Questions tagged [security]
Strengthening themes, plugins and core installation to prevent intrusion.
911
questions
0
votes
0answers
14 views
How to enable wp-admin and wp-login only over highport
For security reasons we want to make our Wordpress login over wp-admin and wp-login only available over highport.
We have a multisite-installation (with two websites).
On the internet I didn't found ...
1
vote
1answer
59 views
Can I write 'RewriteCond' using 'functions.php'?
I want to add 'rewrite condition' in .htcaccess but unfortunately I don't have access of that.
Can I write conditions in functions.php ? If yes, how to achieve that ?
I want to add these lines:
...
0
votes
0answers
16 views
Website getting 100+ brute force attacks in 6 hours
Last night a website I built got 100+ brute force attack. All of them trough xmlrpc.php
I use iThemes Security and I just blocked the access to xmlrpc.php as this website does not actually needs it.
...
0
votes
1answer
26 views
Validating ajax search
Is there a way to prevent user from entering <img src=x onerror=alert(test)> script tag to the form?
My current search page is using ajax to load search result upon entering on the input field. ...
0
votes
0answers
54 views
Content-Security-Policy implementation with WordPress W3Total Cache plugin installed
Documentation about this says to avoid inline script and css
Error:
Refused to execute inline script because it violates the following Content Security Policy directive:
What I have used so far:
...
0
votes
1answer
16 views
Password minimum length in personal subscription [closed]
I have a personal registration area. I already have a condition to check that the password and the password confirmation are identical. I wanted to add a condition to check that the password does not ...
1
vote
1answer
40 views
XMLRPC filtering through htaccess not working
My websites are hosted on a shared instance. They face regular xmlrpc DDoS. I've tried to put in place several mitigation practices to block those attacks :
Installed a dedicated extension that ...
0
votes
0answers
24 views
Validate nonce with post ID in AJAX
I'm trying to create a nonce in an AJAX form where I can pass in a post ID. Then, validate it of course.
I want to confirm that if the action is intended, but also the post ID so someone cannot just ...
0
votes
1answer
27 views
echo cutom css code to Wordpress page template file ? is this safe?
I created wordpress page template and i want to add this css code only in to inside of this template only.for the security concern should i escape?. can anyone help me to solve this?. here is the ...
0
votes
3answers
166 views
WordPress sites being filled with random PHP files
Two weeks ago when I tried to access one of my WordPress sites through the browser, I was redirected to an ad page. I went inside of the public_html directory and found tons of PHP files with random ...
0
votes
0answers
46 views
After limiting the access to my wp-login.php by IP through .htaccess, all my password-protected posts stopped working. What's the best solution now?
To avoid brute force and illegal access to my WordPress website, I've limited the access to the wp-login.php script by IP addresses, using the .htaccess file. In other words, only certain IPs can ...
1
vote
1answer
305 views
How to force Authentication on REST API for Password protected page using custom table and fetch() without Plugin
I am implementing the REST API with fetch() promises as requests on a Password protected page with a custom table without using a plugin (only using the WP REST API that has been merged into WordPress ...
1
vote
0answers
151 views
Frequently getting attacks on admin-ajax.php, wp-cron.php, xmlrpc.php and wp-login.php
I am running more than 500 WordPress website in my shared server, Frequently I am getting attacks on admin-ajax.php, wp-cron.php, xmlrpc.php and wp-login.php files. Due to that our server load is ...
1
vote
0answers
31 views
SQL Injection blocked by firewall
I have a WordPress site that is guarded by firewall. Today I got a notification of blocked SQL injection. I cannot understand what the hacker is trying to do with the query:
https://example.com/?p=121%...
2
votes
3answers
422 views
Using "wordpress_logged_in" to restrict direct access to uploads folder in 2021
I am looking at ways to restrict direct access to the Wordpress Uploads folder. I've read a handful of Stackoverflow and blog posts about using "wordpress_logged_in" in .htaccess to check if ...
0
votes
0answers
82 views
What are the best practices to achieve cross-domain interoperability and transparency in aggregate data through a uniform, hashed user naming schema?
The following plugin was just presented at the special session on data provenance to amend NSA's hard problems during the Hot Topics on Science of Security (HoTSoS) symposium.
I'm looking for peer ...
0
votes
0answers
10 views
how check user roles with most security
hello everyone i want to check user roles for my custom theme .
users according to their roles have different accessibility to site .
i check their roles with this code ,I'm worried I did something ...
0
votes
0answers
23 views
HTML Elements in my WP Plugin being generated in JS. Security and Translated Text Question about this method being used
So unfortunately when developing my WP plugin I created some methods that will help me generate HTML elements and their attributes with document.createElement.
One example function is provided below. (...
1
vote
1answer
29 views
Should I disable directory listing for wp-includes?
This is more of a personal question for my own curiosity.
One of my websites appears to be vulnerable because the directory listing (/wp-includes) is enabled. It’s not difficult to fix, however I’m ...
3
votes
3answers
349 views
Does WordPress sanitize arguments to WP_Query?
This is a very straight-forward question, but it's important and I can't find anything definitive in the docs.
This question asks a similar question for the 's' parameter, specifically. I want to know ...
0
votes
1answer
31 views
How to protect a script execution on Wordpress?
Recently I have created a script to update records on my Wordpress database. I basically use wpdb to connect to another database, grap some records, and update the Wordpress database. Using only ...
1
vote
1answer
107 views
Should you escape hardcoded URLs?
I'm writing a very simple social share plugin for a client. I'm using these two functions to display the share buttons at the bottom of each post:
<?php
/**
* Social buttons
*/
function ...
2
votes
1answer
65 views
Sanitizing comments or escaping comment_text()
I'm creating a template for comments on my WordPress site. I noticed that a simple <script>alert(1);</script> slips through the default WP codex implementation of comments, using the ...
0
votes
1answer
81 views
How to add API security keys into JS of wordpress securely
I am using wp_localize_script() to add variables from my config.ini file to my inline JS code (inside HTML block element of Elementor) [Please see this for reference]
But this method is unsafe to add ...
0
votes
0answers
28 views
HSTS header not being added correctly
I've added the following code to my child theme's functions.php in order to add a HSTS header to my website:
function tg_enable_strict_transport_security_hsts_header_wordpress() {
header( 'Strict-...
0
votes
0answers
252 views
WP SiteHealth check reports "The REST API encountered an unexpected result". Where to setup SSL *client* cert for *internal* WP use?
I'm running WP 5.7 on Linux. It's an Nginx server.
I'm setting up an internal site with policy that requires all services using SSL client cert verification enabled.
The WP host listener has ssl ...
0
votes
1answer
20 views
Input sanitation
I have a question regarding a wordpress site I have recently developed for a client. I have only until now developed a site for small clients that just require personal websites, however this client ...
0
votes
2answers
570 views
Is it Ok to restrict Access-Control-Allow-Origin for /wp-json requests?
I've been tasked with managing a WordPress site that was developed and configured by some other team. During a basic security scan, I've realized that the following end-point https://www.mywordpress....
1
vote
1answer
25 views
How to prevent XSS alter custom global javascript object & methods in Wordpress
Im working on a project in Wordpress that enqueues multiple .js files where each file adds
a new method to a global javascript object, this in order to make the desired methods available only if ...
0
votes
1answer
43 views
Is it unsafe to put php in the /wp-content/uploads directory?
Pretty straight forward question, but I'll provide any clarifications needed.
The reason I'm asking is this: I created a child theme that pulls in a custom-functions.php file. This allows devs to ...
0
votes
0answers
7 views
Is it possible to limit access to login/forget password by countries?
I know we can limit people accessing the wordpress by countries but is it possible to limit access on wp-login.php and forgetpassword links? I see a lot of script trying to access wp-login.php or any ...
0
votes
1answer
24 views
Vulnerability Concern From the Plugin or From Not Updating the Plugin?
Our company website has over 40 plugins. That is a lot...way too many. However, each plugin serves a purpose.
When updating all plugins to the recent version we noticed parts of the website break. ...
0
votes
0answers
19 views
How and why use validate_username and how to secure inputs fields of registration form?
I would use validate_username to protect username and other inputs from tags, octet, and others filters and conditions from sanitize_user but these functions only remove these dangerous chars and does ...
1
vote
1answer
180 views
.htaccess rules for blocking bots with an extra condition
I have a WP multisite installed. I am integrated with Ezoic and Cloudflare. I had implemented firewall rules. However, I have an issue blocking bots that have X-Middleton in the User-Agent, because my ...
0
votes
1answer
45 views
sanitize_post() is not sanitizing Post Object
I wanted to sanitize a WP_Query post object without using foreach.
I used this method:
$args = array(
// ...
)
$data = array();
$the_query = new WP_Query($args);
$data["post"] = $the_query-...
0
votes
0answers
7 views
Adjusting Prevent Concurrent Logins plugin to refresh the pages of older sessions
Is it possible to adjust the "Prevent Concurrent Logins" plugin to refresh "old sessions" browsers right after the "new sessions" logs in?
The plugin works currently fine ...
0
votes
0answers
28 views
Blacklisting jwt after logout in wordpress
I need to blacklist jwt after logout. Does anyone implemented it in in wordpress and could share his approach?
What I’ve thought of is storing blacklisted user jwt in user meta (value and expiration ...
0
votes
1answer
130 views
wp_nonce vs jwt
I’ve recently added jwt authentication to my website because frontend of my site is completely decoupled from backend.
What I haven’t thought of is that I could use wp_nonce instead of jwt - create ...
0
votes
1answer
287 views
Why does check_ajax_referer give a 403 error on https websites?
When I write an ajax funtion on a site without SSL, check_ajax_referer works as intended.
But it fails with a 403 forbidden error on a https site. I've tried a lot of times, but I just don't know why ...
1
vote
0answers
28 views
How to block plugin activations with no known user or coming from unknown IP address range?
I have received a Sucuri alert for an unauthorized plugin activation:
Event: Plugin Activated Website: http://www.XXXXXX.XXX IP Address: XXX.XXX.XXX.XXX Reverse IP: XXXXXX.XXXXXX.XXXX Date/Time: 7 ...
1
vote
1answer
46 views
Nonce failing on form submission
I'm updating some code in one of my WordPress plugins by adding a nonce to improve security. The plugin that has a form that generates some output that the user can copy and paste as a shortcode. At ...
1
vote
1answer
61 views
Wordpress SQL Injections through User Agent
Currently Wordpress seems to be scoring bad on SQL Injection through User Agent. The testing tools that are being used return that it's insecure because it returns HTTP responses (errors) when you ...
0
votes
0answers
23 views
Disabling PHP exec/shell type functions - is this reasonable/best practice for a web hosting provider / does it break known plugins?
This question is nominally similar to Vanilla Wordpress install, what can/should I put in disable_functions? - a possible key difference is that I'm looking at it as someone that provides Wordpress ...
0
votes
1answer
67 views
WordPress disable direct access of files in WordPress installation path
I want to add a security feature to my WordPress website to stop direct access to files added to the root of WordPress installation, recently I discovered that a malicious plugin added some files to ...
2
votes
0answers
183 views
Nonces, AJAX, script variables & security in WordPress
Alright, so let's say you develop a website where you enqueue a js script on a page X of your frontend, using:
wp_enqueue_script(
'script_handle',
PATH_TO_SCRIPT,
array(),
'1.0.0',
true
);
...
1
vote
1answer
37 views
I want to disable login of admin (/wp-admin) with email and make it accessible only with username
I want to do it as a security precaution. I've already taken other actions. But I want to be able to login only with my admin username. Is there a way to do that or even a plugin?
0
votes
0answers
21 views
how secure wordpress comment form in a custom theme?
How is it possible to secure comment form in Wordpress against XSS attack?
recently we made a custom theme for our wordpress website and I used this code for the comments section as follows.
The main ...
0
votes
0answers
17 views
Suhosin After all, should it be used? Or it's obsolete
In PHP 5 versions, I used suhosin.
Currently, this add-on has not been updated since 2016. Is it obsolete? Is it important for the server ... And for CMS wordpress, joomla, drupral?
Should it be used ...
0
votes
0answers
10 views
new plugin idea - shortcode security
i am not a coder so i can't make a plugin. recently i was searching tutorials/plugins for a feature so that i can restrict the use of shortcode but i found nothing. so i think it will be good idea to ...
0
votes
0answers
24 views
Is any code executed in disabled plugins?
I was wondering how much of a problem disabled plugins can be, in terms of security. I found another related question here, but the answers don't provide any details.
What I'd like to know is if any ...
