Questions tagged [security]
Strengthening themes, plugins and core installation to prevent intrusion.
899
questions
0
votes
0answers
37 views
WP SiteHealth check reports “The REST API encountered an unexpected result”. Where to setup SSL *client* cert for *internal* WP use?
I'm running WP 5.7 on Linux. It's an Nginx server.
I'm setting up an internal site with policy that requires all services using SSL client cert verification enabled.
The WP host listener has ssl ...
0
votes
0answers
10 views
mDocs Error on my website how to fix it? [closed]
The error when I try to view the second folder in mdocs on my website I see this:
mDocs Error: Memphis has terminated due to a faulty nonce check. This check is needed to deter Cross-site scripting ...
0
votes
1answer
13 views
Input sanitation
I have a question regarding a wordpress site I have recently developed for a client. I have only until now developed a site for small clients that just require personal websites, however this client ...
0
votes
1answer
26 views
Is it Ok to restrict Access-Control-Allow-Origin for /wp-json requests?
I've been tasked with managing a WordPress site that was developed and configured by some other team. During a basic security scan, I've realized that the following end-point https://www.mywordpress....
1
vote
1answer
17 views
How to prevent XSS alter custom global javascript object & methods in Wordpress
Im working on a project in Wordpress that enqueues multiple .js files where each file adds
a new method to a global javascript object, this in order to make the desired methods available only if ...
0
votes
1answer
34 views
Is it unsafe to put php in the /wp-content/uploads directory?
Pretty straight forward question, but I'll provide any clarifications needed.
The reason I'm asking is this: I created a child theme that pulls in a custom-functions.php file. This allows devs to ...
0
votes
0answers
7 views
Is it possible to limit access to login/forget password by countries?
I know we can limit people accessing the wordpress by countries but is it possible to limit access on wp-login.php and forgetpassword links? I see a lot of script trying to access wp-login.php or any ...
0
votes
1answer
23 views
Vulnerability Concern From the Plugin or From Not Updating the Plugin?
Our company website has over 40 plugins. That is a lot...way too many. However, each plugin serves a purpose.
When updating all plugins to the recent version we noticed parts of the website break. ...
0
votes
0answers
12 views
How and why use validate_username and how to secure inputs fields of registration form?
I would use validate_username to protect username and other inputs from tags, octet, and others filters and conditions from sanitize_user but these functions only remove these dangerous chars and does ...
1
vote
1answer
49 views
.htaccess rules for blocking bots with an extra condition
I have a WP multisite installed. I am integrated with Ezoic and Cloudflare. I had implemented firewall rules. However, I have an issue blocking bots that have X-Middleton in the User-Agent, because my ...
0
votes
1answer
17 views
sanitize_post() is not sanitizing Post Object
I wanted to sanitize a WP_Query post object without using foreach.
I used this method:
$args = array(
// ...
)
$data = array();
$the_query = new WP_Query($args);
$data["post"] = $the_query-...
0
votes
0answers
6 views
Adjusting Prevent Concurrent Logins plugin to refresh the pages of older sessions
Is it possible to adjust the "Prevent Concurrent Logins" plugin to refresh "old sessions" browsers right after the "new sessions" logs in?
The plugin works currently fine ...
0
votes
0answers
16 views
Blacklisting jwt after logout in wordpress
I need to blacklist jwt after logout. Does anyone implemented it in in wordpress and could share his approach?
What I’ve thought of is storing blacklisted user jwt in user meta (value and expiration ...
0
votes
1answer
40 views
wp_nonce vs jwt
I’ve recently added jwt authentication to my website because frontend of my site is completely decoupled from backend.
What I haven’t thought of is that I could use wp_nonce instead of jwt - create ...
0
votes
1answer
72 views
Why does check_ajax_referer give a 403 error on https websites?
When I write an ajax funtion on a site without SSL, check_ajax_referer works as intended.
But it fails with a 403 forbidden error on a https site. I've tried a lot of times, but I just don't know why ...
1
vote
0answers
23 views
How to block plugin activations with no known user or coming from unknown IP address range?
I have received a Sucuri alert for an unauthorized plugin activation:
Event: Plugin Activated Website: http://www.XXXXXX.XXX IP Address: XXX.XXX.XXX.XXX Reverse IP: XXXXXX.XXXXXX.XXXX Date/Time: 7 ...
1
vote
1answer
22 views
Nonce failing on form submission
I'm updating some code in one of my WordPress plugins by adding a nonce to improve security. The plugin that has a form that generates some output that the user can copy and paste as a shortcode. At ...
1
vote
1answer
36 views
Wordpress SQL Injections through User Agent
Currently Wordpress seems to be scoring bad on SQL Injection through User Agent. The testing tools that are being used return that it's insecure because it returns HTTP responses (errors) when you ...
0
votes
0answers
13 views
Disabling PHP exec/shell type functions - is this reasonable/best practice for a web hosting provider / does it break known plugins?
This question is nominally similar to Vanilla Wordpress install, what can/should I put in disable_functions? - a possible key difference is that I'm looking at it as someone that provides Wordpress ...
0
votes
1answer
39 views
WordPress disable direct access of files in WordPress installation path
I want to add a security feature to my WordPress website to stop direct access to files added to the root of WordPress installation, recently I discovered that a malicious plugin added some files to ...
2
votes
0answers
70 views
Nonces, AJAX, script variables & security in WordPress
Alright, so let's say you develop a website where you enqueue a js script on a page X of your frontend, using:
wp_enqueue_script(
'script_handle',
PATH_TO_SCRIPT,
array(),
'1.0.0',
true
);
...
1
vote
1answer
22 views
I want to disable login of admin (/wp-admin) with email and make it accessible only with username
I want to do it as a security precaution. I've already taken other actions. But I want to be able to login only with my admin username. Is there a way to do that or even a plugin?
0
votes
0answers
16 views
how secure wordpress comment form in a custom theme?
How is it possible to secure comment form in Wordpress against XSS attack?
recently we made a custom theme for our wordpress website and I used this code for the comments section as follows.
The main ...
0
votes
0answers
13 views
Suhosin After all, should it be used? Or it's obsolete
In PHP 5 versions, I used suhosin.
Currently, this add-on has not been updated since 2016. Is it obsolete? Is it important for the server ... And for CMS wordpress, joomla, drupral?
Should it be used ...
0
votes
0answers
9 views
new plugin idea - shortcode security
i am not a coder so i can't make a plugin. recently i was searching tutorials/plugins for a feature so that i can restrict the use of shortcode but i found nothing. so i think it will be good idea to ...
0
votes
0answers
18 views
Is any code executed in disabled plugins?
I was wondering how much of a problem disabled plugins can be, in terms of security. I found another related question here, but the answers don't provide any details.
What I'd like to know is if any ...
0
votes
1answer
17 views
SQL queries to another wordpress site
I have 2 wordpress sites on the same hosting and the same host/user/ password for the database
I have on the other hand 2 different database and 2 different prefixes
I need, during an action on site1, ...
0
votes
1answer
18 views
Strict Folder and File Permissions for WordPress Themes Folder
My client is working with a third party security team that insists on having WordPress theme folder I created set to 644 for folders and 444 on files. Is this even possible with WordPress?
0
votes
0answers
17 views
How to secure many Wordpress Sites?
I was wondering what the best way is to secure many wordpress sites. Assuming i have a server with 100 Domains and each Domain has a single Wordpress site to it. What would be the best way to protect ...
0
votes
1answer
44 views
Insert NULL value using prepare()
I have similars queries
/* Query */
global $wpdb;
$tablename = $wpdb->prefix . 'data';
$sql = $wpdb->prepare(
"
UPDATE $tablename
SET
`date` = %s,
WHERE
id= %...
0
votes
1answer
74 views
malware undetectable by multiple scans
I would like to inform and request help from the community.
What happens is this malware was in the folder / wp-content / uploads / 2020 /
Named index.php
And I found him in the year 2017 in the ...
0
votes
1answer
19 views
How to make WP page accessile only to specific user roles
I am creating a website that consists of a "Home Page" (public) that has a login link to the WP login page, then, there will be different pages that are only accessible to specific logged ...
0
votes
0answers
12 views
Disable superadmin login from not-main domain?
I'm looking for a setting to stop that a superadmin can login on any other domains in a multi-user Wordpress than the main-domain. I can do it with iptables or nftabels but i would prefer a more ...
0
votes
2answers
39 views
Checking a WordPress for OWASP top 10 vulnerabilities [closed]
I have just made a WordPress plugin and I would like to scan it for OWASP Top 10 vulnerabilities, any resources on how to get started here?
Thanks
0
votes
0answers
16 views
Restricting access to settings or files
Currently on WordPress administrators have access to the following resources. This is limited by get_userdata( get_current_user_id() ).
'wp-login.php', 'wp-register.php', 'index.php', 'update-core....
0
votes
0answers
94 views
How to prevent my external API call from being called by anyone but me (my site)
My site sends different data to an external API under different circumstances. Luckily, most of it happens on form submissions, but there are a few instances where I need to make an API call from the ...
0
votes
0answers
9 views
Malicious code on a WP site [duplicate]
So the other day I received a message from Google Search Console alerting that one of the websites I host contain malicious code, and I did manage to find numerous encrypted code lines in several ...
0
votes
2answers
19 views
Is it safe to use the basic administration with reduced rights for private member space
I know it´s not clearly a technical question, I did not find on the Web (maybe my location makes the job harder).
I have to develop a private member space.
It´s easier for me to use the wordpress ...
0
votes
0answers
19 views
Is it secure to copy a database from a hacked server?
Is it secure to copy the database and uploads directory from an old hacked server to a new server or may they be infected? I'm not sure what was the attack type but it will save much time if it's ...
1
vote
1answer
25 views
Check for security updates
Is there any option to check all my plugins, core and themes on a website for security issues?
Example:
For the Wordpress core I can check my current Version: get_bloginfo( 'version' ),
for updates: ...
1
vote
1answer
42 views
Wordpress: Adding Security
Regarding this answer, is correct to add the file debug.log in this way?
RewriteRule (?:debug|readme|license|changelog|-config|-sample)\.(?:php|md|txt|html|log?) - [R=404,NC,L]
Kind Regards
0
votes
1answer
20 views
how to protect wordpress content from crawler
I found current wordpress content is very vulunerable to HTML cralwer like BeautifulSoup. How to protect contents?
hide media link
hide post content
using ajax
These are my initial thoughts but I ...
0
votes
0answers
41 views
Is it okay to use an ACF field to store a password for a protected area of a page?
I was wondering how secure it is to use a simple ACF text field on a page to store a password for a certain area of content on the page? So the user would have to enter in a password in an input field ...
0
votes
0answers
29 views
WordPress Admin CPT custom action to add_action securley
I write this PHP code in my functions.php but I was wondering if this the correct way to do it (best way and security)
Is this securely?
What about the use of wp_nonce_url in the link? (is $_GET ...
0
votes
1answer
28 views
Version of jQuery In Wordpress Failing Security Audit
I did a localhost test of a custom WP theme I'm building, and in Google Chrome's Lighthouse audit it is failing the 'best practices' part of the audit because of an old version of jQuery that seems to ...
0
votes
0answers
14 views
hide theme files for admin beneath root
The purpose is to give full admin rights, but not to the proprietary theme files.
Our website is on /root/public_html/
We want to move only the themefolder /root/public_html/wp-content/themes/
beneath ...
0
votes
1answer
44 views
How to Prevent Brute Force Attack on WordPress
my site went down for 1hr. and after then continuously. So I asked my hosting what the problem is with my website. they say I am in under brute force attack. told me to hire someone.
I Limit Login ...
1
vote
1answer
293 views
Remove special characters in a URL
I need a help to prevent special characters in URL & it should redirect to 404 error page, if anyone specifically entered characters. I tried a couple of ways through .htaccess but none of them ...
0
votes
1answer
151 views
get_posts() SQL Injection
I'm working on a custom search page and I usually use wpdb->prepare when crafting custom queries. But this time I went with get_posts to create the below query. But I'm wondering if I have to worry ...
0
votes
0answers
167 views
Securing WordPress running on Azure platform
We have a static website hosted on Microsoft Azure. Our marketing team wanted a easy way to update it so WordPress was installed on Azure, the site was created, marketing team updates it. A WordPress ...
