Questions tagged [security]
Strengthening themes, plugins and core installation to prevent intrusion.
931
questions
0
votes
1
answer
19
views
404/500 error on content images if Referer header is from another domain [closed]
Not very familiar with WordPress so I'm not sure what's causing this.
Essentially, we have a few image assets stored under wp-content. When we access some assets (i.e. cmssubdomain.apex.com/wp-content/...
- 113
1
vote
1
answer
55
views
Escape when echoed
I've been trying to submit a plugin for review and I keep having problems with the echo line.
The last version I sent was like this.
<option value="">
<?php _e( '- Default', ...
- 15
0
votes
1
answer
42
views
How to correctly escape an echo
In WordPress they recommend that I should escape any part of the code of my plugin that shows data to the user, I have made most of the corrections but this specific case I don't know how to escape ...
- 15
0
votes
1
answer
13
views
Website show Google Ads when we have no Google Ads linked to our website
Today we noticed that one of our website has started showing random Google Ads on our website when we have not added any Google Ads to our website.
I would appreciate if someone can help in case they ...
- 101
1
vote
1
answer
40
views
What's the point of forbidding access to wp-config.php?
Probably a dumb question...
the hardening doc suggests setting up your web server so that it prevents access to wp-config.php. If you do this, and a client tries to access the file, Apache returns 403 ...
- 25
1
vote
1
answer
169
views
Is there any point setting the keys and salts in wp-config.php?
I'm auto-generating WordPress (5.9.3) sites on a VPS. I could, as part of the generation script, create random strings for the various keys and salts in wp-config.php. However, there doesn't appear to ...
- 25
0
votes
0
answers
7
views
How to create separate login for authors/moderators/subscribers?
I am working on a simple blog on marketing niche. However, few others have shown interest and is willing to join as authors.
We know that in wordpress the importance to keep the login url unguessable. ...
- 1
0
votes
1
answer
17
views
Are major WordPress updates mandatory for security?
I have created a web site, I want to activate minor updates (for security) on it and disable major updates (to avoid problems with themes or plugin or my functions.php which could become incompatible ...
0
votes
0
answers
28
views
i moved wp-config.php outside of public html and this broke my website
I moved it back and the website started working again.
I tried moving wp-config to secure my wordpress site
here is what i did:
created another file config.php
downloaded wp-config and copied all the ...
- 1
0
votes
1
answer
23
views
Reject all malicious URL requests functions.php
this might not be the right place as it's a question about a function snippet that relates also to the server and log files.
I have been trying to block access to my site from bad query attempts which ...
- 1
0
votes
1
answer
28
views
Is it safe to upload JSON files to upload folder?
I'm using wp_upload_bits to upload JSON files to my WP's upload folder. I get the error "Sorry, this file type is not permitted for security reasons"
Is it safe to upload JSON file anyway?
1
vote
1
answer
18
views
Remove style `?ver=` from `/wp-admin/upgrade.php`
Using style_loader_src hook to remove the version query works just fine, but on /wp-admin/upgrade.php the version queries won't go away.
Is there a way to also remove the versions strings from the /wp-...
- 167
0
votes
0
answers
33
views
Security of a Wordpress Plugin
What security mechanisms exist in Wordpress to ensure that a popular plugin doesn't contain malicious code which for example tries to gain access to the database or make downstream DDOS attacks?
- 111
2
votes
0
answers
16
views
Should I add the IP of the server that hosts my sites to the list of authorized IPs in the wp-admin/.htaccess?
All of my sites were recently hacked and I had to restrict access to the WordPress admin.
The logs are now full of denied connections, but I also see errors coming from the IP of the server that ...
- 123
0
votes
0
answers
52
views
Can I disable xml-rpc by setting it to false?
I've been searching about it and came across with this snippet code, will it disable safely the xml-rpc?
// set below line to false in /public_html/xmlrpc.php
...
define( 'XMLRPC_REQUEST', true );
......
- 101
1
vote
0
answers
24
views
Is there any risk setting Wordpress file permissions and FS method to 'direct' on localhost?
After installing a fresh WordPress on my computer using XAMPP, I got this message when I tried uploading a theme:
Connection Information
To perform the requested action, WordPress needs to access ...
0
votes
0
answers
14
views
Uploading attachment (pdf) and prevent download for anonymous user
I have a website which is public available and there we have "internal" area, these are simply pages with the visibility set to protected.
So wordpress ask the visitor for the password (the ...
- 1
0
votes
1
answer
52
views
should I escape a literal url added in functions.php
I added a snippet to my functions.php file to add credit card icons in the woocommerce checkout page. The icons are in my media library so I added the url of the image.
This is not an input and it ...
0
votes
0
answers
45
views
Wordpress Database - wp_usermeta and the correct number of session_tokens rows
I've been doing some security research for lack of a better term in our database re: specific users and how they access the site.
In the wp_usermeta table in the WordPress database, I recently noticed ...
- 101
0
votes
1
answer
59
views
Content-Security-Policy blocks Wordpress check boxes from being activated
I have a Content-Security-Policy for my Wordpress Website (LAMP-Server):
set Content-Security-Policy "base-uri 'self'; default-src 'self'; font-src 'self' data: https://fonts.gstatic.com; frame-...
- 11
0
votes
2
answers
62
views
Why would you use esc_attr() on internal functions?
I see a lot of these in premium themes/plugins.
#1 - Why would you escape this? It's your own data. For consistency?
function prefix_a() {
$class_attr = 'a b c';
// Some more code.
...
- 147
0
votes
2
answers
33
views
Outgoing new connection to linked Websites - why?
I host a Wordpress site and wanted to fine-tune my firewall. Therefore I blocked all outgoing NEW connections, except to the wordpress servers for updates.
This works fine - but I noticed, as soon as ...
- 11
0
votes
0
answers
18
views
Monitor wordpress all external calls
I'm running wordpress on my own apache server.
Is It possible somehow to monitor/log all external access wordpress are doing? (to internet)?
like when it's sending mail, plugins are making homecalls ...
- 15
0
votes
1
answer
43
views
How can I disable new plugin and theme install, but allow updates?
I've already tried the DISALLOW_FILE_MODS constant, but it disables plugin updates as well, which is not what I need. I need automatic theme and plugin update checking, and the ability to install the ...
- 1
1
vote
0
answers
73
views
Headers Content-Security-Policy CSP Major Issue
Im trying to add CSP :
Header add Content-Security-Policy "script-src 'self';" - to my htaccess,
seems like this line keeps breaking my site, The blocks gets broken, Unable to edit ...
- 11
1
vote
0
answers
255
views
How to Change The WordPress Login URL Without Plugin
I'm looking for a way to change the wordpress admin login url from site.com/wp-login.php or sit.com/wp-admin.php to my custom login url like site.com/mylogin.
I want to this without using plugin or ...
- 21
0
votes
2
answers
102
views
System setting changed by system user
Last week we received an email from our WordPress saying that the admin email got changed to admin@example.com
By checking the logs using the WP Activity Log plugin, I can see that the action was done ...
- 51
0
votes
1
answer
60
views
how to prevent wordpress admin from logging in via woocommerce my-account page
website administrator can login using woocommerce my-account page.
is there any way to prevent this and change the login page for admin? I mean the admin username, email and password will be ...
- 21
0
votes
0
answers
28
views
Should wordpress nonce be placed in html form or in javascript file
This example is specifically related to woocommerce but apparently the same question also applies to wordpress. Hence I believe this question is relevant to this forum. Here goes the example:
I create ...
- 101
0
votes
1
answer
21
views
portfolio site - about this site section - is it safe to post some code
I am re-bulding my portfolio site using Underscores theme. I have an about page with the section "About this site". Since I plan to apply for web dev jobs in the near future, I think its a ...
- 41
0
votes
1
answer
35
views
how much information can we hide when using wordpress cms?
Just have my fist website up and running with WordPress.
Using the tool like Wappalyzer and WPScan. A lot of webite is being exposed.
I already use hide my wp plugin(s). but still received this ...
- 3
1
vote
0
answers
13
views
Is it possible to access the wp-admin from one instance while keeping WP_HOME pointing to the balancing url?
I have a Wordpress running in a load balancer scheme with two instances. For security reasons, i've decided to block wp admin access from the public url and allowing it from one of the instances.
...
- 121
0
votes
0
answers
24
views
Help to Create a Simple Plugin to make a post
im new on wordpress development,for study purposes I need some help to create this simple plugin:
one text box
one button
Explanation:
I insert a value inside a text box.
I click on the button and ...
- 11
1
vote
1
answer
62
views
File Type Is Not Permitted - Cronjob
I am currently developing a cron job that downloads a xml file from an external source and stores it within wordpress media.
For debugging proposals, I have installed the plugin Advanced Cron Manager, ...
- 63
1
vote
0
answers
35
views
Securing/Escaping Output of file content - reading via fread() in PHP
I am working on securing the content read from a file via the fread() function.
private function readfile_chunked($file) {
$chunksize = 1024 * 1024;
// Open Resume
$handle = @fopen($file, ...
- 11
0
votes
1
answer
30
views
Is there a way to globallly apply esc_html( ... ) to all inputs and anchors to filter out XSS markup?
I'm new to XSS prevention only 2 years into WP development, so I am hoping there's an easy solution. Installing a plugin designed to prevent XSS abuse is not an option. I need to programmatically, ...
0
votes
0
answers
20
views
How to enable wp-admin and wp-login only over highport
For security reasons we want to make our Wordpress login over wp-admin and wp-login only available over highport.
We have a multisite-installation (with two websites).
On the internet I didn't found ...
- 1
1
vote
1
answer
76
views
Can I write 'RewriteCond' using 'functions.php'?
I want to add 'rewrite condition' in .htcaccess but unfortunately I don't have access of that.
Can I write conditions in functions.php ? If yes, how to achieve that ?
I want to add these lines:
...
- 39
0
votes
1
answer
39
views
Validating ajax search
Is there a way to prevent user from entering <img src=x onerror=alert(test)> script tag to the form?
My current search page is using ajax to load search result upon entering on the input field. ...
0
votes
0
answers
453
views
Content-Security-Policy implementation with WordPress W3Total Cache plugin installed
Documentation about this says to avoid inline script and css
Error:
Refused to execute inline script because it violates the following Content Security Policy directive:
What I have used so far:
...
0
votes
1
answer
22
views
Password minimum length in personal subscription [closed]
I have a personal registration area. I already have a condition to check that the password and the password confirmation are identical. I wanted to add a condition to check that the password does not ...
- 1
1
vote
1
answer
102
views
XMLRPC filtering through htaccess not working
My websites are hosted on a shared instance. They face regular xmlrpc DDoS. I've tried to put in place several mitigation practices to block those attacks :
Installed a dedicated extension that ...
- 11
0
votes
0
answers
34
views
Validate nonce with post ID in AJAX
I'm trying to create a nonce in an AJAX form where I can pass in a post ID. Then, validate it of course.
I want to confirm that if the action is intended, but also the post ID so someone cannot just ...
- 143
0
votes
1
answer
33
views
echo cutom css code to Wordpress page template file ? is this safe?
I created wordpress page template and i want to add this css code only in to inside of this template only.for the security concern should i escape?. can anyone help me to solve this?. here is the ...
0
votes
3
answers
581
views
WordPress sites being filled with random PHP files
Two weeks ago when I tried to access one of my WordPress sites through the browser, I was redirected to an ad page. I went inside of the public_html directory and found tons of PHP files with random ...
0
votes
0
answers
74
views
After limiting the access to my wp-login.php by IP through .htaccess, all my password-protected posts stopped working. What's the best solution now?
To avoid brute force and illegal access to my WordPress website, I've limited the access to the wp-login.php script by IP addresses, using the .htaccess file. In other words, only certain IPs can ...
1
vote
1
answer
1k
views
How to force Authentication on REST API for Password protected page using custom table and fetch() without Plugin
I am implementing the REST API with fetch() promises as requests on a Password protected page with a custom table without using a plugin (only using the WP REST API that has been merged into WordPress ...
- 131
1
vote
0
answers
300
views
Frequently getting attacks on admin-ajax.php, wp-cron.php, xmlrpc.php and wp-login.php
I am running more than 500 WordPress website in my shared server, Frequently I am getting attacks on admin-ajax.php, wp-cron.php, xmlrpc.php and wp-login.php files. Due to that our server load is ...
- 11
1
vote
0
answers
44
views
SQL Injection blocked by firewall
I have a WordPress site that is guarded by firewall. Today I got a notification of blocked SQL injection. I cannot understand what the hacker is trying to do with the query:
https://example.com/?p=121%...
- 111
2
votes
3
answers
585
views
Using "wordpress_logged_in" to restrict direct access to uploads folder in 2021
I am looking at ways to restrict direct access to the Wordpress Uploads folder. I've read a handful of Stackoverflow and blog posts about using "wordpress_logged_in" in .htaccess to check if ...
