Skip to main content

Questions tagged [security]

Strengthening themes, plugins and core installation to prevent intrusion.

Filter by
Sorted by
Tagged with
0 votes
0 answers
32 views

WordPress.Security.NonceVerification.Recommended

I am trying to program my first wordpress plugin. It works quite well so far, but I get some warnings when checking my plugin with Plugin Check (PCP). These are: Zeile Spalte Typ Code ...
DerWebfuchsde's user avatar
0 votes
0 answers
16 views

CF7 for radio buttons only, ok?

I want to use Contact Form 7 only to use the radio buttons, so this form doesn't need to be send. That mean no submit button. There is a javascript to display content when a radio button is selected. ...
Carlos's user avatar
  • 101
0 votes
1 answer
56 views

How to add a nonce check correctly to this specific code?

Here's what I have so far: add_action( 'wp_ajax_test_process', 'test_process' ); function test_process( $data ) { if ( !is_user_logged_in() ) { return; } if ( !current_user_can( '...
WPdummy's user avatar
  • 23
1 vote
1 answer
87 views

Which WP-CLI commands can be safely run with --allow-root flag?

Over the past several years, WP-CLI has become pretty popular, but there's still a lot of warnings about the --allow-root flag for security reasons, and instead developers are urged to use non-root ...
Jesse Nickles's user avatar
1 vote
0 answers
19 views

nonce_user_logged_out to assign guests unique nonces breaks ajax calls

I've been researching implementing unique guest nonces via nonce_user_logged_out - for reference. So far I can generate nonces for the random UID I create: add_filter( 'nonce_user_logged_out', '...
ghosted's user avatar
  • 11
0 votes
1 answer
35 views

Secure way to add JS Script to Wordpress filesystem

EDIT: Because of the answers below i changed the title and explanation for this question. Maybe there are other people who struggle with saftey questions, like me. I am a beginner with Wordpress ...
LovinQuaQua's user avatar
1 vote
1 answer
26 views

Verify Cryptographic Authenticity after Downloading Releases (Signatures)

How can I verify the authenticity of a wordpress release after downloading it? I tried to securely download wordpress today, but I didn’t find any information on the page about how I can verify that ...
Michael Altfield's user avatar
0 votes
0 answers
27 views

How to stop a nonce from being cached in an inline script, or alternatives to regenerate it if expired?

I have an inline script that gets added into some WordPress pages which fires an AJAX request. We pass a nonce in that script, when using full page caching that nonce might have expired and therefore ...
bigdaveygeorge's user avatar
1 vote
0 answers
60 views

Code Snippets security when selecting "only run on front end"

As I understand the functions.php only runs on the server and its source code is not provided to the browser on the client's side. Additionally, Code Snippets plug-in, assuming previous security ...
Anonymous's user avatar
0 votes
2 answers
339 views

Fix CVE-2017-5487 vulnerability

I have a website which is running Wordpress 6.4.2. Today I received a warning from the hosting service that my website is affected by the CVE-2017-5487 vulnerability, and that I have to do something ...
user171780's user avatar
1 vote
1 answer
169 views

How does the security of admin_ajax.php work?

I have never done any Wordpress development and have no experience at all with the technical architecture of Wordpress. I am self hosting a Wordpress instance and am investigating a recent attack on ...
cdauth's user avatar
  • 121
0 votes
1 answer
197 views

Successful password resets and suspicious scripts on my Wordpress instance

On 2 Wordpress instances that I'm hosting, I've seen several password reset requests on 3 different accounts in the last days, some of which were successful, even though I am sure that the reset link ...
cdauth's user avatar
  • 121
0 votes
2 answers
87 views

Security headers disappear on Wordpress pages

I am facing a problem that both me and my host support team were unable to untangle. I have included security headers in my .htaccess file (see below), but I get inconsistent results: All the headers ...
AnalysisStudent0414's user avatar
0 votes
1 answer
328 views

Unknown phantom user "wordpress" created with admin privileges

We've been seeing a user created out of nowhere named "wordpress" every so often, with most of our wordpress sites on a couple Ubuntu 20 servers. I run a quick audit across our server using ...
blueionRich's user avatar
1 vote
1 answer
71 views

How can I find out exactly what Google is finding 'Deceptive' about my WordPress site?

I recently stood up a WordPress site in a Docker container and enabled https with Let's Encrypt. Everything seems ok from an https standpoint. Then I registered the site with Google Search Console, ...
Marcus's user avatar
  • 113
0 votes
0 answers
91 views

User can see and enter the Wordpress Admin without login

I have some users reporting to me that they can see the admin bar and also they can enter the admin panel of the website without login in. I'm not sure how this is possible and I'm trying to find a ...
Paulo Brás's user avatar
0 votes
0 answers
16 views

Disable themes.php except for network admin username

How to remove and disable the admin menu item: Appearance > Themes for regular admin. Only allowing Appearance > Themes: If you are logged in as multisite admin. The regular admin can not change ...
Angel Hess's user avatar
0 votes
0 answers
35 views

Wordpress EC2 Security Practices

I started working for a client about 3 months ago. They have wordpress running on EC2 instance and no security/monitoring at all. We have about 8 users and 3 active. Recently 2 users reported some ...
user20719's user avatar
  • 101
1 vote
1 answer
106 views

Why is this line of code Wrong in every Wordpress .Htaccess security article?

The following line of code (RegEx) is partly wrong in every Wordpress .Htaccess hardening article I've seen. Why is that? <FilesMatch "^.*(error_log|wp-config\.php|php.ini|\.[hH][tT][aApP].*)$&...
Yahya Tarjuman's user avatar
0 votes
0 answers
28 views

Encrypt User last name in wordpress for security reasons

Can Anyone help me to encrypt only the user's last name in WordPress? I only want to encrypt user's last name in the database for some security reasons. I am unable to find the solution Please let me ...
Kunal Verma's user avatar
0 votes
1 answer
92 views

Content Security Policy blocking images from installed plugins' popup info window, as they are from external domains - global fix?

I have Content Security Policy added to my WordPress site via Header set in .htaccess, and just found if I am on the WordPress plugins admin page (/wp-admin/plugins.php), and click "View Details&...
Ben Blue's user avatar
  • 117
0 votes
0 answers
29 views

Bullet proofing a server with 150 WP insallations

We have about 150 active blogs we are serving our clients and the maintenance is getting to the point where it's not going to be profitable. In order to save space and maint costs, I've symlinked the ...
Zak's user avatar
  • 113
2 votes
0 answers
42 views

How to protect content from public users and limit access to certain roles in WordPress 2023?

There are hundreds of content protection plugins and role managers, however in my current case I need a custom solution. The customer wants that only "logged in users" are to be able to read ...
Blackbam's user avatar
  • 545
0 votes
1 answer
71 views

(How) does WordPress protect direct access of user data?

I am setting up a WordPress with a user system. User information (names, profile picture) of all users should be private, and only accessable when logged in. The "Ultimate Member" plugin ...
M.G.Poirot's user avatar
0 votes
0 answers
121 views

How to address security vulnerabilities: LUCKY13, BEAST, and BREACH

A client sent in an urgent request to resolve 3 vulnerabilities: LUCKY13, BEAST, BREACH. I don't have any more information other than they exist, and I don't really know how to address them. My first ...
Jillian Hoenig's user avatar
0 votes
1 answer
217 views

wp-salt.php and wp-cli.yml File present in public_html folder

Few hours back I was trying to login into my wordpress website, but it gave the error - Incorrect Password. So, I ran a scan on my wordpress website with the command - "wp core verify-checksums&...
user232316's user avatar
0 votes
1 answer
161 views

how to sanitizing $_POST with the correct way?

I am trying to sanitize and validate and escape this code? $positions = $_POST['positions']; foreach ($positions as $key => $position) { $id = sanitize_text_field($position[0]); ...
crazybuilding's user avatar
0 votes
0 answers
21 views

WordPress User Registration/ Sign Up -> Able to take Paid Certification Courses & keep track of Completed Certificates

I'm really new to WordPress and been tasked with this assignment and not sure how to tackle it. So we have a WordPress site and we plan on using the Masteriyo plugin to create and sell online ...
SparklingLemonWater's user avatar
3 votes
1 answer
239 views

Which php files, in a WordPress setup, do not need direct web access?

Many php files in a WordPress installation are only used through require() or include(). Leaving them exposed to direct web access may increase security risks. Files such as wp-config.php has no need ...
capodieci's user avatar
0 votes
1 answer
155 views

Block Root REST API Route using custom &/or iThemes

I'm looking to block the following REST API Routes /wp-json/ & /wp-json/v2/users/ I have iThemes currently installed that handles the users route, but would prefer to block the root route also. ...
WilsonP's user avatar
1 vote
1 answer
1k views

esc_url, esc_url_raw or sanitize_url?

I know there's already this post here but its answers still leave me in the dark about these three methods. I'm a little confused by the selection of one of the methods mentioned in the title, if I ...
DevelJoe's user avatar
  • 497
0 votes
1 answer
35 views

Should we escape the values of constants?

In my theme folder, I store my constants in a file called constants.php. But when we use the constant, should we escape it like esc_html__('This is '. CONSTANT_A, 'text-domain'); I was wondering if a ...
ratib90486's user avatar
1 vote
0 answers
990 views

is exposed wp-admin site a serious security vulnerability

this is a basic question that i was unable to wrap my head around via chat gpt or google, namely is it a serious security vulnerability for a wordpress site to have publicly available wp-admin (login ...
pawelek69420's user avatar
0 votes
2 answers
945 views

Can you alter the default wordpress strong password requirements?

Does anyone know if you can override the default wordpress password strength expectations? We just did a migration from an old system that has a different encryption. We will need to have all users ...
Kai Qing's user avatar
  • 131
0 votes
0 answers
27 views

Wordpress - tracking options

I wanted to ask, how much is it possible to track users when using WP as a CMS. For example, can I see, when users go to certain directories like wp/files or open specific documents like wp/files/docs/...
Mel's user avatar
  • 1
1 vote
0 answers
103 views

Impossible to update jQuery version from 3.1.0

PageSpeed Insights is complaining about me using jQuery version 3.1.0 because of security risks. I've been trying to update my jQuery version with two plugins: jQuery Updater jQuery Version Control ...
Fernando Redondo's user avatar
3 votes
1 answer
590 views

How to find source of these strange SQL queries?

I'm looking at my slow queries and i don't understand how some bot or person is doing them. They look like this: (i copy/paste them no placeholders!) SELECT post_id FROM wp_postmeta, wp_posts WHERE ID ...
Michael Rogers's user avatar
1 vote
1 answer
398 views

How to securely set dynamic HTML content with JavaScript?

Description I have implemented a frontend script that gets a few text options from the server via wp_add_inline_script. When the user does an action the content should dynamically change to one of the ...
Josef Wittmann's user avatar
3 votes
1 answer
843 views

Is my Wordpress site handing out sensitive information/misconfigured?

This HNQ answer seems to imply that the URL path /?rest_route=/wp/v2/users/ may be displaying information that is sensitive, and that perhaps there is some misconfiguration that allows WordPress to ...
Hannah Vernon's user avatar
0 votes
1 answer
259 views

How to rename files during upload to a random string?

I want my files being renamed automatically on upload to a random number that does not interfere with other random named files. I am new to PHP and do not want to change a code snippet every year to ...
WordPress1290412's user avatar
0 votes
0 answers
86 views

How to parse an image that was just uploaded to make sure it doesn't contain malicious code?

Let's assume that an user has just uploaded an image. How do we make sure that the image doesn't contain hidden PHP code that will run once the image is on the server? The most common (and, for ...
Mark Robinson's user avatar
0 votes
0 answers
270 views

Hide plugins and theme from public

I like to hide all or some of my plugins and themes and CMS from public such that the users cannot detect which plugins/themes/CMS I used to build my website. Please let me know if it is possible to ...
asad's user avatar
  • 103
1 vote
2 answers
662 views

Prevent direct access to Wordpress plugin assets?

I was wondering if there was a simple way to prevent direct access to asset files within a WordPress plugin. Primarily javascript files. I'm developing a plugin that's meant to be used only in the ...
Dan's user avatar
  • 315
0 votes
1 answer
35 views

How can i ensure that SQL statements are not displayed if an enduser types the wrong variable name in the URL

My question is similar to this. It is about security of my wordpress site which has custom pages that call variables on the url. An example of my url looks like this: https://mysitevvv.ke/mysite1/...
Alex Maina's user avatar
1 vote
1 answer
33 views

Restrict Access without Creating Users

I'm building a plugin which receives quote data form a third party api and uses it generate a post of type 'quote' which, on the front end, comprises an acf_form which the customer is required to fill ...
Kevin Nugent's user avatar
0 votes
1 answer
155 views

reCaptcha doesnt appear in comment (manual or plugin)

I tried the following: https://www.quora.com/How-can-I-insert-Captcha-code-in-WordPress-theme-without-using-any-plugin https://codeforgeek.com/add-google-recaptcha-wordpress/ https://pluginsforwp.com/...
Axil's user avatar
  • 61
0 votes
0 answers
38 views

Wordpress search shows protected content

I have noticed many times that WordPress search results reveal protected/locked content. Is it a security issue or do search results show the webpage as viewed by the admin? Sometimes, the content of ...
david's user avatar
  • 1
0 votes
1 answer
300 views

404/500 error on content images if Referer header is from another domain [closed]

Not very familiar with WordPress so I'm not sure what's causing this. Essentially, we have a few image assets stored under wp-content. When we access some assets (i.e. cmssubdomain.apex.com/wp-content/...
AnimaSola's user avatar
  • 113
1 vote
1 answer
114 views

Escape when echoed

I've been trying to submit a plugin for review and I keep having problems with the echo line. The last version I sent was like this. <option value=""> <?php _e( '- Default', ...
choseɳ's user avatar
  • 17
0 votes
1 answer
953 views

How to correctly escape an echo

In WordPress they recommend that I should escape any part of the code of my plugin that shows data to the user, I have made most of the corrections but this specific case I don't know how to escape ...
choseɳ's user avatar
  • 17

1
2 3 4 5
20