Strengthening themes, plugins and core installation to prevent intrusion.
1
vote
1answer
15 views
Wordpress custom login form using Ajax
Description:
I would like to create a custom login form: username, password and remember field. This is the code I have:
Problem: /wp-admin/admin-ajax.php 503 ()
What I've tried:
PHP:
function ...
2
votes
1answer
101 views
How to handle security on a wordpress site?
I'm doing a draft of a WordPress site on localhost.
If I am using PHP snippets to do the sort of back-end functionality. How do I know that, when this goes to a real platform, the php code cannot be ...
-1
votes
0answers
7 views
How are hackers getting past my .htaccess file? [migrated]
I run a self-hosted WordPress site on shared hosting. I have the following security setup:
WordPress files in /www/ directory on server. 755 permissions on /www/ dir.
wp-config.php set to 440
Complex ...
1
vote
1answer
39 views
Store brute-force IP addresses
How can I store IP addresses which try to brute-force the login section or to login too frequent too fast?
I need to store all IPs, then use them in another application, sort of like a learning ...
2
votes
0answers
28 views
Coding a plugin on WordPress; when should I sanitize? [duplicate]
I am developing a custom plugin on WordPress for a client. Just a simple question: when I am using update_post_meta() and update_user_meta(), do I need to use the WordPress sanitization functions? I ...
1
vote
2answers
23 views
Generating an nonce for Content Security Policy and all scripts - How to make it match/persist for each page load?
Hooking into the script_loader_tag hook and generating random strings is no problem, but how can I generate them once per page load and use them in both wp_head and script_loader_tag?
I'd really like ...
1
vote
0answers
10 views
WordPress ACL (folder + permissions)
For certificate a web platform created with WordPress, they ask me to provide a snapshot of ACL maintained on application / configuration folder.
Screenshot must clearly show who all have access to ...
0
votes
1answer
33 views
I should enable automatic updates?
I have a small hosting company with a few hundred sites hosted on cPanel.
All my clients need to use a WordPress plugin from our company for compatibility issues.
So I have the option to make all ...
0
votes
0answers
39 views
Should I use Woocommerce rest api to create products
I am trying to create plugin that gets data from external application with wp_remote_post to create products in Woocommerce.
I have read about Woocommerce REST API but have not found any information ...
0
votes
1answer
38 views
Wordpress Password security related questions
Since i'm doing Wordpress hardening for a project and ran into some questions that I haven't found a good answer online. If anyone has had any experience with this kind of stuff or have any know-how ...
1
vote
1answer
23 views
wp-admin folder, brute force, and password protection
I don't know how brute force attacks work. I have protected the wp-admin folder with a password, in addition to having the regular Wordpress login. How does having this "second layer" inhibit brute ...
0
votes
0answers
19 views
Escaping a WPDB Object in One Shot
I know array mapping works for escaping a bunch of values in an array, making them safe for output in HTML. But is there a way to do the same thing with an object? If not, I guess the object could ...
1
vote
1answer
30 views
$wpdb is get_results escaped
I'm guessing the answer is no here, but wanted to be sure. I would expect that when I get a database object or array using get_results that I still need to add htmlspecialchars() or esc_html() when ...
1
vote
0answers
27 views
How can I find security hole in my wordpress site?
Last day I've noticed that my site is hacked and a PHP backdoor is installed on my site.
Virus scanner reported that a plugin file is inside my wp-content/uploads which I did not upload it myself. It ...
0
votes
0answers
17 views
Advice On How to Backup Wordpress
I have my site hosted with Cloudways and am using ManageWP to manage the site. I am wondering about backup options.
Cloudways backs up the server and has an option to restore a particular app on ...
1
vote
0answers
17 views
Is wp_kses the right approach in sanitizing this string?
I have a function that trims my post title and I escape the final output using wp_kses.
Is this the right approach?
function theTrimmedPostTitle( $length = BIG_INT, $delimiter = '' )
{
$title = ...
-1
votes
2answers
27 views
What are the different types of firewall protections available for a WordPress website?
Can someone please explain (in layman language) what are the different types of firewall protections available for a WP site.
How do these firewall work and how are they different from one another?
...
0
votes
0answers
84 views
How to fix this CORS error?
I made a simple site on let's say main_domain.com.
Therefore I have landing_page CCT details page available on main_domain.com/landing_pages/my-landing.
My goal is to hook one domain per landing_page ...
0
votes
1answer
26 views
Hardening uploads folder in IIS breaks images
My site loads a bunch of images from the uploads folder, using direct URLs, such as:
http://www.example.com/wp-content/uploads/some.image.png
I'm trying to figure out a remote script execution issue,...
0
votes
1answer
22 views
Securely log in a user without a password using a link?
I'd like to use links from my application to log users into Wordpress in their browser, but I'm concerned about whether this can be done securely.
Obviously using any sort of static URL pattern seems ...
0
votes
0answers
6 views
How to disable comment review previews
In the comments admin section when I am reviewing new entries there is an annoying mouse-over-preview for links.
How can I disable this?
I am seriously worried that each mouse over is sending ...
0
votes
0answers
57 views
How can I stop other plugins from using my class' sensitive methods?
Assume I have a Class that deals with sending sensitive user information via e-mail to the developer.
So, the whole thing would look like:
<?php
namespace PrivateNamespace;
class ...
1
vote
1answer
113 views
Wordpress not seeing .htaccess rules
I'm currently building a small business website and I'm hosting on a home server, and have hit a roadblock with not being able to enhance security because of Wordpress not following any of the rules I'...
0
votes
1answer
27 views
Is it necessary to do validation again when retrieving data from database?
I do validation when saving data to database like following:
$data = validate($data);
update_post_meta($post_id, 'my_post_meta', $data);
The question is, do I need to do validation again when read ...
0
votes
0answers
17 views
captcha on wordpress site visting
I create website in wordpress and hackers try to hack my site. So I put itheme Security pulgin. I saw log taht tries to hack site. I want to put google captcha on first website visit? Can you please ...
0
votes
1answer
18 views
Secruity Questions on a timer
I am doing some research for a project and one requirement from the client is that to create an account a user must create security questions on account creation. I think this should be easy with a ...
1
vote
1answer
158 views
404 redirect wp-login and wp-admin after changing login url
I've successfully changed the login page to a custom url, using this codes:
This one into wp-config.php
define('WP_ADMIN_DIR', 'secret-folder');
define( 'ADMIN_COOKIE_PATH', SITECOOKIEPATH . ...
0
votes
1answer
65 views
Is it secure to use admin-ajax.php in front?
I would like to know if it is secure to use admin-ajax.php for your ajax requests on the front.
0
votes
0answers
24 views
Wordpress and dorking - Security
There are many good guides like "ultimate-guide-wordpress-security" out there providing many great explanations on how to harden and secure WordPress enabled websites.
However, one vulnerability ...
0
votes
0answers
38 views
Exporting and importing users - will passwords be the same?
I am using a membership plugin which creates users to access certain pages of our website.
I have recreated the membership site using a clean install and database of WordPress.
If I export the users ...
1
vote
1answer
49 views
Is there a way for a user to have an alias?
In the 80s I was the owner of a Apple support BBS (single user/one phone line).
I created a way for a user to have an alias linked to their user account.
The alias had the ability to post and any ...
1
vote
0answers
61 views
Logout USER form backoffice after 30 minutes of inactivity [closed]
I looking for to logout user from backoffice after 30 minutes of non activity except Administrator role.
Thanks.
1
vote
1answer
314 views
Where to store OAuth 2.0 client id and secret?
I'm building some functionality within one of my WordPress sites that integrates with a third-party API, and that API uses OAuth 2.0.
I use both the client ID and secret every time I need a new ...
0
votes
1answer
18 views
Chrome Dev Tools console says every page in my blog has link to http://maps.google.com [closed]
Viewing any page of my blog at https://www.rephunter.net/blog/ with the Chrome Dev Tools console open gives a Mixed Content error message.
The problem is that I cannot find where that link is, and to ...
5
votes
2answers
634 views
How do WordPress Nonces Work?
I am trying to understand how WordPress nonces work in terms of security. nonce stands for a number used once, but according to WordPress, it can be valid for up to 24 hours, which makes no sense. It ...
5
votes
1answer
187 views
WordPress and PHP Sessions - Security and Performance
I'm writing a WordPress plugin to deal with a third-party API.
This API requires a session identifier be passed to it so that the API (which basically functions as a third-party cart) knows what ...
0
votes
0answers
74 views
CSRF attack to create USER
I'm looking for to fix the issue below :
The following scenario show a successful CSRF attack resulting in the creation of a new user on wordpress:
The attacker sends malicious html page to an ...
0
votes
0answers
339 views
Encrypt User Data
I am building an application within Wordpress which requires the data of user accounts to be encrypted. So, email and any other personally identifiable data needs to be encrypted. I am planning on ...
1
vote
0answers
42 views
Reset Password policy
Looking for to add reset password policy.
Password specifications :
12 characters in length, 1 uppercase letter, 1 lowercase letter, 1 number, and 1 special character.
I find a hooks for manage ...
2
votes
1answer
46 views
password protected post policy
I'm looking for a way to add policy about POST password.
Password specifications :
12 characters in length, 1 uppercase letter, 1 lowercase letter, 1 number, and 1 special character.
Is ...
-1
votes
2answers
48 views
What is the best security $_POST method?
I made profile page. And i am getting values directly from inputs with $_POST method. Users update their profile in this page. I wonder is this security method? And i am using this in wp_list_table ...
0
votes
0answers
32 views
Why are the latest visits to my website originating from my own website?
To start with, I don't know anything about coding and stuff. I am here to seek help from experts hoping they can help me resolve the issue.
I have a website/blog that runs on WordPress.
I have a VPS ...
4
votes
3answers
109 views
Disable comment windows for all existing posts (pages/blogposts)
Is there a WP-CLI command to disable comment windows for all existing posts (pages/blogposts)?
I ask this since when I change a theme for a site I have, all pages in that site getting their comment ...
0
votes
1answer
23 views
WordPress scruity issue - Totally disable all comments by CSS — secure enough?
I have a website in which I want to totally disable, by principle, all comment-publishing windows / all comment functionality.
I can give a CSS directive like:
#comment-section, .respond {display: ...
-1
votes
1answer
28 views
DISABLE wordpress upgrade page
For security purpose I want to Disable the adresse below:
...../upgrade.php
It's give informations about the version of wordpress used.
1
vote
1answer
90 views
Force to use STRONG users password and implement rule to prevent REUSE [closed]
I'm looking for a way to force using strong password when we create reset and change users password on WordPress backoffice.
Password complexity must be at least 12 characters in length, and have at ...
0
votes
2answers
57 views
Do I need to escape get_the_post_thumbnail function?
I am developing a WordPress theme for WordPress.org. Do I need to escape get_the_post_thumbnail function? I want to use it outside the loop. So, I won't be able to use the_post_thumbnail. Please let ...
0
votes
1answer
17 views
Is there default meta boxes types that handles types and sanitization?
I've been tasked with my first WordPress project. It's a project that involves custom plugin development. While looking over the documentation for adding custom post types I found the meta boxes ...
0
votes
1answer
170 views
Moving wp-config.php outside root folder where we have multiple wordpress websites for enhanced security [duplicate]
I have moved wp-config.php but my file structure is as given below:
public_html
--abccom
--applecom
--wp-config.php
abcom and applecom folder has wordpress websites both
As advised, I have moved wp-...
0
votes
1answer
14 views
Where to store publicly-accessible files
I have built a wordpress site that requires that the users log in to be able to access the content. However, I want to make a few files publicly-accessible.
The only clue I have found so far ...
