Questions tagged [security]
Strengthening themes, plugins and core installation to prevent intrusion.
855
questions
0
votes
1answer
5 views
How to secure my php forms
Please i need a security advice on how i created and is displaying my forms using php, i want to know from the security point of view if my below code is unsecured from cross scripting attacks or sql ...
-1
votes
0answers
29 views
WordPress Traffic Being Forwarded By Hack for the 5th TIME! How to fix this (I've Identified the code) [closed]
My wordpress website keeps getting its traffic HIJACKED! This is the 5th time already.
The code forwarding my visitors to spam is this:
<link rel='https://api.w.org/' href='https://train....
0
votes
0answers
4 views
Force user to change their password on the frontend at the first login and password policy
I have 3 users roles on my platform with no access to the WordPress backoffice "external_user1" , "external_user2", "external_user3".
I need to force every user with one of this roles to change his ...
0
votes
1answer
197 views
rms_unique_wp_mu_pl_fl_nm.php
What is creating this file? It's in /wp-content/mu-plugins directory. If I delete it, it comes back after a while. it contains these code:
<?php
if(!function_exists('do_rms_activation_task'))
{
...
0
votes
0answers
9 views
Securely render emojis on front-end and post to backend
I am creating a wordpress plugin which allow user to select different emojis with text. I am then making a fetch request to back end to update with selected emoji. Right now I am just rendering a ...
0
votes
0answers
12 views
Block access to all WordPress “data” outlets
I've got an issue.
I want to know all WordPress "secret" urls (so I can block them)
For examples:
Https://example.com/feed
That exposes the posts.
Is there some address that displays all tags/...
0
votes
0answers
22 views
How to restrict access to wordpress upload by specific user
I've added this to the downloads.php in woocommerce my account:
<?php
$current_user = wp_get_current_user();
$file_for_client = get_field('upload1232423', $current_user);
if( $file_for_client ) :...
1
vote
2answers
71 views
+50
Disable REST API for a user ROLE
I'm looking for a way to disable Rest API for a user role called 'external_user' (disable wp-json queries.)
This user role can see right now alot of posts and pages information with when we put wp-...
0
votes
0answers
5 views
Allow Access To Password Protected Pages Only Once
I'd like to modify the built-in password protected functionality in Wordpress to only allow the set password to be used one time. Something that either disables the password or changes it after the ...
1
vote
1answer
26 views
Load More Posts Button - AJAX
I'm trying to add Ajax to my theme so I can load my posts dynamically. The following code works but for some reason when I wrap the button that fires the loading with another div it doesn't do ...
1
vote
0answers
17 views
Should I encrypt the response that triggers an Ajax action? Is nonce sufficient?
I am trying to write a custom user registration plugin. The plugin has 5 basic functionalities
Take form data and create a user using wp_insert_iser
Once a user is created, update user meta for ...
0
votes
0answers
24 views
Word-fence Logs : should i worry for these attempts?
i saw these following lines in wordfence tools
my-site.com/mdocs-posts/?mdocs-img-preview=..%2Fwp-config.php
my-site.com/wp-admin/admin-ajax.php?action=..%2Fwp-config.php
my-site.com/wp-admin/admin-...
0
votes
1answer
19 views
Sanitize user input fields before wp_insert_post
I read how to sanitize, validate and escape text fields and I know wp_insert_post sanitizes all field using wp_kses except HTML tags.
However, I'm new to development and would like to be confirmed ...
0
votes
0answers
14 views
Wordpress website showing 'Your connection is not private' NET::ERR_CERT_COMMON_NAME_INVALID [closed]
I initially thought it was an HSTS issue but other people can access the website tho and the web host says it's working fine on their end. I've tried clearing the cache, the only thing that seemed to ...
0
votes
1answer
25 views
Decoded malware code [closed]
My wordpress site got recently hacked. Upon research I found 3 files were infected :
index.php
wp-config.php
wp-settings.php
All including this piece of code :
@include "\057h\157m\145/mywebsite/\...
0
votes
1answer
26 views
prevent anonymous access to Wordpress site (non-admin site)
I'm using WP to build a help/training portal for a commercial software product (Product X). We'd like to restrict access to this new WP site to only authenticated users of Product X as it contains ...
1
vote
1answer
16 views
password reset link being sent as HTTP?
I was just added as an admin on a WP site.
The first thing I noticed is that the "(re)set your password" link in the email starts with http://
How do I fix that? The "View Post" link in Comment ...
0
votes
1answer
14 views
Security when outputing wp_oembed_get code
This is a code I have in a function.php action.
It is responsible for getting and displaying an embed code. Typically there is a youtube link from $embed_link but it comes from a public form so it can ...
0
votes
1answer
31 views
Hiding Wordpress Plugin Source Code
I wonder if there is a way to hide a Wordpress Plugin's source code from users. I know wordpress is open source but i dont want the users be able to access and see my plugins source code if possible.
...
1
vote
1answer
17 views
How to get WordPress to send Password Reset Link Email instead of New Password?
My WordPress configuration generates a new password and sends it via email whenever a user uses Forgot Password link.
How can I make WordPress send a Reset Password link instead of a new password?
I ...
0
votes
1answer
22 views
Why does my admin email address keep changing to something random?
Every once in a while, I see an email like this:
Someone (hopefully you) has used this email to register at My Website
Username: *********
Password: *********
Thanks
My Website
I login to my ...
0
votes
0answers
28 views
Fix Potential Security Issue in Custom Taxonomy Search Functionality
I want to add some functionality to a client WordPress site that allows you to include taxonomy terms from custom post types in the Wordpress search, and come across the following answer:
Include ...
0
votes
0answers
29 views
Is this code malidcous
what does this code exactly do ??
I found a lot of similar files in a project I take responsibility of it recently >>
and I don't want to delete something I'm not sure of it.
I think it's malicious.
...
1
vote
0answers
17 views
my wordpress website is suspended [closed]
I've got a message from the host saying that the website was suspended due to security issues.
they named a lot of files as malwares, I d've deleted all these files.
I noticed that there are a lot ...
0
votes
0answers
25 views
Prevent attacks, $_POST data security, wp_strip_all_tags
When writing code that accepts input from users I always sanitize data one variable at a time.
Example:
$title = wp_strip_all_tags($_POST['title']);
$content = wp_strip_all_tags($_POST['content']);
...
0
votes
0answers
15 views
Specific Page/Post Need to Stay Non SSL
I have a website that is already SSL secured. I want to have a plugin that will give me a tick mark option to make the page/post as non-SSL. Rarely I need to use that but that is not a small amount, ...
0
votes
2answers
77 views
My Site keeps crashing due to the wp-confg file being deleted
The wp-config.php file keeps on getting deleted. Before this started to happen, extra characters would automatically appear in my database username and password which would take my website down, I'd ...
0
votes
2answers
40 views
How to find exploited wordpress plugin [closed]
Some information: Yesterday I found out that my wordpress page has been 'hacked' (for the lack of a better word). Everyone going to my page was redirected to a http://mywordpresspage.com/NetflixXXX ...
0
votes
0answers
54 views
Should I prevent access to .htaccess and wp-config.php files?
Someone at stackoverflow suggested I should deny access to the two files by doing below in .htaccess.
<files ~ "^.*\.([Hh][Tt][Aa])">
order allow,deny
deny from all
satisfy all
</files&...
0
votes
0answers
16 views
What is the benefit of logout using an nonce?
I get the purpose of nonce in general, but It seems like this particular action would be safe without an nonce. What benefit does it bring?
0
votes
1answer
18 views
WordPress Database Re-installed (Hacked)
Over the past 2 days, exactly in the hour of 8 o'clock, my WordPress blog has rendered with one sample post, as if the databases are being reinstalled. The database usually holds around 2-3 years of ...
0
votes
2answers
175 views
Strange behaviour of is_user_logged_in() and get_current_user_id()
I have an issue where is_user_logged_in() appears to alternate between being true and false.
Additionally, get_current_user_id() gives the correct user ID if is_user_logged_in() is true.
Here's my ...
0
votes
0answers
20 views
Security - Is it possible to add HTTP Authentication just to login page?
I was wondering of ways to make a Wordpress installation more secure. The site has about 20 users, does not allow new users to register, and comments are disabled.
Would it be possible to put the ...
0
votes
1answer
24 views
Could a user account with a stolen password compromised entire WP site?
Assuming a user with Subscriber role account with a weak password has been hacked. So, can someone use this account to compromise a WP site?
0
votes
0answers
26 views
Can't upload mp4 for security reasons
Never had an issue uploading mp4 files before on my wordpress site as they seem to be whitelisted by default. However, today I keep getting an error message saying there are not permitted for security ...
0
votes
2answers
14 views
Block JSON access over the net
One of my websites scan by a security firm and came up with below to block
"http://domain.com/wp-includes/sodium_compat/composer.json" access over the internet. I've tried few plugins but none of them ...
0
votes
1answer
50 views
Is it safe to use a global wp nonce per user instead of a nonce per action?
Please refer to my comments on Greg's answer for more details in relation to his answer which are also relevant to this.
I'm routing all my AJAX requests through a Controller, this is a class that ...
0
votes
0answers
11 views
Can someone do something to my website if I posted a snapped image of the header and covered my logo? (On reddit, when explaining a question)
The question is as it states. I don't want to go on reddit to ask this. Might not be the place to ask a question like this, but I am worried. After I posted my question my wordpress started acting up, ...
0
votes
0answers
14 views
How to only show page if private secure key in body of request?
I have one paid content download page in my WordPress website.
I want to make it secure by sending a pre-decided private secret key in body of request.
If that key exists in incoming request, then ...
0
votes
1answer
87 views
Blocking wp-login in HTACCESS has also blocked password protected pages
We recently blocked all IP addresses except mine and the company owner's from getting to /wp-login.php except today we discovered this has inadvertently blocked any other password protected page. By ...
0
votes
0answers
29 views
$.ajax results in 403 forbidden
I am trying to fetch debug information from a piece of javascript, to make it easier to copy the debug information code (if find my self often doing this). However, when I send a request to a page, ...
0
votes
1answer
40 views
Custom API plugin to execute 3rd party API to retrieve data
I am new to WordPress here.
I have this request where I need to create a custom REST API plugin where when user triggers the following URL link:
www.example.com/wp-json/v1/getCoupon/123456?CouponID=...
0
votes
0answers
14 views
risks on hosting wordpress - with the wrong configuration
are there any risks on hosting wordpress - with the wrong configuration
you will notice upgrades request FTP or FTPS credentials as the server
itself does not typically have write access in ...
0
votes
1answer
115 views
How do I have now a duplicated user entry if this is not allowed (and I cannot replicate it)?
In my website I have users registering with the email as the username
If I try to manually add a new user and I use a username (which is a mail) that already exists, WP complains and tells me that ...
1
vote
2answers
46 views
How to save iframe tag into a post?
I've noticed that when I embed an iframe into a post then save the update, the iframe will not be saved. It seems to be a security feature, but how can I embed the iframe anyway? and set it to accept ...
1
vote
0answers
50 views
Wordpress Content Security Policy and Subresource Integrity
I have tested my website at https://observatory.mozilla.org/ and I receive the following two errors:
Content Security Policy -25 Content Security Policy (CSP) header not implemented
Subresource ...
1
vote
0answers
26 views
Are there mutiple ways to get usernames (as a hacker)
I built a new site and forgot to protect against the "?author=n" technique. I had 2fa on all accounts so no hacker got access to the site's admin.
I've since fixed that security issue. Is there ...
0
votes
0answers
24 views
Is a global nonce a bad idea?
I'm trying to build a central system that will delegate certain functionality and serve me some nice things when dealing with AJAX calls. Basically, I want to dumb the whole charade of checking ...
1
vote
1answer
52 views
How To Clean The Malware Infected & Hacked WordPress Websites? [duplicate]
I have some websites build with WordPress. My sites are affected by Malware programs and Hacked by someone frequently. Finally got a solution to stop this issue.
I create this post for share my tips ...
0
votes
5answers
342 views
wp-config.php being written by attacker
I have an up-to-date Wordpress install, and I've tried to do due diligence when it comes to security. However I'm having a recurring problem.
I've put my config at the level above my install location....
