Questions tagged [security]
Strengthening themes, plugins and core installation to prevent intrusion.
892
questions
0
votes
0answers
15 views
Why does check_ajax_referer give a 403 error on https websites?
When I write an ajax funtion on a site without SSL, check_ajax_referer works as intended.
But it fails with a 403 forbidden error on a https site. I've tried a lot of times, but I just don't know why ...
1
vote
0answers
13 views
How to block plugin activations with no known user or coming from unknown IP address range?
I have received a Sucuri alert for an unauthorized plugin activation:
Event: Plugin Activated Website: http://www.XXXXXX.XXX IP Address: XXX.XXX.XXX.XXX Reverse IP: XXXXXX.XXXXXX.XXXX Date/Time: 7 ...
0
votes
0answers
13 views
Security best practices: use the same email for every project? [closed]
I am using WordPress and at the moment I have 50+ projects I completed for my clients.
For all the websites I am using my business E-mail address for my admin accounts. Is that good or is it better to ...
1
vote
1answer
18 views
Nonce failing on form submission
I'm updating some code in one of my WordPress plugins by adding a nonce to improve security. The plugin that has a form that generates some output that the user can copy and paste as a shortcode. At ...
1
vote
1answer
33 views
Wordpress SQL Injections through User Agent
Currently Wordpress seems to be scoring bad on SQL Injection through User Agent. The testing tools that are being used return that it's insecure because it returns HTTP responses (errors) when you ...
0
votes
0answers
8 views
Disabling PHP exec/shell type functions - is this reasonable/best practice for a web hosting provider / does it break known plugins?
This question is nominally similar to Vanilla Wordpress install, what can/should I put in disable_functions? - a possible key difference is that I'm looking at it as someone that provides Wordpress ...
0
votes
1answer
35 views
WordPress disable direct access of files in WordPress installation path
I want to add a security feature to my WordPress website to stop direct access to files added to the root of WordPress installation, recently I discovered that a malicious plugin added some files to ...
2
votes
0answers
41 views
Nonces, AJAX, script variables & security in WordPress
Alright, so let's say you develop a website where you enqueue a js script on a page X of your frontend, using:
wp_enqueue_script(
'script_handle',
PATH_TO_SCRIPT,
array(),
'1.0.0',
true
);
...
1
vote
1answer
19 views
I want to disable login of admin (/wp-admin) with email and make it accessible only with username
I want to do it as a security precaution. I've already taken other actions. But I want to be able to login only with my admin username. Is there a way to do that or even a plugin?
0
votes
0answers
16 views
how secure wordpress comment form in a custom theme?
How is it possible to secure comment form in Wordpress against XSS attack?
recently we made a custom theme for our wordpress website and I used this code for the comments section as follows.
The main ...
0
votes
0answers
11 views
Suhosin After all, should it be used? Or it's obsolete
In PHP 5 versions, I used suhosin.
Currently, this add-on has not been updated since 2016. Is it obsolete? Is it important for the server ... And for CMS wordpress, joomla, drupral?
Should it be used ...
0
votes
0answers
9 views
new plugin idea - shortcode security
i am not a coder so i can't make a plugin. recently i was searching tutorials/plugins for a feature so that i can restrict the use of shortcode but i found nothing. so i think it will be good idea to ...
0
votes
0answers
18 views
Is any code executed in disabled plugins?
I was wondering how much of a problem disabled plugins can be, in terms of security. I found another related question here, but the answers don't provide any details.
What I'd like to know is if any ...
0
votes
1answer
15 views
SQL queries to another wordpress site
I have 2 wordpress sites on the same hosting and the same host/user/ password for the database
I have on the other hand 2 different database and 2 different prefixes
I need, during an action on site1, ...
0
votes
1answer
18 views
Strict Folder and File Permissions for WordPress Themes Folder
My client is working with a third party security team that insists on having WordPress theme folder I created set to 644 for folders and 444 on files. Is this even possible with WordPress?
0
votes
0answers
17 views
How to secure many Wordpress Sites?
I was wondering what the best way is to secure many wordpress sites. Assuming i have a server with 100 Domains and each Domain has a single Wordpress site to it. What would be the best way to protect ...
0
votes
0answers
17 views
Insert NULL value using prepare()
I have similars queries
/* Query */
global $wpdb;
$tablename = $wpdb->prefix . 'data';
$sql = $wpdb->prepare(
"
UPDATE $tablename
SET
`date` = %s,
WHERE
id= %...
0
votes
1answer
37 views
malware undetectable by multiple scans
I would like to inform and request help from the community.
What happens is this malware was in the folder / wp-content / uploads / 2020 /
Named index.php
And I found him in the year 2017 in the ...
0
votes
1answer
14 views
How to make WP page accessile only to specific user roles
I am creating a website that consists of a "Home Page" (public) that has a login link to the WP login page, then, there will be different pages that are only accessible to specific logged ...
0
votes
0answers
10 views
Disable superadmin login from not-main domain?
I'm looking for a setting to stop that a superadmin can login on any other domains in a multi-user Wordpress than the main-domain. I can do it with iptables or nftabels but i would prefer a more ...
0
votes
2answers
34 views
Checking a WordPress for OWASP top 10 vulnerabilities [closed]
I have just made a WordPress plugin and I would like to scan it for OWASP Top 10 vulnerabilities, any resources on how to get started here?
Thanks
0
votes
0answers
16 views
Restricting access to settings or files
Currently on WordPress administrators have access to the following resources. This is limited by get_userdata( get_current_user_id() ).
'wp-login.php', 'wp-register.php', 'index.php', 'update-core....
0
votes
0answers
46 views
How to prevent my external API call from being called by anyone but me (my site)
My site sends different data to an external API under different circumstances. Luckily, most of it happens on form submissions, but there are a few instances where I need to make an API call from the ...
0
votes
0answers
9 views
Malicious code on a WP site [duplicate]
So the other day I received a message from Google Search Console alerting that one of the websites I host contain malicious code, and I did manage to find numerous encrypted code lines in several ...
0
votes
2answers
19 views
Is it safe to use the basic administration with reduced rights for private member space
I know it´s not clearly a technical question, I did not find on the Web (maybe my location makes the job harder).
I have to develop a private member space.
It´s easier for me to use the wordpress ...
0
votes
0answers
18 views
Is it secure to copy a database from a hacked server?
Is it secure to copy the database and uploads directory from an old hacked server to a new server or may they be infected? I'm not sure what was the attack type but it will save much time if it's ...
0
votes
1answer
24 views
Check for security updates
Is there any option to check all my plugins, core and themes on a website for security issues?
Example:
For the Wordpress core I can check my current Version: get_bloginfo( 'version' ),
for updates: ...
1
vote
1answer
42 views
Wordpress: Adding Security
Regarding this answer, is correct to add the file debug.log in this way?
RewriteRule (?:debug|readme|license|changelog|-config|-sample)\.(?:php|md|txt|html|log?) - [R=404,NC,L]
Kind Regards
0
votes
1answer
20 views
how to protect wordpress content from crawler
I found current wordpress content is very vulunerable to HTML cralwer like BeautifulSoup. How to protect contents?
hide media link
hide post content
using ajax
These are my initial thoughts but I ...
0
votes
0answers
22 views
Is it okay to use an ACF field to store a password for a protected area of a page?
I was wondering how secure it is to use a simple ACF text field on a page to store a password for a certain area of content on the page? So the user would have to enter in a password in an input field ...
0
votes
0answers
23 views
WordPress Admin CPT custom action to add_action securley
I write this PHP code in my functions.php but I was wondering if this the correct way to do it (best way and security)
Is this securely?
What about the use of wp_nonce_url in the link? (is $_GET ...
0
votes
1answer
27 views
Version of jQuery In Wordpress Failing Security Audit
I did a localhost test of a custom WP theme I'm building, and in Google Chrome's Lighthouse audit it is failing the 'best practices' part of the audit because of an old version of jQuery that seems to ...
0
votes
0answers
14 views
hide theme files for admin beneath root
The purpose is to give full admin rights, but not to the proprietary theme files.
Our website is on /root/public_html/
We want to move only the themefolder /root/public_html/wp-content/themes/
beneath ...
0
votes
1answer
39 views
How to Prevent Brute Force Attack on WordPress
my site went down for 1hr. and after then continuously. So I asked my hosting what the problem is with my website. they say I am in under brute force attack. told me to hire someone.
I Limit Login ...
1
vote
1answer
141 views
Remove special characters in a URL
I need a help to prevent special characters in URL & it should redirect to 404 error page, if anyone specifically entered characters. I tried a couple of ways through .htaccess but none of them ...
0
votes
1answer
92 views
get_posts() SQL Injection
I'm working on a custom search page and I usually use wpdb->prepare when crafting custom queries. But this time I went with get_posts to create the below query. But I'm wondering if I have to worry ...
0
votes
0answers
98 views
Securing WordPress running on Azure platform
We have a static website hosted on Microsoft Azure. Our marketing team wanted a easy way to update it so WordPress was installed on Azure, the site was created, marketing team updates it. A WordPress ...
1
vote
1answer
72 views
How to stop xmlrpc attacks without disabling component to allow JetPack to work in WordPress?
I manage a WordPress website using an virtual machine in the cloud, and lately, I noticed a lot of unwanted requests to the xmlrpc.php component that are slowing down the site causing high CPU loads. ...
1
vote
0answers
24 views
Authentication with the Rest API when using an External Application
Good day!
I'm new to rest api.
My task: to make authorization and management of user meta-information on WordPress.
More specifically: I write games in html5 (in fact, this is a Java script), and I ...
0
votes
1answer
25 views
Woocommerce API security concerns
I'm building a native app that will be using the woocommerce API to gather products.
The API user i created has READ only access to the API.
The app I'm making will be publicly available, so is there ...
0
votes
0answers
40 views
How to store sensitive user data (passwords)
I want to create a plugin addon that allows my sites users to share private login information in a secure manner. So they'll enter these private details in a form on the frontend and I want to be able ...
0
votes
1answer
13 views
Asking help regarding potential malware
I am helping someone whose WordPress website has files getting generated unders his folders, and being named after the folder. Can someone help me with what this does?
https://pastebin.com/zrUeXwZS
I ...
0
votes
0answers
13 views
Safe to use of SVG in a multi user blog in this scenario?
I want to upload SVG format site logo. I know uploading SVG creates possibilities of vulnerabilities. What I asking about the following scenario,
When No-one can upload anything in the post (I prefer ...
1
vote
0answers
70 views
Client side HTTP parameter pollution (reflected)
Some of my sites have been flagged by a security scanner as being vulnerable to client-side HTTP parameter pollution. The security department says that this must be fixed. How can I protect against ...
1
vote
1answer
289 views
Wordpress “Site Health Status” trust it or myself for its security advice?
I'm using WordPress to host a few sites. Lately it includes this feature called Site Health Status. This information has in part been valuable, but it also itches me the wrong way somehow that I can't ...
1
vote
0answers
25 views
Local file inclusion critical security issue [closed]
08/Jul/20 13:33:56 #5406089 CRITICAL 3 195.54.160.115 GET /index.php - Local file inclusion - [GET:fileName = /etc/passwd] - my-domain.com
I received this log in my NinjaFirewall plugin ...
0
votes
0answers
32 views
What are these weird url's in my Google Analytics reports?
I have a WP blog site. I have installed google analytics.
From one or two months ago, there are weird access frequently, but not every day. I can see that url from the Google Analytics.
The urls are ...
0
votes
0answers
50 views
WordPress URL requests have suspicious query strings attached in logs
I have a simple Wordpress site. Unknown query string is appended to few requests by Bing and Google bots daily. In site's Apache access log, there are few entries every day like below:
157.55.39.119 -...
0
votes
0answers
155 views
?wc-ajax=get_refreshed_fragments call after page load
I'm working on a wooCommerce website, it's slow, so i checked with gmetrix, it shows
?wc-ajax=get_refreshed_fragments
ajax call drain the site speed, actually it call two time, i know, it basically ...
0
votes
0answers
56 views
How to force JWT auth for default GET endpoints of Wordpress rest api?
The default GET endpoints (for e.g. http://scintec.net/wp-json/wp/v2/posts/) of the Wordpress Rest api are public and can be accessed by anyone.
I am currently interacting with a Wordpress Rest api ...
