Questions tagged [security]
Strengthening themes, plugins and core installation to prevent intrusion.
904
questions
1
vote
3answers
118 views
Using “wordpress_logged_in” to restrict direct access to uploads folder in 2021
I am looking at ways to restrict direct access to the Wordpress Uploads folder. I've read a handful of Stackoverflow and blog posts about using "wordpress_logged_in" in .htaccess to check if ...
0
votes
0answers
17 views
What are the best practices to achieve cross-domain interoperability and transparency in aggregate data through a uniform, hashed user naming schema?
The following plugin was just presented at the special session on data provenance to amend NSA's hard problems during the Hot Topics on Science of Security (HoTSoS) symposium.
I'm looking for peer ...
0
votes
0answers
9 views
how check user roles with most security
hello everyone i want to check user roles for my custom theme .
users according to their roles have different accessibility to site .
i check their roles with this code ,I'm worried I did something ...
0
votes
0answers
20 views
HTML Elements in my WP Plugin being generated in JS. Security and Translated Text Question about this method being used
So unfortunately when developing my WP plugin I created some methods that will help me generate HTML elements and their attributes with document.createElement.
One example function is provided below. (...
1
vote
1answer
26 views
Should I disable directory listing for wp-includes?
This is more of a personal question for my own curiosity.
One of my websites appears to be vulnerable because the directory listing (/wp-includes) is enabled. It’s not difficult to fix, however I’m ...
3
votes
3answers
201 views
Does WordPress sanitize arguments to WP_Query?
This is a very straight-forward question, but it's important and I can't find anything definitive in the docs.
This question asks a similar question for the 's' parameter, specifically. I want to know ...
0
votes
1answer
22 views
How to protect a script execution on Wordpress?
Recently I have created a script to update records on my Wordpress database. I basically use wpdb to connect to another database, grap some records, and update the Wordpress database. Using only ...
1
vote
1answer
89 views
Should you escape hardcoded URLs?
I'm writing a very simple social share plugin for a client. I'm using these two functions to display the share buttons at the bottom of each post:
<?php
/**
* Social buttons
*/
function ...
2
votes
1answer
37 views
Sanitizing comments or escaping comment_text()
I'm creating a template for comments on my WordPress site. I noticed that a simple <script>alert(1);</script> slips through the default WP codex implementation of comments, using the ...
0
votes
1answer
26 views
How to add API security keys into JS of wordpress securely
I am using wp_localize_script() to add variables from my config.ini file to my inline JS code (inside HTML block element of Elementor) [Please see this for reference]
But this method is unsafe to add ...
0
votes
0answers
19 views
HSTS header not being added correctly
I've added the following code to my child theme's functions.php in order to add a HSTS header to my website:
function tg_enable_strict_transport_security_hsts_header_wordpress() {
header( 'Strict-...
0
votes
0answers
111 views
WP SiteHealth check reports “The REST API encountered an unexpected result”. Where to setup SSL *client* cert for *internal* WP use?
I'm running WP 5.7 on Linux. It's an Nginx server.
I'm setting up an internal site with policy that requires all services using SSL client cert verification enabled.
The WP host listener has ssl ...
0
votes
1answer
16 views
Input sanitation
I have a question regarding a wordpress site I have recently developed for a client. I have only until now developed a site for small clients that just require personal websites, however this client ...
0
votes
1answer
110 views
Is it Ok to restrict Access-Control-Allow-Origin for /wp-json requests?
I've been tasked with managing a WordPress site that was developed and configured by some other team. During a basic security scan, I've realized that the following end-point https://www.mywordpress....
1
vote
1answer
19 views
How to prevent XSS alter custom global javascript object & methods in Wordpress
Im working on a project in Wordpress that enqueues multiple .js files where each file adds
a new method to a global javascript object, this in order to make the desired methods available only if ...
0
votes
1answer
41 views
Is it unsafe to put php in the /wp-content/uploads directory?
Pretty straight forward question, but I'll provide any clarifications needed.
The reason I'm asking is this: I created a child theme that pulls in a custom-functions.php file. This allows devs to ...
0
votes
0answers
7 views
Is it possible to limit access to login/forget password by countries?
I know we can limit people accessing the wordpress by countries but is it possible to limit access on wp-login.php and forgetpassword links? I see a lot of script trying to access wp-login.php or any ...
0
votes
1answer
23 views
Vulnerability Concern From the Plugin or From Not Updating the Plugin?
Our company website has over 40 plugins. That is a lot...way too many. However, each plugin serves a purpose.
When updating all plugins to the recent version we noticed parts of the website break. ...
0
votes
0answers
16 views
How and why use validate_username and how to secure inputs fields of registration form?
I would use validate_username to protect username and other inputs from tags, octet, and others filters and conditions from sanitize_user but these functions only remove these dangerous chars and does ...
1
vote
1answer
100 views
.htaccess rules for blocking bots with an extra condition
I have a WP multisite installed. I am integrated with Ezoic and Cloudflare. I had implemented firewall rules. However, I have an issue blocking bots that have X-Middleton in the User-Agent, because my ...
0
votes
1answer
21 views
sanitize_post() is not sanitizing Post Object
I wanted to sanitize a WP_Query post object without using foreach.
I used this method:
$args = array(
// ...
)
$data = array();
$the_query = new WP_Query($args);
$data["post"] = $the_query-...
0
votes
0answers
6 views
Adjusting Prevent Concurrent Logins plugin to refresh the pages of older sessions
Is it possible to adjust the "Prevent Concurrent Logins" plugin to refresh "old sessions" browsers right after the "new sessions" logs in?
The plugin works currently fine ...
0
votes
0answers
21 views
Blacklisting jwt after logout in wordpress
I need to blacklist jwt after logout. Does anyone implemented it in in wordpress and could share his approach?
What I’ve thought of is storing blacklisted user jwt in user meta (value and expiration ...
0
votes
1answer
83 views
wp_nonce vs jwt
I’ve recently added jwt authentication to my website because frontend of my site is completely decoupled from backend.
What I haven’t thought of is that I could use wp_nonce instead of jwt - create ...
0
votes
1answer
143 views
Why does check_ajax_referer give a 403 error on https websites?
When I write an ajax funtion on a site without SSL, check_ajax_referer works as intended.
But it fails with a 403 forbidden error on a https site. I've tried a lot of times, but I just don't know why ...
1
vote
0answers
25 views
How to block plugin activations with no known user or coming from unknown IP address range?
I have received a Sucuri alert for an unauthorized plugin activation:
Event: Plugin Activated Website: http://www.XXXXXX.XXX IP Address: XXX.XXX.XXX.XXX Reverse IP: XXXXXX.XXXXXX.XXXX Date/Time: 7 ...
1
vote
1answer
25 views
Nonce failing on form submission
I'm updating some code in one of my WordPress plugins by adding a nonce to improve security. The plugin that has a form that generates some output that the user can copy and paste as a shortcode. At ...
1
vote
1answer
37 views
Wordpress SQL Injections through User Agent
Currently Wordpress seems to be scoring bad on SQL Injection through User Agent. The testing tools that are being used return that it's insecure because it returns HTTP responses (errors) when you ...
0
votes
0answers
17 views
Disabling PHP exec/shell type functions - is this reasonable/best practice for a web hosting provider / does it break known plugins?
This question is nominally similar to Vanilla Wordpress install, what can/should I put in disable_functions? - a possible key difference is that I'm looking at it as someone that provides Wordpress ...
0
votes
1answer
44 views
WordPress disable direct access of files in WordPress installation path
I want to add a security feature to my WordPress website to stop direct access to files added to the root of WordPress installation, recently I discovered that a malicious plugin added some files to ...
2
votes
0answers
113 views
Nonces, AJAX, script variables & security in WordPress
Alright, so let's say you develop a website where you enqueue a js script on a page X of your frontend, using:
wp_enqueue_script(
'script_handle',
PATH_TO_SCRIPT,
array(),
'1.0.0',
true
);
...
1
vote
1answer
23 views
I want to disable login of admin (/wp-admin) with email and make it accessible only with username
I want to do it as a security precaution. I've already taken other actions. But I want to be able to login only with my admin username. Is there a way to do that or even a plugin?
0
votes
0answers
19 views
how secure wordpress comment form in a custom theme?
How is it possible to secure comment form in Wordpress against XSS attack?
recently we made a custom theme for our wordpress website and I used this code for the comments section as follows.
The main ...
0
votes
0answers
15 views
Suhosin After all, should it be used? Or it's obsolete
In PHP 5 versions, I used suhosin.
Currently, this add-on has not been updated since 2016. Is it obsolete? Is it important for the server ... And for CMS wordpress, joomla, drupral?
Should it be used ...
0
votes
0answers
10 views
new plugin idea - shortcode security
i am not a coder so i can't make a plugin. recently i was searching tutorials/plugins for a feature so that i can restrict the use of shortcode but i found nothing. so i think it will be good idea to ...
0
votes
0answers
21 views
Is any code executed in disabled plugins?
I was wondering how much of a problem disabled plugins can be, in terms of security. I found another related question here, but the answers don't provide any details.
What I'd like to know is if any ...
0
votes
1answer
21 views
SQL queries to another wordpress site
I have 2 wordpress sites on the same hosting and the same host/user/ password for the database
I have on the other hand 2 different database and 2 different prefixes
I need, during an action on site1, ...
0
votes
1answer
18 views
Strict Folder and File Permissions for WordPress Themes Folder
My client is working with a third party security team that insists on having WordPress theme folder I created set to 644 for folders and 444 on files. Is this even possible with WordPress?
0
votes
0answers
17 views
How to secure many Wordpress Sites?
I was wondering what the best way is to secure many wordpress sites. Assuming i have a server with 100 Domains and each Domain has a single Wordpress site to it. What would be the best way to protect ...
0
votes
1answer
73 views
Insert NULL value using prepare()
I have similars queries
/* Query */
global $wpdb;
$tablename = $wpdb->prefix . 'data';
$sql = $wpdb->prepare(
"
UPDATE $tablename
SET
`date` = %s,
WHERE
id= %...
0
votes
1answer
104 views
malware undetectable by multiple scans
I would like to inform and request help from the community.
What happens is this malware was in the folder / wp-content / uploads / 2020 /
Named index.php
And I found him in the year 2017 in the ...
0
votes
1answer
21 views
How to make WP page accessile only to specific user roles
I am creating a website that consists of a "Home Page" (public) that has a login link to the WP login page, then, there will be different pages that are only accessible to specific logged ...
0
votes
0answers
12 views
Disable superadmin login from not-main domain?
I'm looking for a setting to stop that a superadmin can login on any other domains in a multi-user Wordpress than the main-domain. I can do it with iptables or nftabels but i would prefer a more ...
0
votes
2answers
47 views
Checking a WordPress for OWASP top 10 vulnerabilities [closed]
I have just made a WordPress plugin and I would like to scan it for OWASP Top 10 vulnerabilities, any resources on how to get started here?
Thanks
0
votes
0answers
16 views
Restricting access to settings or files
Currently on WordPress administrators have access to the following resources. This is limited by get_userdata( get_current_user_id() ).
'wp-login.php', 'wp-register.php', 'index.php', 'update-core....
0
votes
0answers
172 views
How to prevent my external API call from being called by anyone but me (my site)
My site sends different data to an external API under different circumstances. Luckily, most of it happens on form submissions, but there are a few instances where I need to make an API call from the ...
0
votes
0answers
9 views
Malicious code on a WP site [duplicate]
So the other day I received a message from Google Search Console alerting that one of the websites I host contain malicious code, and I did manage to find numerous encrypted code lines in several ...
0
votes
2answers
20 views
Is it safe to use the basic administration with reduced rights for private member space
I know it´s not clearly a technical question, I did not find on the Web (maybe my location makes the job harder).
I have to develop a private member space.
It´s easier for me to use the wordpress ...
0
votes
0answers
19 views
Is it secure to copy a database from a hacked server?
Is it secure to copy the database and uploads directory from an old hacked server to a new server or may they be infected? I'm not sure what was the attack type but it will save much time if it's ...
1
vote
1answer
26 views
Check for security updates
Is there any option to check all my plugins, core and themes on a website for security issues?
Example:
For the Wordpress core I can check my current Version: get_bloginfo( 'version' ),
for updates: ...
