Questions tagged [security]
Strengthening themes, plugins and core installation to prevent intrusion.
1
vote
0answers
30 views
Best practices to assert current_user_can() with guests
In WordPress, a guest can do a lot of things, such as reading posts.
However, this always returns false for guests:
add_action('wp', function() {
global $post;
/** @var WP_Post_Type $pto */
...
0
votes
0answers
16 views
Can i use php phar to archive a wordpress plugin source files or few files only?
I want to secure main logic of my wordpress plugin. Only solution i got except encryption and obscurification is by making an archived file of my plugin source files via php phar but how and is it ...
1
vote
1answer
24 views
WP Admin AJAX Security - using POST to include a relative URL
I have set up several WordPress Admin AJAX scripts (that run only in the Admin panel) that currently all use separate actions, functions and nonce's.
The only "real" difference between these scripts ...
1
vote
1answer
18 views
Admin username and password
I use ceber security plugin which protects my site again malicious attacks etc.
I checked today and there were over 20 lock outs. I checked ip addresses and there were no constituencies, they were ...
0
votes
0answers
15 views
wordpress injection scripts & images finding
My wordpress site was injected some unwanted scripts & images. Right now nearly 25 plugins available on my site. So i am not able to review each plugin folders & sub folders.
Please let me ...
-1
votes
1answer
24 views
Is my WP site being hacked?
In the past month or so I've seen 3 or 4 new users signing up each day with "awkward" usernames (letters/numbers). Then, a few days later, they start changing their password. And then a few days later ...
0
votes
0answers
12 views
block access to wordpress users to the folder that contains an external web application
First, sorry for my english.
I am developing a web application that works on wordpress. I have a folder called GSC, and inside it is my application.
The problem I have, is when I have to control ...
0
votes
1answer
27 views
Where i should not use if (!defined('ABSPATH')) { exit; }?
I think this best way to prevent direct access..
<?php if (!defined('ABSPATH')) { exit; }?>
i have used this on all my php files..can it create problems?
any files on WordPress theme i should ...
0
votes
0answers
16 views
Should I check for privileges before hooking into `wp_ajax_$handle` or after?
Should I heck for privileges before even hooking the wp_ajax_hook_name or in the function that I've hooked to it?
The first way:
if( current_user_can( 'manage_options' ) ) {
add_action( '...
0
votes
1answer
27 views
How can I have more confidence that WP plugins aren't getting and storing user data?
How can I have more confidence that WP plugins aren't getting and storing user data? This is in regard to making my website GDPR-compliant.
Perhaps an automatic scanning tool?
Are there any existing ...
0
votes
2answers
49 views
How do I test to ensure that my wp-config file is protected?
Since order allow,deny is deprecated in 2.4 I wanted to rewrite the rules in my .htaccess file to use the new rules. Previously I was using:
<files wp-config.php>
order allow,deny
deny ...
0
votes
0answers
22 views
Is the Wordpress Nonce authentication enough for admin REST calls in a plugin
I have a plugin which also has some admin pages. These pages require some ajax calls that should be authenticated. So if the admin is logged in, these ajax calls are valid, and otherwise they should ...
0
votes
0answers
15 views
Ninja Forms security issue
I am working on a WordPress site where there is a security problem found by "WPScan" with the Ninja Forms plugin. Unfortunately, I cannot do these scans myself and only have this info:
The file /wp-...
7
votes
3answers
1k views
Does this .htaccess security setting really work?
What does this .htaccess do?
Am I correct in thinking that all it does is prevent automatic brute force attacks?
So, to access the wp-login.php you have to manually type in the URL of the domain so ...
-1
votes
1answer
17 views
How to resolve these findings from security audit
I am working on a corporate project and they are running security audit by consultants and they found the following issues regarding Wordpress. I managed to get a lot of issues resolved using headers ...
-1
votes
1answer
38 views
Are image addresses security relevant?
I have a website, where images are like:
<img src="upload/test.jpg"/>
But I checked some larger sites and they have a different src as:
<img src="imgrur.com/9keqqq"/>
My question is, ...
0
votes
0answers
21 views
Am I at risk if I am the only one uploading SVG to my website?
I am working on a wordpress website and I enabled SVGs uploading through functions.php to make graphics look crisp and increase page speed. It's a company website, so I'll probably be the only one ...
0
votes
0answers
18 views
Securing php templates which access to external DB
I was asked to generate a form as a theme template which must access an external DB only for logged users. It can even write into it. What I did to secure the form is:
making the page, which relies ...
0
votes
0answers
20 views
Share a single database or multiple databases
I currently have a live site on its own database (prefix wp_).
I want to install a new region-specific site on subdirectory (e.g. domain.com/my).
The blog will always be on the first site (domain.com/...
0
votes
0answers
33 views
Deny php execution in /wp-includes - using .htaccess in /wp-includes VS root folder
Trying to secure my WP site. In an attempt to deny php execution from the wp-includes folder wondering if these two methods are effectively doing the same thing?
1) add new .htaccess file to root of ...
0
votes
1answer
23 views
Is it possible to use WP-CLI in a plugin (or theme)?
Is it possible to use WP-CLI in a plugin (or theme)?
Such as
$ret = \WP_CLI::execute('plugin list');
I want to use some subcommands from other plugins.
0
votes
0answers
26 views
How to safely pass post_id and user_id via AJAX to the backend (prevent user from changing it via JS)?
I'm having code (user rates post) where I'm passing user_id and post_id via AJAX to the back-end. My concern is that user can change values in JS and pass another’s user id or post id. How do I ...
0
votes
0answers
25 views
setup wordpress behind a firewall, how to detect host needed to add to whitelist?
I need to deploy my company website on my company server through firewall (image below)
The firewall 1 is done,
But I can't findout what, and how many host my wordpres server need to connect to.
Is ...
0
votes
0answers
18 views
Allowing upload of files without an extension based on MIME type
I am trying to allow the upload of files that match a specific mime type, regardless of what the extension is (and even if there is no extension at all.)
Currently, wordpress is blocking these ...
1
vote
1answer
148 views
Wordpress custom login form using Ajax
Description:
I would like to create a custom login form: username, password and remember field. This is the code I have:
Problem: /wp-admin/admin-ajax.php 503 ()
What I've tried:
PHP:
function ...
2
votes
1answer
118 views
How to handle security on a wordpress site? [closed]
I'm doing a draft of a WordPress site on localhost.
If I am using PHP snippets to do the sort of back-end functionality. How do I know that, when this goes to a real platform, the php code cannot be ...
1
vote
1answer
43 views
Store brute-force IP addresses
How can I store IP addresses which try to brute-force the login section or to login too frequent too fast?
I need to store all IPs, then use them in another application, sort of like a learning ...
2
votes
0answers
32 views
Coding a plugin on WordPress; when should I sanitize? [duplicate]
I am developing a custom plugin on WordPress for a client. Just a simple question: when I am using update_post_meta() and update_user_meta(), do I need to use the WordPress sanitization functions? I ...
1
vote
2answers
50 views
Generating an nonce for Content Security Policy and all scripts - How to make it match/persist for each page load?
Hooking into the script_loader_tag hook and generating random strings is no problem, but how can I generate them once per page load and use them in both wp_head and script_loader_tag?
I'd really like ...
1
vote
0answers
12 views
WordPress ACL (folder + permissions)
For certificate a web platform created with WordPress, they ask me to provide a snapshot of ACL maintained on application / configuration folder.
Screenshot must clearly show who all have access to ...
0
votes
1answer
33 views
I should enable automatic updates?
I have a small hosting company with a few hundred sites hosted on cPanel.
All my clients need to use a WordPress plugin from our company for compatibility issues.
So I have the option to make all ...
0
votes
0answers
235 views
Should I use Woocommerce rest api to create products
I am trying to create plugin that gets data from external application with wp_remote_post to create products in Woocommerce.
I have read about Woocommerce REST API but have not found any information ...
0
votes
1answer
43 views
Wordpress Password security related questions
Since i'm doing Wordpress hardening for a project and ran into some questions that I haven't found a good answer online. If anyone has had any experience with this kind of stuff or have any know-how ...
1
vote
1answer
37 views
wp-admin folder, brute force, and password protection
I don't know how brute force attacks work. I have protected the wp-admin folder with a password, in addition to having the regular Wordpress login. How does having this "second layer" inhibit brute ...
0
votes
0answers
20 views
Escaping a WPDB Object in One Shot
I know array mapping works for escaping a bunch of values in an array, making them safe for output in HTML. But is there a way to do the same thing with an object? If not, I guess the object could ...
1
vote
1answer
123 views
$wpdb is get_results escaped
I'm guessing the answer is no here, but wanted to be sure. I would expect that when I get a database object or array using get_results that I still need to add htmlspecialchars() or esc_html() when ...
1
vote
0answers
38 views
How can I find security hole in my wordpress site?
Last day I've noticed that my site is hacked and a PHP backdoor is installed on my site.
Virus scanner reported that a plugin file is inside my wp-content/uploads which I did not upload it myself. It ...
0
votes
0answers
18 views
Advice On How to Backup Wordpress
I have my site hosted with Cloudways and am using ManageWP to manage the site. I am wondering about backup options.
Cloudways backs up the server and has an option to restore a particular app on ...
1
vote
0answers
18 views
Is wp_kses the right approach in sanitizing this string?
I have a function that trims my post title and I escape the final output using wp_kses.
Is this the right approach?
function theTrimmedPostTitle( $length = BIG_INT, $delimiter = '' )
{
$title = ...
-1
votes
2answers
30 views
What are the different types of firewall protections available for a WordPress website?
Can someone please explain (in layman language) what are the different types of firewall protections available for a WP site.
How do these firewall work and how are they different from one another?
...
0
votes
0answers
395 views
How to fix this CORS error?
I made a simple site on let's say main_domain.com.
Therefore I have landing_page CCT details page available on main_domain.com/landing_pages/my-landing.
My goal is to hook one domain per landing_page ...
0
votes
1answer
36 views
Hardening uploads folder in IIS breaks images
My site loads a bunch of images from the uploads folder, using direct URLs, such as:
http://www.example.com/wp-content/uploads/some.image.png
I'm trying to figure out a remote script execution issue,...
0
votes
1answer
42 views
Securely log in a user without a password using a link?
I'd like to use links from my application to log users into Wordpress in their browser, but I'm concerned about whether this can be done securely.
Obviously using any sort of static URL pattern seems ...
0
votes
0answers
7 views
How to disable comment review previews
In the comments admin section when I am reviewing new entries there is an annoying mouse-over-preview for links.
How can I disable this?
I am seriously worried that each mouse over is sending ...
0
votes
0answers
58 views
How can I stop other plugins from using my class' sensitive methods?
Assume I have a Class that deals with sending sensitive user information via e-mail to the developer.
So, the whole thing would look like:
<?php
namespace PrivateNamespace;
class ...
1
vote
1answer
199 views
Wordpress not seeing .htaccess rules
I'm currently building a small business website and I'm hosting on a home server, and have hit a roadblock with not being able to enhance security because of Wordpress not following any of the rules I'...
0
votes
1answer
30 views
Is it necessary to do validation again when retrieving data from database?
I do validation when saving data to database like following:
$data = validate($data);
update_post_meta($post_id, 'my_post_meta', $data);
The question is, do I need to do validation again when read ...
0
votes
0answers
18 views
captcha on wordpress site visting
I create website in wordpress and hackers try to hack my site. So I put itheme Security pulgin. I saw log taht tries to hack site. I want to put google captcha on first website visit? Can you please ...
0
votes
1answer
19 views
Secruity Questions on a timer
I am doing some research for a project and one requirement from the client is that to create an account a user must create security questions on account creation. I think this should be easy with a ...
1
vote
1answer
317 views
404 redirect wp-login and wp-admin after changing login url
I've successfully changed the login page to a custom url, using this codes:
This one into wp-config.php
define('WP_ADMIN_DIR', 'secret-folder');
define( 'ADMIN_COOKIE_PATH', SITECOOKIEPATH . ...
