Questions tagged [security]
Strengthening themes, plugins and core installation to prevent intrusion.
962
questions
0
votes
2
answers
42
views
Security headers disappear on Wordpress pages
I am facing a problem that both me and my host support team were unable to untangle. I have included security headers in my .htaccess file (see below), but I get inconsistent results:
All the headers ...
0
votes
0
answers
54
views
Unknown phantom user "wordpress" created with admin privileges
We've been seeing a user created out of nowhere named "wordpress" every so often, with most of our wordpress sites on a couple Ubuntu 20 servers. I run a quick audit across our server using ...
1
vote
1
answer
51
views
How can I find out exactly what Google is finding 'Deceptive' about my WordPress site?
I recently stood up a WordPress site in a Docker container and enabled https with Let's Encrypt. Everything seems ok from an https standpoint.
Then I registered the site with Google Search Console, ...
- 113
0
votes
0
answers
29
views
User can see and enter the Wordpress Admin without login
I have some users reporting to me that they can see the admin bar and also they can enter the admin panel of the website without login in.
I'm not sure how this is possible and I'm trying to find a ...
0
votes
0
answers
11
views
Disable themes.php except for network admin username
How to remove and disable the admin menu item:
Appearance > Themes for regular admin.
Only allowing Appearance > Themes:
If you are logged in as multisite admin.
The regular admin can not change ...
- 13
0
votes
0
answers
26
views
Wordpress EC2 Security Practices
I started working for a client about 3 months ago. They have wordpress running on EC2 instance and no security/monitoring at all. We have about 8 users and 3 active. Recently 2 users reported some ...
- 101
1
vote
1
answer
87
views
Why is this line of code Wrong in every Wordpress .Htaccess security article?
The following line of code (RegEx) is partly wrong in every Wordpress .Htaccess hardening article I've seen. Why is that?
<FilesMatch "^.*(error_log|wp-config\.php|php.ini|\.[hH][tT][aApP].*)$&...
0
votes
0
answers
26
views
Encrypt User last name in wordpress for security reasons
Can Anyone help me to encrypt only the user's last name in WordPress? I only want to encrypt user's last name in the database for some security reasons. I am unable to find the solution Please let me ...
0
votes
1
answer
23
views
Content Security Policy blocking images from installed plugins' popup info window, as they are from external domains - global fix?
I have Content Security Policy added to my WordPress site via Header set in .htaccess, and just found if I am on the WordPress plugins admin page (/wp-admin/plugins.php), and click "View Details&...
- 117
0
votes
0
answers
27
views
Bullet proofing a server with 150 WP insallations
We have about 150 active blogs we are serving our clients and the maintenance is getting to the point where it's not going to be profitable. In order to save space and maint costs, I've symlinked the ...
- 103
2
votes
0
answers
39
views
How to protect content from public users and limit access to certain roles in WordPress 2023?
There are hundreds of content protection plugins and role managers, however in my current case I need a custom solution.
The customer wants that only "logged in users" are to be able to read ...
- 535
0
votes
1
answer
39
views
(How) does WordPress protect direct access of user data?
I am setting up a WordPress with a user system.
User information (names, profile picture) of all users should be private, and only accessable when logged in.
The "Ultimate Member" plugin ...
- 101
0
votes
0
answers
59
views
How to address security vulnerabilities: LUCKY13, BEAST, and BREACH
A client sent in an urgent request to resolve 3 vulnerabilities: LUCKY13, BEAST, BREACH. I don't have any more information other than they exist, and I don't really know how to address them.
My first ...
- 111
0
votes
0
answers
11
views
how to decrease the size of wordpress site after installing the wordfence
Recently i had a malicious attack on my wordpress website through the EA for elementor , after that i downloaded some plugins for security and monitoring activity , like activity log for logs and ...
0
votes
1
answer
100
views
wp-salt.php and wp-cli.yml File present in public_html folder
Few hours back I was trying to login into my wordpress website, but it gave the error - Incorrect Password.
So, I ran a scan on my wordpress website with the command - "wp core verify-checksums&...
0
votes
1
answer
48
views
how to sanitizing $_POST with the correct way?
I am trying to sanitize and validate and escape this code?
$positions = $_POST['positions'];
foreach ($positions as $key => $position) {
$id = sanitize_text_field($position[0]);
...
0
votes
0
answers
18
views
WordPress User Registration/ Sign Up -> Able to take Paid Certification Courses & keep track of Completed Certificates
I'm really new to WordPress and been tasked with this assignment and not sure how to tackle it.
So we have a WordPress site and we plan on using the Masteriyo plugin to create and sell online ...
3
votes
1
answer
69
views
Which php files, in a WordPress setup, do not need direct web access?
Many php files in a WordPress installation are only used through require() or include(). Leaving them exposed to direct web access may increase security risks. Files such as wp-config.php has no need ...
- 33
0
votes
1
answer
47
views
Block Root REST API Route using custom &/or iThemes
I'm looking to block the following REST API Routes /wp-json/ & /wp-json/v2/users/
I have iThemes currently installed that handles the users route, but would prefer to block the root route also.
...
- 3
0
votes
1
answer
540
views
esc_url, esc_url_raw or sanitize_url?
I know there's already this post here but its answers still leave me in the dark about these three methods.
I'm a little confused by the selection of one of the methods mentioned in the title, if I ...
- 487
0
votes
1
answer
30
views
Should we escape the values of constants?
In my theme folder, I store my constants in a file called constants.php.
But when we use the constant, should we escape it like esc_html__('This is '. CONSTANT_A, 'text-domain');
I was wondering if a ...
- 19
1
vote
0
answers
356
views
is exposed wp-admin site a serious security vulnerability
this is a basic question that i was unable to wrap my head around via chat gpt or google, namely is it a serious security vulnerability for a wordpress site to have publicly available wp-admin (login ...
- 11
0
votes
2
answers
279
views
Can you alter the default wordpress strong password requirements?
Does anyone know if you can override the default wordpress password strength expectations?
We just did a migration from an old system that has a different encryption. We will need to have all users ...
- 131
0
votes
0
answers
27
views
Wordpress - tracking options
I wanted to ask, how much is it possible to track users when using WP as a CMS. For example, can I see, when users go to certain directories like wp/files or open specific documents like wp/files/docs/...
- 1
0
votes
0
answers
14
views
what to do after instlling cyberpanel on VPS
I am upgrading from shared hosting to VPS hosting, so I went with digitalocean and used marketplace to create a droplet with cyberpanel, linked my domain to the droplet, moved data, and almost done.
...
- 1
1
vote
0
answers
72
views
Impossible to update jQuery version from 3.1.0
PageSpeed Insights is complaining about me using jQuery version 3.1.0 because of security risks.
I've been trying to update my jQuery version with two plugins:
jQuery Updater
jQuery Version Control
...
- 119
3
votes
1
answer
576
views
How to find source of these strange SQL queries?
I'm looking at my slow queries and i don't understand how some bot or person is doing them. They look like this: (i copy/paste them no placeholders!)
SELECT post_id FROM wp_postmeta, wp_posts WHERE ID ...
- 539
1
vote
1
answer
213
views
How to securely set dynamic HTML content with JavaScript?
Description
I have implemented a frontend script that gets a few text options from the server via wp_add_inline_script.
When the user does an action the content should dynamically change to one of the ...
- 131
0
votes
0
answers
39
views
WP-JSON: Cross Origin Resource Sharing Vulnerability?
I am testing the security of a webpage owned by the company I work for. I noticed that an arbitrary origin is accepted. In the screenshot below, you'll see that I added that example origin which was ...
2
votes
1
answer
327
views
Is my Wordpress site handing out sensitive information/misconfigured?
This HNQ answer seems to imply that the URL path /?rest_route=/wp/v2/users/ may be displaying information that is sensitive, and that perhaps there is some misconfiguration that allows WordPress to ...
- 281
0
votes
1
answer
179
views
How to rename files during upload to a random string?
I want my files being renamed automatically on upload to a random number that does not interfere with other random named files. I am new to PHP and do not want to change a code snippet every year to ...
0
votes
0
answers
73
views
How to parse an image that was just uploaded to make sure it doesn't contain malicious code?
Let's assume that an user has just uploaded an image. How do we make sure that the image doesn't contain hidden PHP code that will run once the image is on the server? The most common (and, for ...
0
votes
0
answers
153
views
Hide plugins and theme from public
I like to hide all or some of my plugins and themes and CMS from public such that the users cannot detect which plugins/themes/CMS I used to build my website.
Please let me know if it is possible to ...
- 103
1
vote
2
answers
473
views
Prevent direct access to Wordpress plugin assets?
I was wondering if there was a simple way to prevent direct access to asset files within a WordPress plugin. Primarily javascript files.
I'm developing a plugin that's meant to be used only in the ...
- 315
0
votes
1
answer
34
views
How can i ensure that SQL statements are not displayed if an enduser types the wrong variable name in the URL
My question is similar to this. It is about security of my wordpress site which has custom pages that call variables on the url.
An example of my url looks like this:
https://mysitevvv.ke/mysite1/...
- 103
1
vote
1
answer
25
views
Restrict Access without Creating Users
I'm building a plugin which receives quote data form a third party api and uses it generate a post of type 'quote' which, on the front end, comprises an acf_form which the customer is required to fill ...
- 561
0
votes
1
answer
130
views
reCaptcha doesnt appear in comment (manual or plugin)
I tried the following:
https://www.quora.com/How-can-I-insert-Captcha-code-in-WordPress-theme-without-using-any-plugin
https://codeforgeek.com/add-google-recaptcha-wordpress/
https://pluginsforwp.com/...
- 61
0
votes
0
answers
33
views
Wordpress search shows protected content
I have noticed many times that WordPress search results reveal protected/locked content. Is it a security issue or do search results show the webpage as viewed by the admin?
Sometimes, the content of ...
- 1
0
votes
1
answer
255
views
404/500 error on content images if Referer header is from another domain [closed]
Not very familiar with WordPress so I'm not sure what's causing this.
Essentially, we have a few image assets stored under wp-content. When we access some assets (i.e. cmssubdomain.apex.com/wp-content/...
- 113
1
vote
1
answer
103
views
Escape when echoed
I've been trying to submit a plugin for review and I keep having problems with the echo line.
The last version I sent was like this.
<option value="">
<?php _e( '- Default', ...
- 17
0
votes
1
answer
590
views
How to correctly escape an echo
In WordPress they recommend that I should escape any part of the code of my plugin that shows data to the user, I have made most of the corrections but this specific case I don't know how to escape ...
- 17
0
votes
1
answer
17
views
Website show Google Ads when we have no Google Ads linked to our website
Today we noticed that one of our website has started showing random Google Ads on our website when we have not added any Google Ads to our website.
I would appreciate if someone can help in case they ...
- 101
1
vote
1
answer
157
views
What's the point of forbidding access to wp-config.php?
Probably a dumb question...
the hardening doc suggests setting up your web server so that it prevents access to wp-config.php. If you do this, and a client tries to access the file, Apache returns 403 ...
- 127
1
vote
1
answer
359
views
Is there any point setting the keys and salts in wp-config.php?
I'm auto-generating WordPress (5.9.3) sites on a VPS. I could, as part of the generation script, create random strings for the various keys and salts in wp-config.php. However, there doesn't appear to ...
- 127
0
votes
1
answer
24
views
Are major WordPress updates mandatory for security?
I have created a web site, I want to activate minor updates (for security) on it and disable major updates (to avoid problems with themes or plugin or my functions.php which could become incompatible ...
0
votes
0
answers
95
views
i moved wp-config.php outside of public html and this broke my website
I moved it back and the website started working again.
I tried moving wp-config to secure my wordpress site
here is what i did:
created another file config.php
downloaded wp-config and copied all the ...
- 1
0
votes
1
answer
170
views
Reject all malicious URL requests functions.php
this might not be the right place as it's a question about a function snippet that relates also to the server and log files.
I have been trying to block access to my site from bad query attempts which ...
- 1
0
votes
1
answer
254
views
Is it safe to upload JSON files to upload folder?
I'm using wp_upload_bits to upload JSON files to my WP's upload folder. I get the error "Sorry, this file type is not permitted for security reasons"
Is it safe to upload JSON file anyway?
- 19
1
vote
1
answer
97
views
Remove style `?ver=` from `/wp-admin/upgrade.php`
Using style_loader_src hook to remove the version query works just fine, but on /wp-admin/upgrade.php the version queries won't go away.
Is there a way to also remove the versions strings from the /wp-...
- 253
0
votes
0
answers
46
views
Security of a Wordpress Plugin
What security mechanisms exist in Wordpress to ensure that a popular plugin doesn't contain malicious code which for example tries to gain access to the database or make downstream DDOS attacks?
- 111