Tag Info

Hot answers tagged

7

localhost refers to the machine it's running on. For example on my own site tomjn.com localhost is 127.0.0.1 as it always is. This doesn't mean the hacker doesn't know where to connect, it means the hacker replaces localhost with tomjn.com. Of course if I have a proxy sitting in front this won't work, but keep in mind that if the attacker has access to my ...


4

You can do this by adding some code to wp-config.php $request_uri = $_SERVER['REQUEST_URI']; $debug_dirs = array ('/debug-dir1/','/debug-dir2/'); // list of directories to turn on debugging foreach ($debug_dirs as $debug_dir) { if (!strncmp($request_uri,$debug_dir,strlen($debug_dir))) { define('WP_DEBUG', true); } } define('WP_DEBUG', ...


3

This is how i set my content directory in wp-config.php // ======================== // Custom Content Directory // ======================== define( 'WP_CONTENT_DIR', dirname( __FILE__ ) . '/somedir' ); define( 'WP_CONTENT_URL', 'http://' . $_SERVER['HTTP_HOST'] . '/somedir' );


3

To disable WordPress Cron Jobs, place this in wp-config.php: define('DISABLE_WP_CRON', true); To schedule a cron job in Linux with cPanel for example... This is the command you might run: wget -q -O - http://www.your-domain.org/wp-cron.php?doing_wp_cron >/dev/null 2>&1 The end of the above command just suppresses any output. Just pick the ...


3

You don't. The get_option() function is a WordPress function. You cannot use it without loading WordPress. More to the point, you should not be calling a file in your plugin directly. You should make your form or whatever is directly linking to that file link to a normal WordPress endpoint instead, and have additional parameters in your plugin to load that ...


2

The best way is to not do that. There's no need for a plugin file to ever include the wp-config.php. You're doing it backwards. WordPress loads plugins. Plugins don't load WordPress.


2

Consider everything that comes with a vanilla WordPress installation a core file. Core files will be overwritten on updates, so it's not safe to edit them. E.g. wp-config.php isn't a core file, because the vanilla installation comes only with the sample version of that file.


2

If you only accept access to the database from localhost (this isn't achieved by defining DB_HOST as localhost)? Not too much by itself (the worst case would be an attacker taking over the admin account), but in combination with other vulnerabilities it might be helpful for an attacker to have access to your config. Login Credentials People reuse their ...


2

Modify your installation such that your custom Farsi language files are associated with a non-standard WPLANG value. For example, instead of the standard 'fa_IR', maybe try something non-standard like 'farsi_IR' (or even 'myCustomFarsi_IR'). This way, when new WordPress versions are released for the "official" Farsi version, you will no longer get ...


2

Is it possible to give drop-ins in their own subdirectory of wp-content instead? No, it is not possible without editing the core WordPress code.


2

While I cannot speak to your specific white-screen issue, registered theme directories must be within the Apache document root, at minimum. Many files in themes, such as CSS, JS, images, etc, are served directly by the webserver, not via calls to WordPress. So having a theme directory that is not directly accessible and serve-able by the webserver process ...


2

Is it possible to set different WP_CONTENT_URL values for different sub-sites in wp-config.php ? Ans: Yes it is. If sub sites are installed on sub-domain, An example to define it this way - define( 'CURRENT_SITE_DOMAIN', $_SERVER['HTTP_HOST'] ); if( 'sub1.domain.com' == CURRENT_SITE_DOMAIN ){ define( 'WP_CONTENT_URL', ...


1

I would consider it somewhat safe since that's where your database connection information is also stored. One could easily ruin your website by deleting your whole database if they had access to that file. There are a couple of things you can do to increase security: Move the wp-config file one level outside the root. Wordpress knows to look for the file ...


1

Try memory_limit = 128M in php.ini. Your syntax may be wrong. You can run a function called phpinfo to see what kind of memory allocation you really have. Make a plain text file and call it phpinfo.php and put just this line in it: <?php phpinfo(); ?> then put the file in the root of your server, and then go to that file with your web browser, ...


1

My advice is to not do long running bulk-operations over a web-connection in the first place. PHP works just fine from the command line. Write your one-time script to do whatever it is that you need it to do. If you need access to WordPress functions in that process, then include the wp-load.php file at the top of the script. Then, go to a shell prompt on ...


1

First, rename the folder wp-content/plugins/wordpress-https to wp-content/plugins/wordpress-https-OFF so that WordPress can't find it to run it. Second, add the following lines to your wp-config.php file, replacing the domain name with your domain name: define( 'WP_SITEURL', 'http://example.com/' ); define( 'WP_HOME', 'http://example.com/' );


1

You can move the wp-config file one level up. You can also create a .htaccess file and upload it to your uploads folder with this code: <Files ~ ".*..*"> Order Allow,Deny Deny from all </Files> <FilesMatch ".(jpg|jpeg|jpe|gif|png)$"> Order Deny,Allow Allow from all </FilesMatch> Or install a plugin for security which also scans ...


1

Try changing your script to this since you're not actually running a cross-browser request: <script> (function($) { $(document).ready(function() { var refreshId = setInterval(function() { $('#content').fadeOut("fast").load('/new.php').fadeIn("fast"); $("#content .span9 article").unwrap(); }, 10000); }); })(jQuery); ...


1

WordPress loads jQuery in NoConflict mode. Do not use $. Use jQuery or one of the other solutions in the Codex, like this one: (function($) { // Inside of this function, $() will work as an alias for jQuery() // and other libraries also using $ will not be accessible under this shortcut })(jQuery); Nothing will work until you sort that out.


1

(s)FTP into your site, or use a file manager provided by your host, and undo what you did. Then, if you were editing PHP with the built in editor as I suspect, don't ever do that again-- ever. It is like working on an airplane while it is in the air. Create a local copy of your site and work locally. Upload to the host when you know the code works. If you ...


1

It is indeed a security issue to have those left as the defaults, but it is not an extremely serious issue. To mitigate the problem of known default salts, WordPress intentionally recognizes when those values are left as "put your unique phrase here" and will not use that phrase as a key/salt. Instead, it generates random 64 character salts internally and ...


1

There is a section that should look like this: defined( 'ABSPATH' ) || define( 'ABSPATH', __DIR__ . '/' ); require_once( ABSPATH . 'wp-settings.php' ); add_filter() is available after that, you are probably using it too early.


1

For security issues, Hostgator requires more parameters - like port, etc. - in wp-config.php to connect to a remote - non-localhost - mysql server. Read http://support.hostgator.com/articles/cpanel/how-to-connect-to-the-mysql-database-remotely


1

In WordPress error reporting is primarily controlled by WP_DEBUG and other related constants in wp-config.php file. Typically they are completely independent of theme and plugins, although some (well coded) extensions adjust their behavior accordingly with debug settings.


1

update the fields in general settings in wp-admin. I think it will solve your issue. please make sure that you will not give any static path for any image


1

You can apply the language_attributes filter to language_attributes() function (source). Basically you can do this by adding something like this to your functions.php: add_filter('language_attributes', 'custom_lang_attr'); function custom_lang_attr() { return 'lang="en-US"'; } Note: Keep in mind, that you're overwriting the language parameter; the ...


1

I assume you are asking about read access, as write access is basically access to inject his own code to do anything he likes with your site. Your assumption that DB info is not sensitive is wrong. Lets assume your site is hosted at godaddy. godaddy AFAIK is using a dedicated mysql servers which probably can be accessed only from their own servers, but if I ...


1

The official reply is that ABSPATH is more for backward compatibility with code which was written when plugins were including wp-config.php and overriding WP_CONTENT_DIR should be enough. https://core.trac.wordpress.org/ticket/29626#comment:3 https://core.trac.wordpress.org/ticket/26592#comment:8



Only top voted, non community-wiki answers of a minimum length are eligible