Questions tagged [security]
Strengthening themes, plugins and core installation to prevent intrusion.
0
votes
0answers
8 views
Security in Wordpress, better to edit pre_gets_post or protect single pages?
I am making a website where user must register and when they are logged in they must complete the profile informations with other infos before they can access the content.
I wrote this function
...
0
votes
1answer
22 views
Wordpress Security tools
Hi fellow wordpress developers or Web Masters. I would like to ask what are the tools you are using to secure your wordpress websites? Also, what are you ways to prevent wordpress plugin vulnerability ...
0
votes
1answer
111 views
Spam Registrations
Since the past 3 days, I am seeing that every day a new user registers to my WordPress site. The default role is admin and it's very concerning. Their email ids are workspace@kleverandeverbever.top ...
0
votes
0answers
14 views
Only allow user to download files from wp-content/uploads/ subdirectory that matches their user ID
I have this function which puts files in a /uploads/ subdirectory based on their user ID (for example, user with ID 23 uploads image.jpeg, it ends up here: /wp-content/uploads/23/image.jpeg ) and it ...
0
votes
1answer
35 views
Does WordPress (or a plugin) reveal login credentials to admin?
I just tried to login to an old WordPress site of mine. I forgot that I already sold the website. I tried logging in, using my login credentials, but obviously I wasn't able to login. Now my question ...
0
votes
1answer
13 views
Securing a plugin pop-up window
I have a plugin that opens a pop-up window and displays it's content in there, not using any of the default wordpress theme/style etc.
My question is, what is the best way of securing access to this ...
0
votes
1answer
20 views
Access WP files on “server 1”, from “server 2” - using wp-load on an external website
My setup consists of a "members area" which is set aside from my Wordpress install. This members area is written in PHP.
Until now, ive been using the following code in a PHP file to pull in the WP ...
0
votes
1answer
21 views
How safe is current_user_can()?
I'm saving sensitive data via JSON ajax request, it is not sanitized, literally anything can be passed.
I need to make sure that only admins with edit_options permission can save it.
So I do:
...
0
votes
1answer
22 views
Advice on redirect to lock site from unauthorized users
Looking for some advice on the below function. I have a web app type site built in WP. There is nothing on the site relevant to non-users, apart from the login form on the homepage. I've got some ...
0
votes
1answer
13 views
Scan multiple websites for malware that are in same webhost root?
I have a bunch of WordPress sites that I host with the same hosting company. I manage them with the same account so they sit in the same root directory.
I noticed that one of my sites was infected ...
0
votes
0answers
17 views
WordPress and Azure Directory
We have a WordPress website that is synced with our Azure company directory.
This allows users to access this WordPress website with their Email and password SSO (single sign on).
Instead of users ...
0
votes
1answer
20 views
Iterating users while user iteration is suppressed
Recently I noticed various login attempts being blocked by security plug-in this is pretty much ordinary when the attempt is about non-existent users or default/common user names like the website name,...
0
votes
0answers
18 views
Links to root domain from search engines don't work, but direct links and links from other referrers do
I've got a really odd situation with a wordpress website I manage - when I directly type the domain into my browser, the site comes up just fine - similarly, when I click a link to my site from ...
0
votes
1answer
18 views
Does meta-data need to be sanitized?
Is it necessary to escape data when storing it in the user's meta-data? I'm not sure if WP does this automatically, or if it is even necessary. Also, if it is necessary, should I use ...
-1
votes
3answers
36 views
Block any other domains from using my server
Seems someone has set their domain to use my server. It's not a mirror, the database and everything works and updates with mine. He's basically stealing my content, and he's showing up on google ...
0
votes
0answers
61 views
Robots.txt file not updating
One of our website robots.txt file is not getting updated,deleted .htaccess and robots.txt file from root folder from one of the suggested answers
Why does Google Webmaster Tools say my whole site is ...
0
votes
2answers
37 views
Security concerns with external links
In this article I read, that using <a href="" target="blank"> is related to some security issues. They recommend rel=noopener.
How do I implement this in my WP-Installation? Which file is the ...
0
votes
1answer
33 views
Why am I sometimes getting a 404 error when I try to update a page with Elementor?
When updating a page with Elementor, we're occasionally receiving a 404 error.
Most of the time we can update the page just fine, but when we try to add a <script> tag or a button with a custom ...
0
votes
1answer
40 views
Are SVG image files safe to upload? Why WP defines them as a security risk? [duplicate]
I'd like to upload a map of the USA in a SVG format however I am prevented from doing so because of a 'security risk'.
Any ideas why this is? Is it safe to do so?
Thanks
0
votes
1answer
21 views
Running multiple security plugins
Is it a bad idea to run more than one plugin that offers simialar seciruty features.
I'm planning to use wordfence for security and jetpack for backups. But i see jetpack offers security features as ...
0
votes
1answer
15 views
My wordpress site has “https://” on it but when I go to Dashboard and click visit site, it removes the “https://”
We have an internal website that is accessible only if you have an office 365 employee logins. It's hosted on bluehost and we have activated the https feature of it. Our site is running on WordPress ...
0
votes
1answer
40 views
Handling nonces for actions from guests to logged-in users
Imagine the following scenario:
John has an account on my website, but is currently not logged in.
He clicks the "upvote" button on an article, but is redirected to the login page because only logged-...
7
votes
4answers
669 views
Why escape if the_content isnt?
The built in function the_content runs through several filters, but does not escape output. It would be difficult for it to do so, as HTML and even some scripts must be allowed through.
When ...
1
vote
1answer
53 views
Is echo get_the_term_list and get_field in a template file considered safe?
Is using get_the_term_list and get_field in the manner below consistent with accepted standards for safely displaying taxonomy terms as links in a table and custom field text beneath headings in a ...
0
votes
4answers
49 views
How can I backup my site if it gets hacked?
Today I want to ask you something which is really important what if my WordPress website https://thecodezine.com gets hacked or my jetpack plugin security is broken?Will I lose everything? Is there no ...
0
votes
1answer
26 views
how do I secure my WP website from hackers? [closed]
I appreciate if someone helps me to secure my website from being hacked. Is there any helpful plugin to use?
0
votes
0answers
13 views
Block unauthenticated users from downloading png (or other data) files
How can I block users from direct downloading image files ( if they are not authenticated)?
I want to enable download just when user pass authentication header (JWT). Currently I have JWT enabled for ...
0
votes
2answers
205 views
Someone keeps changing my SITEURL (mysql injection or xss?) [closed]
I've twice had my site's url changed in the database. This is the only piece of data being altered. Whoever is doing this is then redirecting the site to a script at this location:
somelandingpage [...
0
votes
1answer
29 views
Where to store sensitive uploaded file?
I'm developing a plugin. Where is the best place to store a user uploaded file that is sensitive in nature? It should not be web accessible.
Given the encoding of the file, it's necessary that it be ...
0
votes
2answers
27 views
Developer/Designer asking for admin access
I have a Wordpress website and want a customized home-page built with Elementor plugin for my website. I am not good at designing attractive pages so I contacted one small firm to help me out with ...
0
votes
1answer
15 views
https rewrite not working for All in one security Brute force > rename login url
I am trying to set 2 security measures that seems not to work together:
https on the site, using a server redirect + Module rewrite in htaccess :
<IfModule mod_rewrite.c>
RewriteEngine On
...
0
votes
1answer
26 views
Will there be security updates for WordPress 4.9.9
Since WordPress 5 is out im wondering if there are still security updates for WordPress 4.9.9 or do I need to update to WordPress 5 as soon as possible?
0
votes
0answers
19 views
How can I ascertain that my previously hacked WordPress site are now free of malicious code? [duplicate]
I am almost certain that someone cracked my FTP password using Bruteforce attacks. After that, they injected malicious code in my 3 different websites. Two are hosted on WordPress and one is entirely ...
0
votes
2answers
34 views
White screen of death on admin pages after moving wp-config up two levels for security
I moved the wp-config to the hosting root and put it in a new directory and then I included it from the WordPress directory like so: include("../../my-fast-cars/fast-cars.php"); this gave me white ...
1
vote
1answer
27 views
Auth cookie value security risk?
A short question this time:
How much of a security risk is it when an third party gets access to WordPress auth cookie?
Can they for example simply copy the cookie and "be" logged in as the user who ...
0
votes
1answer
23 views
Security question - Display a General Custom Login Error Message
I need to change the information given on Wordpress' Login page and the Lost password page so that hackers cannot easily see if a username or email is associated with an existing account.
At the ...
0
votes
0answers
45 views
The in-famous Unable to locate WordPress Content directory (wp-content) and the Direct Method
I've been receiving this error for several years in all my Wordpress installations.
The solution has been always the same: the classic snipet where you add a filter for "filesystem_method" with direct ...
0
votes
1answer
23 views
Is a very simple theme secure enough?
I am very very new to Wordpress theme development and after creating one, I want to know if any threats will face it.
There is no way i receive any data from visitors, including no comments received. ...
0
votes
1answer
17 views
Security: Critical backend outside of wordpress
For starters, apologies for my miserable knowledge of web development.
I have been developing a simple website for my startup and have encountered some security concerns. Knowing my limited knowledge ...
1
vote
0answers
29 views
Good way to block users within a multisite setup without deleting them?
This is probably a common problem with multiple possibilities to solve. However I am asking for an easy solution as I guess I am not the first one to have this problem.
Assume we have a huge company ...
0
votes
1answer
27 views
Security: AWS (shared hosting) claims template file malicious
Recently, our hosting platform (AWS) notified us of a malicious template file:
/wp-content/uploads/tcb_lp_templates/templates/tcb2-bright-content-page.tpl
On closer closer inspection, there are quite ...
0
votes
1answer
35 views
Cannot access wp admin of Wordpress website (security plugin issue) [closed]
I was using all in one WP security and White Label plugin in one of my wordpress website.
I had custom wp-admin login url. After moving host i realized i cannot login via custom url. Also, wp-admin ...
1
vote
0answers
28 views
Plugins Deleted
I have a client whose site was broken by a plugin and instead of deactivating plugins, they deleted some kind of 'visual editor' plugin.
We managed to get the site back up and running and updated all ...
0
votes
1answer
88 views
Is it best to avoid using $wpdb for security issues?
I'm using WordPress Multisite with multilingualpress.
In order to get the href, outside of my navbar, to the page with the appropriate language, I am using an SQL query that queries $wpdb within the ...
0
votes
0answers
24 views
scripts in Wordpress pages are filtered
I have rich snippet scripts I'd like to place on my wordpress pages, for instance:
<script type='application/ld+json'>{"@context": "http://www.schema.org", "@type": "Event", "name":" Reading &...
0
votes
1answer
47 views
Need help for WordPress User Session Management?
I need help regarding WordPress session management. Follow these steps::
Bug: Session management and break authentication.
Steps to reproduce:
Log in to your account using browser 1.
Now, login to ...
0
votes
0answers
20 views
Any way to analyze suspicious password reset requests?
My WP site was recently hacked. I've removed the fake user account that was created, checked for hidden users in the database via phpMyAdmin, I believe I've found most of the added and hacked files ...
0
votes
0answers
33 views
Password protect multiple pages
Is it possible to have the "password protected page" feature of WordPress apply to more than one page? I have multiple pages I wish to protect with the same password, but I don't want people to keep ...
0
votes
2answers
29 views
How to add domain security certification, in WordPress website?
When I visit website using Wordpress Dashboard, browser is showing 'cPanel, Inc. Certification Authority';
But, when I access it directly typing the domain in the URL Bar, no Certification icon is ...
0
votes
1answer
26 views
Should I manually resolve WP Core File security issues or await a subsequent WP release?
Using the Google Developer Tools, I can see that some of WordPress' JavaScript Libraries contain known security vulnerabilities; some a few months old.
With this in mind, should I consider ...
