Questions tagged [security]

Strengthening themes, plugins and core installation to prevent intrusion.

Filter by
Sorted by
Tagged with
0 votes
0 answers
8 views

Wordpress - Security Question at Login from User's Meta Data

How can I add KBA (Knowledge-based authentication) Field at the time of login in WordPress? That field can be anything submitted by the user at the time of registration. For example … At the time of ...
0 votes
0 answers
27 views

Move data from wp-config to another file

I heard, that is possible to move that data: define('DB_NAME', 'moja_baza'); define('DB_USER', 'moj_user'); define('DB_PASSWORD', 'moje_haslo'); define('DB_HOST', 'moj_host'); define('DB_CHARSET', '...
0 votes
0 answers
22 views

How to parse an image that was just uploaded to make sure it doesn't contain malicious code?

Let's assume that an user has just uploaded an image. How do we make sure that the image doesn't contain hidden PHP code that will run once the image is on the server? The most common (and, for ...
0 votes
0 answers
14 views

Hide plugins and theme from public

I like to hide all or some of my plugins and themes and CMS from public such that the users cannot detect which plugins/themes/CMS I used to build my website. Please let me know if it is possible to ...
  • 103
0 votes
2 answers
68 views

Prevent direct access to Wordpress plugin assets?

I was wondering if there was a simple way to prevent direct access to asset files within a WordPress plugin. Primarily javascript files. I'm developing a plugin that's meant to be used only in the ...
  • 285
0 votes
1 answer
30 views

How can i ensure that SQL statements are not displayed if an enduser types the wrong variable name in the URL

My question is similar to this. It is about security of my wordpress site which has custom pages that call variables on the url. An example of my url looks like this: https://mysitevvv.ke/mysite1/...
1 vote
1 answer
22 views

Restrict Access without Creating Users

I'm building a plugin which receives quote data form a third party api and uses it generate a post of type 'quote' which, on the front end, comprises an acf_form which the customer is required to fill ...
0 votes
0 answers
13 views

User media folder for each users on registration

i need to create a "user folder" in media library for user registration using usermeta field, for example "billing_company".. so, my purpose is to procect file url inside that ...
  • 1
0 votes
1 answer
74 views

reCaptcha doesnt appear in comment (manual or plugin)

I tried the following: https://www.quora.com/How-can-I-insert-Captcha-code-in-WordPress-theme-without-using-any-plugin https://codeforgeek.com/add-google-recaptcha-wordpress/ https://pluginsforwp.com/...
  • 61
0 votes
0 answers
21 views

Wordpress search shows protected content

I have noticed many times that WordPress search results reveal protected/locked content. Is it a security issue or do search results show the webpage as viewed by the admin? Sometimes, the content of ...
  • 1
0 votes
1 answer
38 views

404/500 error on content images if Referer header is from another domain [closed]

Not very familiar with WordPress so I'm not sure what's causing this. Essentially, we have a few image assets stored under wp-content. When we access some assets (i.e. cmssubdomain.apex.com/wp-content/...
  • 113
1 vote
1 answer
68 views

Escape when echoed

I've been trying to submit a plugin for review and I keep having problems with the echo line. The last version I sent was like this. <option value=""> <?php _e( '- Default', ...
  • 17
0 votes
1 answer
120 views

How to correctly escape an echo

In WordPress they recommend that I should escape any part of the code of my plugin that shows data to the user, I have made most of the corrections but this specific case I don't know how to escape ...
  • 17
0 votes
1 answer
14 views

Website show Google Ads when we have no Google Ads linked to our website

Today we noticed that one of our website has started showing random Google Ads on our website when we have not added any Google Ads to our website. I would appreciate if someone can help in case they ...
  • 101
1 vote
1 answer
51 views

What's the point of forbidding access to wp-config.php?

Probably a dumb question... the hardening doc suggests setting up your web server so that it prevents access to wp-config.php. If you do this, and a client tries to access the file, Apache returns 403 ...
  • 27
1 vote
1 answer
211 views

Is there any point setting the keys and salts in wp-config.php?

I'm auto-generating WordPress (5.9.3) sites on a VPS. I could, as part of the generation script, create random strings for the various keys and salts in wp-config.php. However, there doesn't appear to ...
  • 27
0 votes
0 answers
12 views

How to create separate login for authors/moderators/subscribers?

I am working on a simple blog on marketing niche. However, few others have shown interest and is willing to join as authors. We know that in wordpress the importance to keep the login url unguessable. ...
0 votes
1 answer
18 views

Are major WordPress updates mandatory for security?

I have created a web site, I want to activate minor updates (for security) on it and disable major updates (to avoid problems with themes or plugin or my functions.php which could become incompatible ...
0 votes
0 answers
40 views

i moved wp-config.php outside of public html and this broke my website

I moved it back and the website started working again. I tried moving wp-config to secure my wordpress site here is what i did: created another file config.php downloaded wp-config and copied all the ...
0 votes
1 answer
36 views

Reject all malicious URL requests functions.php

this might not be the right place as it's a question about a function snippet that relates also to the server and log files. I have been trying to block access to my site from bad query attempts which ...
  • 1
0 votes
1 answer
76 views

Is it safe to upload JSON files to upload folder?

I'm using wp_upload_bits to upload JSON files to my WP's upload folder. I get the error "Sorry, this file type is not permitted for security reasons" Is it safe to upload JSON file anyway?
1 vote
1 answer
41 views

Remove style `?ver=` from `/wp-admin/upgrade.php`

Using style_loader_src hook to remove the version query works just fine, but on /wp-admin/upgrade.php the version queries won't go away. Is there a way to also remove the versions strings from the /wp-...
0 votes
0 answers
39 views

Security of a Wordpress Plugin

What security mechanisms exist in Wordpress to ensure that a popular plugin doesn't contain malicious code which for example tries to gain access to the database or make downstream DDOS attacks?
2 votes
0 answers
32 views

Should I add the IP of the server that hosts my sites to the list of authorized IPs in the wp-admin/.htaccess?

All of my sites were recently hacked and I had to restrict access to the WordPress admin. The logs are now full of denied connections, but I also see errors coming from the IP of the server that ...
  • 123
0 votes
0 answers
91 views

Can I disable xml-rpc by setting it to false?

I've been searching about it and came across with this snippet code, will it disable safely the xml-rpc? // set below line to false in /public_html/xmlrpc.php ... define( 'XMLRPC_REQUEST', true ); ......
1 vote
0 answers
108 views

Is there any risk setting Wordpress file permissions and FS method to 'direct' on localhost?

After installing a fresh WordPress on my computer using XAMPP, I got this message when I tried uploading a theme: Connection Information To perform the requested action, WordPress needs to access ...
0 votes
0 answers
21 views

Uploading attachment (pdf) and prevent download for anonymous user

I have a website which is public available and there we have "internal" area, these are simply pages with the visibility set to protected. So wordpress ask the visitor for the password (the ...
  • 1
0 votes
1 answer
56 views

should I escape a literal url added in functions.php

I added a snippet to my functions.php file to add credit card icons in the woocommerce checkout page. The icons are in my media library so I added the url of the image. This is not an input and it ...
0 votes
0 answers
67 views

Wordpress Database - wp_usermeta and the correct number of session_tokens rows

I've been doing some security research for lack of a better term in our database re: specific users and how they access the site. In the wp_usermeta table in the WordPress database, I recently noticed ...
0 votes
1 answer
128 views

Content-Security-Policy blocks Wordpress check boxes from being activated

I have a Content-Security-Policy for my Wordpress Website (LAMP-Server): set Content-Security-Policy "base-uri 'self'; default-src 'self'; font-src 'self' data: https://fonts.gstatic.com; frame-...
0 votes
2 answers
69 views

Why would you use esc_attr() on internal functions?

I see a lot of these in premium themes/plugins. #1 - Why would you escape this? It's your own data. For consistency? function prefix_a() { $class_attr = 'a b c'; // Some more code. ...
0 votes
2 answers
38 views

Outgoing new connection to linked Websites - why?

I host a Wordpress site and wanted to fine-tune my firewall. Therefore I blocked all outgoing NEW connections, except to the wordpress servers for updates. This works fine - but I noticed, as soon as ...
  • 11
0 votes
0 answers
22 views

Monitor wordpress all external calls

I'm running wordpress on my own apache server. Is It possible somehow to monitor/log all external access wordpress are doing? (to internet)? like when it's sending mail, plugins are making homecalls ...
0 votes
1 answer
80 views

How can I disable new plugin and theme install, but allow updates?

I've already tried the DISALLOW_FILE_MODS constant, but it disables plugin updates as well, which is not what I need. I need automatic theme and plugin update checking, and the ability to install the ...
1 vote
0 answers
194 views

Headers Content-Security-Policy CSP Major Issue

Im trying to add CSP : Header add Content-Security-Policy "script-src 'self';" - to my htaccess, seems like this line keeps breaking my site, The blocks gets broken, Unable to edit ...
1 vote
0 answers
469 views

How to Change The WordPress Login URL Without Plugin

I'm looking for a way to change the wordpress admin login url from site.com/wp-login.php or sit.com/wp-admin.php to my custom login url like site.com/mylogin. I want to this without using plugin or ...
  • 21
0 votes
2 answers
102 views

System setting changed by system user

Last week we received an email from our WordPress saying that the admin email got changed to admin@example.com By checking the logs using the WP Activity Log plugin, I can see that the action was done ...
  • 51
0 votes
1 answer
147 views

how to prevent wordpress admin from logging in via woocommerce my-account page

website administrator can login using woocommerce my-account page. is there any way to prevent this and change the login page for admin? I mean the admin username, email and password will be ...
  • 21
0 votes
0 answers
76 views

Should wordpress nonce be placed in html form or in javascript file

This example is specifically related to woocommerce but apparently the same question also applies to wordpress. Hence I believe this question is relevant to this forum. Here goes the example: I create ...
  • 101
0 votes
1 answer
22 views

portfolio site - about this site section - is it safe to post some code

I am re-bulding my portfolio site using Underscores theme. I have an about page with the section "About this site". Since I plan to apply for web dev jobs in the near future, I think its a ...
  • 41
0 votes
1 answer
38 views

how much information can we hide when using wordpress cms?

Just have my fist website up and running with WordPress. Using the tool like Wappalyzer and WPScan. A lot of webite is being exposed. I already use hide my wp plugin(s). but still received this ...
1 vote
0 answers
16 views

Is it possible to access the wp-admin from one instance while keeping WP_HOME pointing to the balancing url?

I have a Wordpress running in a load balancer scheme with two instances. For security reasons, i've decided to block wp admin access from the public url and allowing it from one of the instances. ...
  • 121
0 votes
0 answers
26 views

Help to Create a Simple Plugin to make a post

im new on wordpress development,for study purposes I need some help to create this simple plugin: one text box one button Explanation: I insert a value inside a text box. I click on the button and ...
  • 11
1 vote
1 answer
90 views

File Type Is Not Permitted - Cronjob

I am currently developing a cron job that downloads a xml file from an external source and stores it within wordpress media. For debugging proposals, I have installed the plugin Advanced Cron Manager, ...
  • 63
1 vote
0 answers
45 views

Securing/Escaping Output of file content - reading via fread() in PHP

I am working on securing the content read from a file via the fread() function. private function readfile_chunked($file) { $chunksize = 1024 * 1024; // Open Resume $handle = @fopen($file, ...
  • 11
0 votes
1 answer
56 views

Is there a way to globallly apply esc_html( ... ) to all inputs and anchors to filter out XSS markup?

I'm new to XSS prevention only 2 years into WP development, so I am hoping there's an easy solution. Installing a plugin designed to prevent XSS abuse is not an option. I need to programmatically, ...
0 votes
0 answers
20 views

How to enable wp-admin and wp-login only over highport

For security reasons we want to make our Wordpress login over wp-admin and wp-login only available over highport. We have a multisite-installation (with two websites). On the internet I didn't found ...
  • 1
1 vote
1 answer
95 views

Can I write 'RewriteCond' using 'functions.php'?

I want to add 'rewrite condition' in .htcaccess but unfortunately I don't have access of that. Can I write conditions in functions.php ? If yes, how to achieve that ? I want to add these lines: ...
  • 39
0 votes
1 answer
45 views

Validating ajax search

Is there a way to prevent user from entering <img src=x onerror=alert(test)> script tag to the form? My current search page is using ajax to load search result upon entering on the input field. ...
0 votes
0 answers
582 views

Content-Security-Policy implementation with WordPress W3Total Cache plugin installed

Documentation about this says to avoid inline script and css Error: Refused to execute inline script because it violates the following Content Security Policy directive: What I have used so far: ...

1
2 3 4 5
19