minimizing traffic it takes to serve update to everyone), but process also got more complicated. Now there are multiple versions of update archive that core might receive ...


1

Silly me, I posted this before doing a proper investigation. The issue isn't with WordPress, it was instead with how Polylang (translation plugin) handled the site url. The solution was to put define('PLL_CACHE_HOME_URL', false); in the wp-config.php before I changed the URL using the WP constants.


1

There's a filter named 'upload_size_limit' where you should be able to change the value. Just add a small mu-plugin for that job: <?php /** Plugin Name: (WPSE) #177620 Alter Upload Size Limit */ add_filter( 'upload_size_limit', function( $limit = 0, $u_bytes = 0, $p_bytes = 0 ) { return ( in_array( get_current_screen()->base, array( /* Add ...


1

Try to create a symbolic link within wp-content for each site: ln -s /root/mu-plugins mu-plugins


1

I had the same problem and solved it by moving the two define statements up before the require_once that includes wp-settings.php. Seems this was the issue all along. Source: http://stackoverflow.com/a/27193576/117268


1

This is just, how I understood the idea of the WordPress File API. If it is wrong, please downvote :) Okay. If you upload a file, this file has an owner. If you upload your file with FTP, you login and the file will be owned by the FTP user. Since you have the credentials, you can alter these files through FTP. The owner can usually execute, delete, alter ...


1

It's too early to use this WP built-in function. You can use it in some plugin or theme files, but not when WP enviroment is still loading. As I am not really sure if your intention is really correct, you have to use some other way (with PHP native functions) to distinct between front-end and administration. For example something like this: if( ...



Only top voted, non community-wiki answers of a minimum length are eligible