Questions tagged [security]
Strengthening themes, plugins and core installation to prevent intrusion.
822
questions
0
votes
0answers
14 views
How to only show page if private secure key in body of request?
I have one paid content download page in my WordPress website.
I want to make it secure by sending a pre-decided private secret key in body of request.
If that key exists in incoming request, then ...
0
votes
1answer
27 views
Blocking wp-login in HTACCESS has also blocked password protected pages
We recently blocked all IP addresses except mine and the company owner's from getting to /wp-login.php except today we discovered this has inadvertently blocked any other password protected page. By ...
0
votes
0answers
9 views
Fetch debug information from WPML in $.ajax results in 403 forbidden
I am trying to fetch debug information from a piece of javascript, to make it easier to copy the debug information code (if find my self often doing this). However, when I send a request to a page, ...
0
votes
1answer
17 views
Custom API plugin to execute 3rd party API to retrieve data
I am new to WordPress here.
I have this request where I need to create a custom REST API plugin where when user triggers the following URL link:
www.example.com/wp-json/v1/getCoupon/123456?CouponID=...
0
votes
3answers
75 views
Wordpress malware keeps creating .ico files that are actually malicious php files. How to clean? [closed]
The .ico files contain obfuscated code. This malware also creates 8 letter php files with random names like hzgt33ez.php that also have obfuscated code. A scanner has identified those as backdoors. ...
0
votes
0answers
10 views
risks on hosting wordpress - with the wrong configuration
are there any risks on hosting wordpress - with the wrong configuration
you will notice upgrades request FTP or FTPS credentials as the server
itself does not typically have write access in ...
0
votes
1answer
35 views
How do I have now a duplicated user entry if this is not allowed (and I cannot replicate it)?
In my website I have users registering with the email as the username
If I try to manually add a new user and I use a username (which is a mail) that already exists, WP complains and tells me that ...
1
vote
2answers
26 views
How to save iframe tag into a post?
I've noticed that when I embed an iframe into a post then save the update, the iframe will not be saved. It seems to be a security feature, but how can I embed the iframe anyway? and set it to accept ...
1
vote
0answers
26 views
Wordpress Content Security Policy and Subresource Integrity
I have tested my website at https://observatory.mozilla.org/ and I receive the following two errors:
Content Security Policy -25 Content Security Policy (CSP) header not implemented
Subresource ...
1
vote
0answers
24 views
Are there mutiple ways to get usernames (as a hacker)
I built a new site and forgot to protect against the "?author=n" technique. I had 2fa on all accounts so no hacker got access to the site's admin.
I've since fixed that security issue. Is there ...
0
votes
0answers
15 views
Is a global nonce a bad idea?
I'm trying to build a central system that will delegate certain functionality and serve me some nice things when dealing with AJAX calls. Basically, I want to dumb the whole charade of checking ...
1
vote
1answer
31 views
How To Clean The Malware Infected & Hacked WordPress Websites? [duplicate]
I have some websites build with WordPress. My sites are affected by Malware programs and Hacked by someone frequently. Finally got a solution to stop this issue.
I create this post for share my tips ...
0
votes
5answers
118 views
wp-config.php being written by attacker
I have an up-to-date Wordpress install, and I've tried to do due diligence when it comes to security. However I'm having a recurring problem.
I've put my config at the level above my install location....
2
votes
1answer
30 views
Blocking access to wp-login via htaccess not working
Some time ago I installed the Limit Login Attempts Reloaded plugin and it's working fine.
However because I was getting SO many unauthorized login attempts I also implemented an .htaccess password ...
0
votes
0answers
53 views
Basic Auth .htaccess on wp-login, but allow logout from woocommerce
I use a .htaccess basic auth on my WC site to help prevent hackers accessing wp-login, which works well... except with WooCommerce if a logged in customer wants to logout from their account - upon ...
0
votes
0answers
18 views
whether a nonce is required for get type and get_query_var?
I have a front form that allows filtering. I think I need a nonce but I am not sure to use it or not.
I use the get_query_var method to modify the main query. It uses a get method.
whether a nonce is ...
0
votes
0answers
21 views
How to invalidate `password reset key` after being used
I am trying to write my own lost password plugin. It is working perfectly. But how can I invalidate the reset key after being used once. Currently I am able to set new password as many times as I wish ...
2
votes
1answer
26 views
When is it useful to use wp_verify_nonce
I know that wp_verify_nonce() is used to make sure that the $_POST is coming from a safe place.
I am developing a WordPress plugin which creates custom lists. In order to do that the web site owner ...
0
votes
0answers
11 views
Cleartext Authentication on WooCommerce
A PCI Compliance scan has warned that forms are using cleartext authentication. The site has SSL installed.
I believe that the forms are from WooCommerce. We're not using any plugins that should be ...
0
votes
0answers
34 views
Bing/msn bots is heavily requesting random of my website
I am facing a big problem with my server. I have a website that keeps getting massive page requests coming from "Bing/Msn" bot every second or two and the ip changes now and then. Which is putting a ...
1
vote
1answer
120 views
Sanitize get_query_var() url parameters
I am currently working on a site and testing its security. One of the pages has a sort feature where I pass a url parameter on how I would like the content sorted.
For example:
www.example.com/page/?...
0
votes
0answers
20 views
WP Snippet to Hide Theme Editor In Dashboard Only Works On LocalHost Site
I want to remove the Theme Editor in the WP Dashboard that is located under Dashboard > Appearance > Theme Editor. The code I'm using in my config.php file in the root of my site is :
define('...
1
vote
0answers
24 views
Malware script in database post table only? [closed]
How can java script be visible in phpmyadmin posts but not visible within the wordpress environment??
Been struggling to clean a wordpress site after an annoying hack which popsup ads and redirects.
...
1
vote
0answers
37 views
Standard Fail2Ban vs. WP Fail2ban vs. WP Fail2Ban Redux
I am working on revamping my wordpress site security, hosted via cloudways. Cloudways is generally great. I was working on installing WP Fail2Ban Redux: https://wordpress.org/plugins/wp-fail2ban-redux/...
0
votes
0answers
45 views
Site infected by link
my store (woocommerce) is blocked by anti-viruses. I found that the following link is added to the footer without my knowledge:
<script src = "// minisrclink.cool/1e40c8bd4601a5a5a4.js" async = ""...
-1
votes
1answer
46 views
Run a security scan on WordPress site that has .htaccess password [closed]
Firstly, I don't know the correct term for what this password thing is. I think it's just a line in .htaccess, that prevents bots or unauthorized access to a staging environment, but it also breaks ...
-1
votes
1answer
23 views
Secure a WordPress website in 2019: one plugin or a combinations of them?
How do you guys work now days regarding WordPress and security?
Do you use plugins or you manually edit the core files to prevent attacks?
Out there there are really good plugins solutions, but for ...
0
votes
0answers
23 views
Why are HTML tags limited in comment section?
I see that HTML tags are limited in comment section. Is there a reason for this? What could go wrong if more are allowed? For example, the table, heading, image and list tags.
FYI: Expanding the ...
0
votes
0answers
27 views
Does wp_verify_nonce check ajax form referrer url?
I have a form "accept request" that is displayed conditionally when the accepter clicks on a unique link that was sent via email from the sender.
?>
<form id ="accept" action="<?php echo ...
0
votes
1answer
23 views
Should I worry about SQL injection when using REST API?
Should I worry about SQL injection when using REST API and sql queries via $wpdb?
For example, is the bellow vulnerable to sql injection?
public static function get_post( WP_REST_Request $request ) ...
0
votes
0answers
25 views
How do I make secure API calls from my Wordpress plugin?
I've stumbled upon this problem which I just can't seem to figure out..
I am currently in the midst of developing my own Wordpress plugin.
The plugin I'm building serves as a dashboard interface that ...
-1
votes
2answers
23 views
Correct setup to block file modifications from hackers
Recently I got my website compromised so I cleaned it and enforce security. Among other things I've installed wordfence plugin that now scans everything in my worpdress installation, searched for the ...
0
votes
1answer
45 views
esc_attr() on hard coded string
I am going through some example code from the codex for creating a widget (https://codex.wordpress.org/Widgets_API) . Below is the code for creating a label and input field for an admin widget form :
...
0
votes
1answer
41 views
Any any insecure http:// URLs left in wordpress?
Just about everything should be https now.
I just examined the 5.2.3 php files (844 files with 365741 non-blank lines -- yikes!!) and found several references that might be real. I say "might" be ...
0
votes
1answer
90 views
How to deal with Slow HTTP POST (slowloris) vulnerability
I'm using WordPress Version 5.2.2
I've been asked to implement changes highlighted as required by a security scan, the problem is I have little access (none in fact I think) to the webserver ...
0
votes
0answers
25 views
Problem with permalinks getting reset
I'm having a problem with a website I recently published (aimga.ca). I did all of the development work on a test subdomain and everything was working ok. Then I backed up the existing site that was ...
1
vote
0answers
58 views
disable site_url redirect in wp-login.php
I'm running a wordpress install on nginx, and I'm looking at novel ways of securing wp-admin. I know theres more than one way to do this (e.g. adding an http basic auth layer, login lockdown, 2FA, etc....
0
votes
0answers
47 views
How critical are Underscore.min.js, wp-auth-check.min.js, heartbeat.min.js and jquery.js if blocked by CSP?
The following files are blocked from loading when the following CSP is implemented.
Header set Content-Security-Policy default-src 'self' 'unsafe-inline' https://fonts.googleapis.com; script-src '...
2
votes
1answer
982 views
How to remove javascript malware in wordpress site [closed]
This is my site - (redacted site URL with malware from an XSS exploit - for security reasons)
I created this website in wordpress and suddenly realized malware in my site after google ads stopped and ...
0
votes
0answers
337 views
Restricting access to WordPress's REST API to localhost
In reviewing the WordPress REST API documentation, it's my understanding that the endpoints are publicly access thus when accessing www.domain.com/wp-json for example, it exposes the JSON construct ...
0
votes
0answers
17 views
check_ajax_reffer not working when logged
When I'm logged, the code works perfect, but if no logged, check_ajax_reffer fails.
First, pass ajax_url and nonce's':
wp_localize_script( $this->plugin_name, 'ajax_object',
array( '...
0
votes
1answer
27 views
Safety side of storing emoji into database
I am storing emojis into a custom table and querying the content using wpdb variable.
The database charset is utf8mb4 and collation is utf8mb4_general_ci
Emoji are stored as it is as the user enters ...
2
votes
1answer
23 views
Restrictive File Permissions
What are the most restrictive file permissions I should use if I do not intend to use any of WordPress's auto updating functionality. All the recommendations I find online assume you want WordPress ...
0
votes
1answer
81 views
Using htaccess to prevent spam through wp-comments-post.php
I have a lot of spam comments being posted on my WordPress site. It is being posted using the wp-comments-post.php file. I can see from the logs:
"POST /wp/wp-comments-post.php HTTP/1.0" 302 3744 "...
0
votes
0answers
68 views
“Fire Secure” menu item
I've got a strange menu item in a Wordpress instalation:
"Fire Secure"
If I click in this item, I got an error:
plugins.php?action=activate&plugin=&plugin_status=&paged=&s&...
0
votes
0answers
33 views
Add custom security question to custom login form
I wonder if someone who knows this with security can help me out? I got a custom made login form (template and functions.php) to which I need to add a security question that I can modify directly ...
0
votes
0answers
8 views
how to find only more then 1 value in array if $_POST['data'] is post 5 or more array length if value found then stop cheking & return true
how to I check only which value is in database, I mean i have array of 4 but in database only two values and i post 2 value from array and other field blank or array if these two values found in array ...
3
votes
2answers
131 views
Nonce in settings API with tabbed navigation
I'm rewording this because, as it's correctly been pointed out, the original post was "woefully inadequate." I made a plugin which has tabbed views for the various settings. It's based on this ...
0
votes
0answers
24 views
how to add security questions on wp-registration page and validate it
I wanted to validate security questions which show's on wp-login page validation is if answers are blank user cant login and if user register with 2 questions and admin change no. question show on ...
0
votes
0answers
15 views
Security in Wordpress, better to edit pre_gets_post or protect single pages?
I am making a website where user must register and when they are logged in they must complete the profile informations with other infos before they can access the content.
I wrote this function
...
