Questions tagged [security]

Strengthening themes, plugins and core installation to prevent intrusion.

Filter by
Sorted by
Tagged with
0
votes
0answers
7 views

Malicious code on a WP site‏ [duplicate]

So the other day I received a message from Google Search Console alerting that one of the websites I host contain malicious code, and I did manage to find numerous encrypted code lines in several ...
0
votes
2answers
16 views

Is it safe to use the basic administration with reduced rights for private member space

I know it´s not clearly a technical question, I did not find on the Web (maybe my location makes the job harder). I have to develop a private member space. It´s easier for me to use the wordpress ...
0
votes
0answers
17 views

Is it secure to copy a database from a hacked server?

Is it secure to copy the database and uploads directory from an old hacked server to a new server or may they be infected? I'm not sure what was the attack type but it will save much time if it's ...
0
votes
1answer
18 views

Check for security updates

Is there any option to check all my plugins, core and themes on a website for security issues? Example: For the Wordpress core I can check my current Version: get_bloginfo( 'version' ), for updates: ...
1
vote
1answer
36 views

Wordpress: Adding Security

Regarding this answer, is correct to add the file debug.log in this way? RewriteRule (?:debug|readme|license|changelog|-config|-sample)\.(?:php|md|txt|html|log?) - [R=404,NC,L] Kind Regards
0
votes
1answer
18 views

how to protect wordpress content from crawler

I found current wordpress content is very vulunerable to HTML cralwer like BeautifulSoup. How to protect contents? hide media link hide post content using ajax These are my initial thoughts but I ...
0
votes
0answers
13 views

Is it okay to use an ACF field to store a password for a protected area of a page?

I was wondering how secure it is to use a simple ACF text field on a page to store a password for a certain area of content on the page? So the user would have to enter in a password in an input field ...
0
votes
0answers
15 views

WordPress Admin CPT custom action to add_action securley

I write this PHP code in my functions.php but I was wondering if this the correct way to do it (best way and security) Is this securely? What about the use of wp_nonce_url in the link? (is $_GET ...
0
votes
1answer
18 views

Version of jQuery In Wordpress Failing Security Audit

I did a localhost test of a custom WP theme I'm building, and in Google Chrome's Lighthouse audit it is failing the 'best practices' part of the audit because of an old version of jQuery that seems to ...
0
votes
0answers
14 views

hide theme files for admin beneath root

The purpose is to give full admin rights, but not to the proprietary theme files. Our website is on /root/public_html/ We want to move only the themefolder /root/public_html/wp-content/themes/ beneath ...
0
votes
1answer
34 views

How to Prevent Brute Force Attack on WordPress

my site went down for 1hr. and after then continuously. So I asked my hosting what the problem is with my website. they say I am in under brute force attack. told me to hire someone. I Limit Login ...
1
vote
1answer
39 views

Remove special characters in a URL

I need a help to prevent special characters in URL & it should redirect to 404 error page, if anyone specifically entered characters. I tried a couple of ways through .htaccess but none of them ...
0
votes
1answer
39 views

get_posts() SQL Injection

I'm working on a custom search page and I usually use wpdb->prepare when crafting custom queries. But this time I went with get_posts to create the below query. But I'm wondering if I have to worry ...
0
votes
0answers
23 views

Securing WordPress running on Azure platform

We have a static website hosted on Microsoft Azure. Our marketing team wanted a easy way to update it so WordPress was installed on Azure, the site was created, marketing team updates it. A WordPress ...
0
votes
0answers
42 views

How to stop xmlrpc attacks without disabling component to allow JetPack to work in WordPress?

I manage a WordPress website using an virtual machine in the cloud, and lately, I noticed a lot of unwanted requests to the xmlrpc.php component that are slowing down the site causing high CPU loads. ...
1
vote
0answers
17 views

Authentication with the Rest API when using an External Application

Good day! I'm new to rest api. My task: to make authorization and management of user meta-information on WordPress. More specifically: I write games in html5 (in fact, this is a Java script), and I ...
0
votes
1answer
20 views

Woocommerce API security concerns

I'm building a native app that will be using the woocommerce API to gather products. The API user i created has READ only access to the API. The app I'm making will be publicly available, so is there ...
0
votes
0answers
26 views

How to store sensitive user data (passwords)

I want to create a plugin addon that allows my sites users to share private login information in a secure manner. So they'll enter these private details in a form on the frontend and I want to be able ...
0
votes
1answer
13 views

Asking help regarding potential malware

I am helping someone whose WordPress website has files getting generated unders his folders, and being named after the folder. Can someone help me with what this does? https://pastebin.com/zrUeXwZS I ...
0
votes
0answers
13 views

Safe to use of SVG in a multi user blog in this scenario?

I want to upload SVG format site logo. I know uploading SVG creates possibilities of vulnerabilities. What I asking about the following scenario, When No-one can upload anything in the post (I prefer ...
1
vote
0answers
39 views

Client side HTTP parameter pollution (reflected)

Some of my sites have been flagged by a security scanner as being vulnerable to client-side HTTP parameter pollution. The security department says that this must be fixed. How can I protect against ...
1
vote
1answer
101 views

Wordpress “Site Health Status” trust it or myself for its security advice?

I'm using WordPress to host a few sites. Lately it includes this feature called Site Health Status. This information has in part been valuable, but it also itches me the wrong way somehow that I can't ...
1
vote
0answers
18 views

Local file inclusion critical security issue [closed]

08/Jul/20 13:33:56 #5406089 CRITICAL 3 195.54.160.115 GET /index.php - Local file inclusion - [GET:fileName = /etc/passwd] - my-domain.com I received this log in my NinjaFirewall plugin ...
0
votes
0answers
27 views

What are these weird url's in my Google Analytics reports?

I have a WP blog site. I have installed google analytics. From one or two months ago, there are weird access frequently, but not every day. I can see that url from the Google Analytics. The urls are ...
0
votes
0answers
37 views

WordPress URL requests have suspicious query strings attached in logs

I have a simple Wordpress site. Unknown query string is appended to few requests by Bing and Google bots daily. In site's Apache access log, there are few entries every day like below: 157.55.39.119 -...
0
votes
0answers
54 views

?wc-ajax=get_refreshed_fragments call after page load

I'm working on a wooCommerce website, it's slow, so i checked with gmetrix, it shows ?wc-ajax=get_refreshed_fragments ajax call drain the site speed, actually it call two time, i know, it basically ...
0
votes
0answers
42 views

How to force JWT auth for default GET endpoints of Wordpress rest api?

The default GET endpoints (for e.g. http://scintec.net/wp-json/wp/v2/posts/) of the Wordpress Rest api are public and can be accessed by anyone. I am currently interacting with a Wordpress Rest api ...
0
votes
1answer
19 views

Can Wordpress admin user + database credentials be used to gain Cpanel or FTP access?

Trying to figure out if deleting admin user and changing database password will be enough to secure the website afterwards.
0
votes
1answer
26 views

How to secure my php forms

Please i need a security advice on how i created and is displaying my forms using php, i want to know from the security point of view if my below code is unsecured from cross scripting attacks or sql ...
0
votes
2answers
189 views

Force user to change their password on the frontend at the first login and password policy

I have 3 users roles on my platform with no access to the WordPress backoffice "external_user1" , "external_user2", "external_user3". I need to force every user with one of this roles to change his ...
1
vote
1answer
8k views

rms_unique_wp_mu_pl_fl_nm.php

What is creating this file? It's in /wp-content/mu-plugins directory. If I delete it, it comes back after a while. it contains these code: <?php if(!function_exists('do_rms_activation_task')) { ...
0
votes
0answers
25 views

Securely render emojis on front-end and post to backend

I am creating a wordpress plugin which allow user to select different emojis with text. I am then making a fetch request to back end to update with selected emoji. Right now I am just rendering a ...
0
votes
0answers
14 views

Block access to all WordPress “data” outlets

I've got an issue. I want to know all WordPress "secret" urls (so I can block them) For examples: Https://example.com/feed That exposes the posts. Is there some address that displays all tags/...
0
votes
0answers
249 views

How to restrict access to wordpress upload by specific user

I've added this to the downloads.php in woocommerce my account: <?php $current_user = wp_get_current_user(); $file_for_client = get_field('upload1232423', $current_user); if( $file_for_client ) :...
2
votes
2answers
155 views

Disable REST API for a user ROLE

I'm looking for a way to disable Rest API for a user role called 'external_user' (disable wp-json queries.) This user role can see right now alot of posts and pages information with when we put wp-...
0
votes
0answers
7 views

Allow Access To Password Protected Pages Only Once

I'd like to modify the built-in password protected functionality in Wordpress to only allow the set password to be used one time. Something that either disables the password or changes it after the ...
1
vote
1answer
71 views

Load More Posts Button - AJAX

I'm trying to add Ajax to my theme so I can load my posts dynamically. The following code works but for some reason when I wrap the button that fires the loading with another div it doesn't do ...
1
vote
0answers
23 views

Should I encrypt the response that triggers an Ajax action? Is nonce sufficient?

I am trying to write a custom user registration plugin. The plugin has 5 basic functionalities Take form data and create a user using wp_insert_iser Once a user is created, update user meta for ...
0
votes
0answers
29 views

Word-fence Logs : should i worry for these attempts?

i saw these following lines in wordfence tools my-site.com/mdocs-posts/?mdocs-img-preview=..%2Fwp-config.php my-site.com/wp-admin/admin-ajax.php?action=..%2Fwp-config.php my-site.com/wp-admin/admin-...
0
votes
1answer
65 views

Sanitize user input fields before wp_insert_post

I read how to sanitize, validate and escape text fields and I know wp_insert_post sanitizes all field using wp_kses except HTML tags. However, I'm new to development and would like to be confirmed ...
0
votes
1answer
169 views

Decoded malware code [closed]

My wordpress site got recently hacked. Upon research I found 3 files were infected : index.php wp-config.php wp-settings.php All including this piece of code : @include "\057h\157m\145/mywebsite/\...
0
votes
1answer
45 views

prevent anonymous access to Wordpress site (non-admin site)

I'm using WP to build a help/training portal for a commercial software product (Product X). We'd like to restrict access to this new WP site to only authenticated users of Product X as it contains ...
1
vote
1answer
17 views

password reset link being sent as HTTP?

I was just added as an admin on a WP site. The first thing I noticed is that the "(re)set your password" link in the email starts with http:// How do I fix that? The "View Post" link in Comment ...
0
votes
1answer
20 views

Security when outputing wp_oembed_get code

This is a code I have in a function.php action. It is responsible for getting and displaying an embed code. Typically there is a youtube link from $embed_link but it comes from a public form so it can ...
0
votes
1answer
109 views

Hiding Wordpress Plugin Source Code

I wonder if there is a way to hide a Wordpress Plugin's source code from users. I know wordpress is open source but i dont want the users be able to access and see my plugins source code if possible. ...
1
vote
1answer
21 views

How to get WordPress to send Password Reset Link Email instead of New Password?

My WordPress configuration generates a new password and sends it via email whenever a user uses Forgot Password link. How can I make WordPress send a Reset Password link instead of a new password? I ...
0
votes
1answer
44 views

Why does my admin email address keep changing to something random?

Every once in a while, I see an email like this: Someone (hopefully you) has used this email to register at My Website Username: ********* Password: ********* Thanks My Website I login to my ...
0
votes
0answers
30 views

Fix Potential Security Issue in Custom Taxonomy Search Functionality

I want to add some functionality to a client WordPress site that allows you to include taxonomy terms from custom post types in the Wordpress search, and come across the following answer: Include ...
0
votes
1answer
656 views

Is this code malidcous

what does this code exactly do ?? I found a lot of similar files in a project I take responsibility of it recently >> and I don't want to delete something I'm not sure of it. I think it's malicious. ...
1
vote
0answers
21 views

my wordpress website is suspended [closed]

I've got a message from the host saying that the website was suspended due to security issues. they named a lot of files as malwares, I d've deleted all these files. I noticed that there are a lot ...

1
2 3 4 5
18