Questions tagged [security]

Strengthening themes, plugins and core installation to prevent intrusion.

Filter by
Sorted by
Tagged with
0
votes
0answers
14 views

How to enable wp-admin and wp-login only over highport

For security reasons we want to make our Wordpress login over wp-admin and wp-login only available over highport. We have a multisite-installation (with two websites). On the internet I didn't found ...
1
vote
1answer
59 views

Can I write 'RewriteCond' using 'functions.php'?

I want to add 'rewrite condition' in .htcaccess but unfortunately I don't have access of that. Can I write conditions in functions.php ? If yes, how to achieve that ? I want to add these lines: ...
0
votes
0answers
16 views

Website getting 100+ brute force attacks in 6 hours

Last night a website I built got 100+ brute force attack. All of them trough xmlrpc.php I use iThemes Security and I just blocked the access to xmlrpc.php as this website does not actually needs it. ...
0
votes
1answer
26 views

Validating ajax search

Is there a way to prevent user from entering <img src=x onerror=alert(test)> script tag to the form? My current search page is using ajax to load search result upon entering on the input field. ...
0
votes
0answers
54 views

Content-Security-Policy implementation with WordPress W3Total Cache plugin installed

Documentation about this says to avoid inline script and css Error: Refused to execute inline script because it violates the following Content Security Policy directive: What I have used so far: ...
0
votes
1answer
16 views

Password minimum length in personal subscription [closed]

I have a personal registration area. I already have a condition to check that the password and the password confirmation are identical. I wanted to add a condition to check that the password does not ...
1
vote
1answer
40 views

XMLRPC filtering through htaccess not working

My websites are hosted on a shared instance. They face regular xmlrpc DDoS. I've tried to put in place several mitigation practices to block those attacks : Installed a dedicated extension that ...
0
votes
0answers
24 views

Validate nonce with post ID in AJAX

I'm trying to create a nonce in an AJAX form where I can pass in a post ID. Then, validate it of course. I want to confirm that if the action is intended, but also the post ID so someone cannot just ...
0
votes
1answer
27 views

echo cutom css code to Wordpress page template file ? is this safe?

I created wordpress page template and i want to add this css code only in to inside of this template only.for the security concern should i escape?. can anyone help me to solve this?. here is the ...
0
votes
3answers
166 views

WordPress sites being filled with random PHP files

Two weeks ago when I tried to access one of my WordPress sites through the browser, I was redirected to an ad page. I went inside of the public_html directory and found tons of PHP files with random ...
0
votes
0answers
46 views

After limiting the access to my wp-login.php by IP through .htaccess, all my password-protected posts stopped working. What's the best solution now?

To avoid brute force and illegal access to my WordPress website, I've limited the access to the wp-login.php script by IP addresses, using the .htaccess file. In other words, only certain IPs can ...
1
vote
1answer
305 views

How to force Authentication on REST API for Password protected page using custom table and fetch() without Plugin

I am implementing the REST API with fetch() promises as requests on a Password protected page with a custom table without using a plugin (only using the WP REST API that has been merged into WordPress ...
1
vote
0answers
151 views

Frequently getting attacks on admin-ajax.php, wp-cron.php, xmlrpc.php and wp-login.php

I am running more than 500 WordPress website in my shared server, Frequently I am getting attacks on admin-ajax.php, wp-cron.php, xmlrpc.php and wp-login.php files. Due to that our server load is ...
1
vote
0answers
31 views

SQL Injection blocked by firewall

I have a WordPress site that is guarded by firewall. Today I got a notification of blocked SQL injection. I cannot understand what the hacker is trying to do with the query: https://example.com/?p=121%...
2
votes
3answers
422 views

Using "wordpress_logged_in" to restrict direct access to uploads folder in 2021

I am looking at ways to restrict direct access to the Wordpress Uploads folder. I've read a handful of Stackoverflow and blog posts about using "wordpress_logged_in" in .htaccess to check if ...
0
votes
0answers
82 views

What are the best practices to achieve cross-domain interoperability and transparency in aggregate data through a uniform, hashed user naming schema?

The following plugin was just presented at the special session on data provenance to amend NSA's hard problems during the Hot Topics on Science of Security (HoTSoS) symposium. I'm looking for peer ...
0
votes
0answers
10 views

how check user roles with most security

hello everyone i want to check user roles for my custom theme . users according to their roles have different accessibility to site . i check their roles with this code ,I'm worried I did something ...
0
votes
0answers
23 views

HTML Elements in my WP Plugin being generated in JS. Security and Translated Text Question about this method being used

So unfortunately when developing my WP plugin I created some methods that will help me generate HTML elements and their attributes with document.createElement. One example function is provided below. (...
1
vote
1answer
29 views

Should I disable directory listing for wp-includes?

This is more of a personal question for my own curiosity. One of my websites appears to be vulnerable because the directory listing (/wp-includes) is enabled. It’s not difficult to fix, however I’m ...
3
votes
3answers
349 views

Does WordPress sanitize arguments to WP_Query?

This is a very straight-forward question, but it's important and I can't find anything definitive in the docs. This question asks a similar question for the 's' parameter, specifically. I want to know ...
0
votes
1answer
31 views

How to protect a script execution on Wordpress?

Recently I have created a script to update records on my Wordpress database. I basically use wpdb to connect to another database, grap some records, and update the Wordpress database. Using only ...
1
vote
1answer
107 views

Should you escape hardcoded URLs?

I'm writing a very simple social share plugin for a client. I'm using these two functions to display the share buttons at the bottom of each post: <?php /** * Social buttons */ function ...
2
votes
1answer
65 views

Sanitizing comments or escaping comment_text()

I'm creating a template for comments on my WordPress site. I noticed that a simple <script>alert(1);</script> slips through the default WP codex implementation of comments, using the ...
0
votes
1answer
81 views

How to add API security keys into JS of wordpress securely

I am using wp_localize_script() to add variables from my config.ini file to my inline JS code (inside HTML block element of Elementor) [Please see this for reference] But this method is unsafe to add ...
0
votes
0answers
28 views

HSTS header not being added correctly

I've added the following code to my child theme's functions.php in order to add a HSTS header to my website: function tg_enable_strict_transport_security_hsts_header_wordpress() { header( 'Strict-...
0
votes
0answers
252 views

WP SiteHealth check reports "The REST API encountered an unexpected result". Where to setup SSL *client* cert for *internal* WP use?

I'm running WP 5.7 on Linux. It's an Nginx server. I'm setting up an internal site with policy that requires all services using SSL client cert verification enabled. The WP host listener has ssl ...
0
votes
1answer
20 views

Input sanitation

I have a question regarding a wordpress site I have recently developed for a client. I have only until now developed a site for small clients that just require personal websites, however this client ...
0
votes
2answers
570 views

Is it Ok to restrict Access-Control-Allow-Origin for /wp-json requests?

I've been tasked with managing a WordPress site that was developed and configured by some other team. During a basic security scan, I've realized that the following end-point https://www.mywordpress....
1
vote
1answer
25 views

How to prevent XSS alter custom global javascript object & methods in Wordpress

Im working on a project in Wordpress that enqueues multiple .js files where each file adds a new method to a global javascript object, this in order to make the desired methods available only if ...
0
votes
1answer
43 views

Is it unsafe to put php in the /wp-content/uploads directory?

Pretty straight forward question, but I'll provide any clarifications needed. The reason I'm asking is this: I created a child theme that pulls in a custom-functions.php file. This allows devs to ...
0
votes
0answers
7 views

Is it possible to limit access to login/forget password by countries?

I know we can limit people accessing the wordpress by countries but is it possible to limit access on wp-login.php and forgetpassword links? I see a lot of script trying to access wp-login.php or any ...
0
votes
1answer
24 views

Vulnerability Concern From the Plugin or From Not Updating the Plugin?

Our company website has over 40 plugins. That is a lot...way too many. However, each plugin serves a purpose. When updating all plugins to the recent version we noticed parts of the website break. ...
0
votes
0answers
19 views

How and why use validate_username and how to secure inputs fields of registration form?

I would use validate_username to protect username and other inputs from tags, octet, and others filters and conditions from sanitize_user but these functions only remove these dangerous chars and does ...
1
vote
1answer
180 views

.htaccess rules for blocking bots with an extra condition

I have a WP multisite installed. I am integrated with Ezoic and Cloudflare. I had implemented firewall rules. However, I have an issue blocking bots that have X-Middleton in the User-Agent, because my ...
0
votes
1answer
45 views

sanitize_post() is not sanitizing Post Object

I wanted to sanitize a WP_Query post object without using foreach. I used this method: $args = array( // ... ) $data = array(); $the_query = new WP_Query($args); $data["post"] = $the_query-...
0
votes
0answers
7 views

Adjusting Prevent Concurrent Logins plugin to refresh the pages of older sessions

Is it possible to adjust the "Prevent Concurrent Logins" plugin to refresh "old sessions" browsers right after the "new sessions" logs in? The plugin works currently fine ...
0
votes
0answers
28 views

Blacklisting jwt after logout in wordpress

I need to blacklist jwt after logout. Does anyone implemented it in in wordpress and could share his approach? What I’ve thought of is storing blacklisted user jwt in user meta (value and expiration ...
0
votes
1answer
130 views

wp_nonce vs jwt

I’ve recently added jwt authentication to my website because frontend of my site is completely decoupled from backend. What I haven’t thought of is that I could use wp_nonce instead of jwt - create ...
0
votes
1answer
287 views

Why does check_ajax_referer give a 403 error on https websites?

When I write an ajax funtion on a site without SSL, check_ajax_referer works as intended. But it fails with a 403 forbidden error on a https site. I've tried a lot of times, but I just don't know why ...
1
vote
0answers
28 views

How to block plugin activations with no known user or coming from unknown IP address range?

I have received a Sucuri alert for an unauthorized plugin activation: Event: Plugin Activated Website: http://www.XXXXXX.XXX IP Address: XXX.XXX.XXX.XXX Reverse IP: XXXXXX.XXXXXX.XXXX Date/Time: 7 ...
1
vote
1answer
46 views

Nonce failing on form submission

I'm updating some code in one of my WordPress plugins by adding a nonce to improve security. The plugin that has a form that generates some output that the user can copy and paste as a shortcode. At ...
1
vote
1answer
61 views

Wordpress SQL Injections through User Agent

Currently Wordpress seems to be scoring bad on SQL Injection through User Agent. The testing tools that are being used return that it's insecure because it returns HTTP responses (errors) when you ...
0
votes
0answers
23 views

Disabling PHP exec/shell type functions - is this reasonable/best practice for a web hosting provider / does it break known plugins?

This question is nominally similar to Vanilla Wordpress install, what can/should I put in disable_functions? - a possible key difference is that I'm looking at it as someone that provides Wordpress ...
0
votes
1answer
67 views

WordPress disable direct access of files in WordPress installation path

I want to add a security feature to my WordPress website to stop direct access to files added to the root of WordPress installation, recently I discovered that a malicious plugin added some files to ...
2
votes
0answers
183 views

Nonces, AJAX, script variables & security in WordPress

Alright, so let's say you develop a website where you enqueue a js script on a page X of your frontend, using: wp_enqueue_script( 'script_handle', PATH_TO_SCRIPT, array(), '1.0.0', true ); ...
1
vote
1answer
37 views

I want to disable login of admin (/wp-admin) with email and make it accessible only with username

I want to do it as a security precaution. I've already taken other actions. But I want to be able to login only with my admin username. Is there a way to do that or even a plugin?
0
votes
0answers
21 views

how secure wordpress comment form in a custom theme?

How is it possible to secure comment form in Wordpress against XSS attack? recently we made a custom theme for our wordpress website and I used this code for the comments section as follows. The main ...
0
votes
0answers
17 views

Suhosin After all, should it be used? Or it's obsolete

In PHP 5 versions, I used suhosin. Currently, this add-on has not been updated since 2016. Is it obsolete? Is it important for the server ... And for CMS wordpress, joomla, drupral? Should it be used ...
0
votes
0answers
10 views

new plugin idea - shortcode security

i am not a coder so i can't make a plugin. recently i was searching tutorials/plugins for a feature so that i can restrict the use of shortcode but i found nothing. so i think it will be good idea to ...
0
votes
0answers
24 views

Is any code executed in disabled plugins?

I was wondering how much of a problem disabled plugins can be, in terms of security. I found another related question here, but the answers don't provide any details. What I'd like to know is if any ...

1
2 3 4 5
19