Questions tagged [security]

Strengthening themes, plugins and core installation to prevent intrusion.

Filter by
Sorted by
Tagged with
0 votes
2 answers
42 views

Security headers disappear on Wordpress pages

I am facing a problem that both me and my host support team were unable to untangle. I have included security headers in my .htaccess file (see below), but I get inconsistent results: All the headers ...
AnalysisStudent0414's user avatar
0 votes
0 answers
54 views

Unknown phantom user "wordpress" created with admin privileges

We've been seeing a user created out of nowhere named "wordpress" every so often, with most of our wordpress sites on a couple Ubuntu 20 servers. I run a quick audit across our server using ...
blueionRich's user avatar
1 vote
1 answer
51 views

How can I find out exactly what Google is finding 'Deceptive' about my WordPress site?

I recently stood up a WordPress site in a Docker container and enabled https with Let's Encrypt. Everything seems ok from an https standpoint. Then I registered the site with Google Search Console, ...
Marcus's user avatar
  • 113
0 votes
0 answers
29 views

User can see and enter the Wordpress Admin without login

I have some users reporting to me that they can see the admin bar and also they can enter the admin panel of the website without login in. I'm not sure how this is possible and I'm trying to find a ...
Paulo Brás's user avatar
0 votes
0 answers
11 views

Disable themes.php except for network admin username

How to remove and disable the admin menu item: Appearance > Themes for regular admin. Only allowing Appearance > Themes: If you are logged in as multisite admin. The regular admin can not change ...
Angel Hess's user avatar
0 votes
0 answers
26 views

Wordpress EC2 Security Practices

I started working for a client about 3 months ago. They have wordpress running on EC2 instance and no security/monitoring at all. We have about 8 users and 3 active. Recently 2 users reported some ...
user20719's user avatar
  • 101
1 vote
1 answer
87 views

Why is this line of code Wrong in every Wordpress .Htaccess security article?

The following line of code (RegEx) is partly wrong in every Wordpress .Htaccess hardening article I've seen. Why is that? <FilesMatch "^.*(error_log|wp-config\.php|php.ini|\.[hH][tT][aApP].*)$&...
Yahya Tarjuman's user avatar
0 votes
0 answers
26 views

Encrypt User last name in wordpress for security reasons

Can Anyone help me to encrypt only the user's last name in WordPress? I only want to encrypt user's last name in the database for some security reasons. I am unable to find the solution Please let me ...
Kunal Verma's user avatar
0 votes
1 answer
23 views

Content Security Policy blocking images from installed plugins' popup info window, as they are from external domains - global fix?

I have Content Security Policy added to my WordPress site via Header set in .htaccess, and just found if I am on the WordPress plugins admin page (/wp-admin/plugins.php), and click "View Details&...
Ben Blue's user avatar
  • 117
0 votes
0 answers
27 views

Bullet proofing a server with 150 WP insallations

We have about 150 active blogs we are serving our clients and the maintenance is getting to the point where it's not going to be profitable. In order to save space and maint costs, I've symlinked the ...
Zak's user avatar
  • 103
2 votes
0 answers
39 views

How to protect content from public users and limit access to certain roles in WordPress 2023?

There are hundreds of content protection plugins and role managers, however in my current case I need a custom solution. The customer wants that only "logged in users" are to be able to read ...
Blackbam's user avatar
  • 535
0 votes
1 answer
39 views

(How) does WordPress protect direct access of user data?

I am setting up a WordPress with a user system. User information (names, profile picture) of all users should be private, and only accessable when logged in. The "Ultimate Member" plugin ...
M.G.Poirot's user avatar
0 votes
0 answers
59 views

How to address security vulnerabilities: LUCKY13, BEAST, and BREACH

A client sent in an urgent request to resolve 3 vulnerabilities: LUCKY13, BEAST, BREACH. I don't have any more information other than they exist, and I don't really know how to address them. My first ...
Jillian Hoenig's user avatar
0 votes
0 answers
11 views

how to decrease the size of wordpress site after installing the wordfence

Recently i had a malicious attack on my wordpress website through the EA for elementor , after that i downloaded some plugins for security and monitoring activity , like activity log for logs and ...
Prince Bhati's user avatar
0 votes
1 answer
100 views

wp-salt.php and wp-cli.yml File present in public_html folder

Few hours back I was trying to login into my wordpress website, but it gave the error - Incorrect Password. So, I ran a scan on my wordpress website with the command - "wp core verify-checksums&...
user232316's user avatar
0 votes
1 answer
48 views

how to sanitizing $_POST with the correct way?

I am trying to sanitize and validate and escape this code? $positions = $_POST['positions']; foreach ($positions as $key => $position) { $id = sanitize_text_field($position[0]); ...
crazybuilding's user avatar
0 votes
0 answers
18 views

WordPress User Registration/ Sign Up -> Able to take Paid Certification Courses & keep track of Completed Certificates

I'm really new to WordPress and been tasked with this assignment and not sure how to tackle it. So we have a WordPress site and we plan on using the Masteriyo plugin to create and sell online ...
SparklingLemonWater's user avatar
3 votes
1 answer
69 views

Which php files, in a WordPress setup, do not need direct web access?

Many php files in a WordPress installation are only used through require() or include(). Leaving them exposed to direct web access may increase security risks. Files such as wp-config.php has no need ...
capodieci's user avatar
0 votes
1 answer
47 views

Block Root REST API Route using custom &/or iThemes

I'm looking to block the following REST API Routes /wp-json/ & /wp-json/v2/users/ I have iThemes currently installed that handles the users route, but would prefer to block the root route also. ...
WilsonP's user avatar
0 votes
1 answer
540 views

esc_url, esc_url_raw or sanitize_url?

I know there's already this post here but its answers still leave me in the dark about these three methods. I'm a little confused by the selection of one of the methods mentioned in the title, if I ...
DevelJoe's user avatar
  • 487
0 votes
1 answer
30 views

Should we escape the values of constants?

In my theme folder, I store my constants in a file called constants.php. But when we use the constant, should we escape it like esc_html__('This is '. CONSTANT_A, 'text-domain'); I was wondering if a ...
ratib90486's user avatar
1 vote
0 answers
356 views

is exposed wp-admin site a serious security vulnerability

this is a basic question that i was unable to wrap my head around via chat gpt or google, namely is it a serious security vulnerability for a wordpress site to have publicly available wp-admin (login ...
pawelek69420's user avatar
0 votes
2 answers
279 views

Can you alter the default wordpress strong password requirements?

Does anyone know if you can override the default wordpress password strength expectations? We just did a migration from an old system that has a different encryption. We will need to have all users ...
Kai Qing's user avatar
  • 131
0 votes
0 answers
27 views

Wordpress - tracking options

I wanted to ask, how much is it possible to track users when using WP as a CMS. For example, can I see, when users go to certain directories like wp/files or open specific documents like wp/files/docs/...
Mel's user avatar
  • 1
0 votes
0 answers
14 views

what to do after instlling cyberpanel on VPS

I am upgrading from shared hosting to VPS hosting, so I went with digitalocean and used marketplace to create a droplet with cyberpanel, linked my domain to the droplet, moved data, and almost done. ...
mo999dev's user avatar
1 vote
0 answers
72 views

Impossible to update jQuery version from 3.1.0

PageSpeed Insights is complaining about me using jQuery version 3.1.0 because of security risks. I've been trying to update my jQuery version with two plugins: jQuery Updater jQuery Version Control ...
Fernando Redondo's user avatar
3 votes
1 answer
576 views

How to find source of these strange SQL queries?

I'm looking at my slow queries and i don't understand how some bot or person is doing them. They look like this: (i copy/paste them no placeholders!) SELECT post_id FROM wp_postmeta, wp_posts WHERE ID ...
Michael Rogers's user avatar
1 vote
1 answer
213 views

How to securely set dynamic HTML content with JavaScript?

Description I have implemented a frontend script that gets a few text options from the server via wp_add_inline_script. When the user does an action the content should dynamically change to one of the ...
Josef Wittmann's user avatar
0 votes
0 answers
39 views

WP-JSON: Cross Origin Resource Sharing Vulnerability?

I am testing the security of a webpage owned by the company I work for. I noticed that an arbitrary origin is accepted. In the screenshot below, you'll see that I added that example origin which was ...
UbuntuNoob's user avatar
2 votes
1 answer
327 views

Is my Wordpress site handing out sensitive information/misconfigured?

This HNQ answer seems to imply that the URL path /?rest_route=/wp/v2/users/ may be displaying information that is sensitive, and that perhaps there is some misconfiguration that allows WordPress to ...
Hannah Vernon's user avatar
0 votes
1 answer
179 views

How to rename files during upload to a random string?

I want my files being renamed automatically on upload to a random number that does not interfere with other random named files. I am new to PHP and do not want to change a code snippet every year to ...
WordPress1290412's user avatar
0 votes
0 answers
73 views

How to parse an image that was just uploaded to make sure it doesn't contain malicious code?

Let's assume that an user has just uploaded an image. How do we make sure that the image doesn't contain hidden PHP code that will run once the image is on the server? The most common (and, for ...
Mark Robinson's user avatar
0 votes
0 answers
153 views

Hide plugins and theme from public

I like to hide all or some of my plugins and themes and CMS from public such that the users cannot detect which plugins/themes/CMS I used to build my website. Please let me know if it is possible to ...
asad's user avatar
  • 103
1 vote
2 answers
473 views

Prevent direct access to Wordpress plugin assets?

I was wondering if there was a simple way to prevent direct access to asset files within a WordPress plugin. Primarily javascript files. I'm developing a plugin that's meant to be used only in the ...
Dan's user avatar
  • 315
0 votes
1 answer
34 views

How can i ensure that SQL statements are not displayed if an enduser types the wrong variable name in the URL

My question is similar to this. It is about security of my wordpress site which has custom pages that call variables on the url. An example of my url looks like this: https://mysitevvv.ke/mysite1/...
Alex Maina's user avatar
1 vote
1 answer
25 views

Restrict Access without Creating Users

I'm building a plugin which receives quote data form a third party api and uses it generate a post of type 'quote' which, on the front end, comprises an acf_form which the customer is required to fill ...
Kevin Nugent's user avatar
0 votes
1 answer
130 views

reCaptcha doesnt appear in comment (manual or plugin)

I tried the following: https://www.quora.com/How-can-I-insert-Captcha-code-in-WordPress-theme-without-using-any-plugin https://codeforgeek.com/add-google-recaptcha-wordpress/ https://pluginsforwp.com/...
Axil's user avatar
  • 61
0 votes
0 answers
33 views

Wordpress search shows protected content

I have noticed many times that WordPress search results reveal protected/locked content. Is it a security issue or do search results show the webpage as viewed by the admin? Sometimes, the content of ...
david's user avatar
  • 1
0 votes
1 answer
255 views

404/500 error on content images if Referer header is from another domain [closed]

Not very familiar with WordPress so I'm not sure what's causing this. Essentially, we have a few image assets stored under wp-content. When we access some assets (i.e. cmssubdomain.apex.com/wp-content/...
AnimaSola's user avatar
  • 113
1 vote
1 answer
103 views

Escape when echoed

I've been trying to submit a plugin for review and I keep having problems with the echo line. The last version I sent was like this. <option value=""> <?php _e( '- Default', ...
choseɳ's user avatar
  • 17
0 votes
1 answer
590 views

How to correctly escape an echo

In WordPress they recommend that I should escape any part of the code of my plugin that shows data to the user, I have made most of the corrections but this specific case I don't know how to escape ...
choseɳ's user avatar
  • 17
0 votes
1 answer
17 views

Website show Google Ads when we have no Google Ads linked to our website

Today we noticed that one of our website has started showing random Google Ads on our website when we have not added any Google Ads to our website. I would appreciate if someone can help in case they ...
Learning's user avatar
  • 101
1 vote
1 answer
157 views

What's the point of forbidding access to wp-config.php?

Probably a dumb question... the hardening doc suggests setting up your web server so that it prevents access to wp-config.php. If you do this, and a client tries to access the file, Apache returns 403 ...
QF0's user avatar
  • 127
1 vote
1 answer
359 views

Is there any point setting the keys and salts in wp-config.php?

I'm auto-generating WordPress (5.9.3) sites on a VPS. I could, as part of the generation script, create random strings for the various keys and salts in wp-config.php. However, there doesn't appear to ...
QF0's user avatar
  • 127
0 votes
1 answer
24 views

Are major WordPress updates mandatory for security?

I have created a web site, I want to activate minor updates (for security) on it and disable major updates (to avoid problems with themes or plugin or my functions.php which could become incompatible ...
Nicolas Bourdon's user avatar
0 votes
0 answers
95 views

i moved wp-config.php outside of public html and this broke my website

I moved it back and the website started working again. I tried moving wp-config to secure my wordpress site here is what i did: created another file config.php downloaded wp-config and copied all the ...
wp user's user avatar
0 votes
1 answer
170 views

Reject all malicious URL requests functions.php

this might not be the right place as it's a question about a function snippet that relates also to the server and log files. I have been trying to block access to my site from bad query attempts which ...
lee03's user avatar
  • 1
0 votes
1 answer
254 views

Is it safe to upload JSON files to upload folder?

I'm using wp_upload_bits to upload JSON files to my WP's upload folder. I get the error "Sorry, this file type is not permitted for security reasons" Is it safe to upload JSON file anyway?
ratib90486's user avatar
1 vote
1 answer
97 views

Remove style `?ver=` from `/wp-admin/upgrade.php`

Using style_loader_src hook to remove the version query works just fine, but on /wp-admin/upgrade.php the version queries won't go away. Is there a way to also remove the versions strings from the /wp-...
David Wolf's user avatar
0 votes
0 answers
46 views

Security of a Wordpress Plugin

What security mechanisms exist in Wordpress to ensure that a popular plugin doesn't contain malicious code which for example tries to gain access to the database or make downstream DDOS attacks?
Ant Kutschera's user avatar

1
2 3 4 5
20