Strengthening themes, plugins and core installation to prevent intrusion.
0
votes
0answers
20 views
Is the Wordpress Nonce authentication enough for admin REST calls in a plugin
I have a plugin which also has some admin pages. These pages require some ajax calls that should be authenticated. So if the admin is logged in, these ajax calls are valid, and otherwise they should ...
0
votes
0answers
10 views
Ninja Forms security issue
I am working on a WordPress site where there is a security problem found by "WPScan" with the Ninja Forms plugin. Unfortunately, I cannot do these scans myself and only have this info:
The file /wp-...
6
votes
3answers
828 views
Does this .htaccess security setting really work?
What does this .htaccess do?
Am I correct in thinking that all it does is prevent automatic brute force attacks?
So, to access the wp-login.php you have to manually type in the URL of the domain so ...
-1
votes
1answer
15 views
How to resolve these findings from security audit
I am working on a corporate project and they are running security audit by consultants and they found the following issues regarding Wordpress. I managed to get a lot of issues resolved using headers ...
-1
votes
1answer
37 views
Are image addresses security relevant?
I have a website, where images are like:
<img src="upload/test.jpg"/>
But I checked some larger sites and they have a different src as:
<img src="imgrur.com/9keqqq"/>
My question is, ...
0
votes
0answers
17 views
Am I at risk if I am the only one uploading SVG to my website?
I am working on a wordpress website and I enabled SVGs uploading through functions.php to make graphics look crisp and increase page speed. It's a company website, so I'll probably be the only one ...
-2
votes
0answers
16 views
Deploying local development environment to production
All my previous experiences using wordpress was developing on local xampp server then buy hosting with my hosting provider and upload the website using their cpanel.
My latest project will be ran on ...
0
votes
0answers
18 views
Securing php templates which access to external DB
I was asked to generate a form as a theme template which must access an external DB only for logged users. It can even write into it. What I did to secure the form is:
making the page, which relies ...
0
votes
0answers
16 views
Share a single database or multiple databases
I currently have a live site on its own database (prefix wp_).
I want to install a new region-specific site on subdirectory (e.g. domain.com/my).
The blog will always be on the first site (domain.com/...
-1
votes
0answers
31 views
Is there a way to hide the wp-admin with Nginx?
I'm trying to hide wp-admin and wp-login.php on a fresh installation of wordpress.
The server is a VPS with both Nginx and Apache. Nginx serve static files and act as a proxy to Apache.
In the past (...
0
votes
0answers
30 views
Deny php execution in /wp-includes - using .htaccess in /wp-includes VS root folder
Trying to secure my WP site. In an attempt to deny php execution from the wp-includes folder wondering if these two methods are effectively doing the same thing?
1) add new .htaccess file to root of ...
0
votes
0answers
8 views
Validating textarea, Before sending the value to the DB
I have a textarea that I want to validate:
<form method="POST">
<textarea id="textarea" name="textarea"></textarea>
</form>
Sending the value using Ajax:
$.ajax('ajaxurl'...
0
votes
1answer
17 views
Is it possible to use WP-CLI in a plugin (or theme)?
Is it possible to use WP-CLI in a plugin (or theme)?
Such as
$ret = \WP_CLI::execute('plugin list');
I want to use some subcommands from other plugins.
0
votes
0answers
23 views
How to safely pass post_id and user_id via AJAX to the backend (prevent user from changing it via JS)?
I'm having code (user rates post) where I'm passing user_id and post_id via AJAX to the back-end. My concern is that user can change values in JS and pass another’s user id or post id. How do I ...
0
votes
0answers
23 views
setup wordpress behind a firewall, how to detect host needed to add to whitelist?
I need to deploy my company website on my company server through firewall (image below)
The firewall 1 is done,
But I can't findout what, and how many host my wordpres server need to connect to.
Is ...
0
votes
0answers
17 views
Allowing upload of files without an extension based on MIME type
I am trying to allow the upload of files that match a specific mime type, regardless of what the extension is (and even if there is no extension at all.)
Currently, wordpress is blocking these ...
1
vote
1answer
42 views
Wordpress custom login form using Ajax
Description:
I would like to create a custom login form: username, password and remember field. This is the code I have:
Problem: /wp-admin/admin-ajax.php 503 ()
What I've tried:
PHP:
function ...
2
votes
1answer
117 views
How to handle security on a wordpress site? [closed]
I'm doing a draft of a WordPress site on localhost.
If I am using PHP snippets to do the sort of back-end functionality. How do I know that, when this goes to a real platform, the php code cannot be ...
1
vote
1answer
41 views
Store brute-force IP addresses
How can I store IP addresses which try to brute-force the login section or to login too frequent too fast?
I need to store all IPs, then use them in another application, sort of like a learning ...
2
votes
0answers
31 views
Coding a plugin on WordPress; when should I sanitize? [duplicate]
I am developing a custom plugin on WordPress for a client. Just a simple question: when I am using update_post_meta() and update_user_meta(), do I need to use the WordPress sanitization functions? I ...
1
vote
2answers
34 views
Generating an nonce for Content Security Policy and all scripts - How to make it match/persist for each page load?
Hooking into the script_loader_tag hook and generating random strings is no problem, but how can I generate them once per page load and use them in both wp_head and script_loader_tag?
I'd really like ...
1
vote
0answers
11 views
WordPress ACL (folder + permissions)
For certificate a web platform created with WordPress, they ask me to provide a snapshot of ACL maintained on application / configuration folder.
Screenshot must clearly show who all have access to ...
0
votes
1answer
33 views
I should enable automatic updates?
I have a small hosting company with a few hundred sites hosted on cPanel.
All my clients need to use a WordPress plugin from our company for compatibility issues.
So I have the option to make all ...
0
votes
0answers
140 views
Should I use Woocommerce rest api to create products
I am trying to create plugin that gets data from external application with wp_remote_post to create products in Woocommerce.
I have read about Woocommerce REST API but have not found any information ...
0
votes
1answer
41 views
Wordpress Password security related questions
Since i'm doing Wordpress hardening for a project and ran into some questions that I haven't found a good answer online. If anyone has had any experience with this kind of stuff or have any know-how ...
1
vote
1answer
30 views
wp-admin folder, brute force, and password protection
I don't know how brute force attacks work. I have protected the wp-admin folder with a password, in addition to having the regular Wordpress login. How does having this "second layer" inhibit brute ...
0
votes
0answers
20 views
Escaping a WPDB Object in One Shot
I know array mapping works for escaping a bunch of values in an array, making them safe for output in HTML. But is there a way to do the same thing with an object? If not, I guess the object could ...
1
vote
1answer
81 views
$wpdb is get_results escaped
I'm guessing the answer is no here, but wanted to be sure. I would expect that when I get a database object or array using get_results that I still need to add htmlspecialchars() or esc_html() when ...
1
vote
0answers
32 views
How can I find security hole in my wordpress site?
Last day I've noticed that my site is hacked and a PHP backdoor is installed on my site.
Virus scanner reported that a plugin file is inside my wp-content/uploads which I did not upload it myself. It ...
0
votes
0answers
17 views
Advice On How to Backup Wordpress
I have my site hosted with Cloudways and am using ManageWP to manage the site. I am wondering about backup options.
Cloudways backs up the server and has an option to restore a particular app on ...
1
vote
0answers
17 views
Is wp_kses the right approach in sanitizing this string?
I have a function that trims my post title and I escape the final output using wp_kses.
Is this the right approach?
function theTrimmedPostTitle( $length = BIG_INT, $delimiter = '' )
{
$title = ...
-1
votes
2answers
30 views
What are the different types of firewall protections available for a WordPress website?
Can someone please explain (in layman language) what are the different types of firewall protections available for a WP site.
How do these firewall work and how are they different from one another?
...
0
votes
0answers
274 views
How to fix this CORS error?
I made a simple site on let's say main_domain.com.
Therefore I have landing_page CCT details page available on main_domain.com/landing_pages/my-landing.
My goal is to hook one domain per landing_page ...
0
votes
1answer
32 views
Hardening uploads folder in IIS breaks images
My site loads a bunch of images from the uploads folder, using direct URLs, such as:
http://www.example.com/wp-content/uploads/some.image.png
I'm trying to figure out a remote script execution issue,...
0
votes
1answer
30 views
Securely log in a user without a password using a link?
I'd like to use links from my application to log users into Wordpress in their browser, but I'm concerned about whether this can be done securely.
Obviously using any sort of static URL pattern seems ...
0
votes
0answers
6 views
How to disable comment review previews
In the comments admin section when I am reviewing new entries there is an annoying mouse-over-preview for links.
How can I disable this?
I am seriously worried that each mouse over is sending ...
0
votes
0answers
58 views
How can I stop other plugins from using my class' sensitive methods?
Assume I have a Class that deals with sending sensitive user information via e-mail to the developer.
So, the whole thing would look like:
<?php
namespace PrivateNamespace;
class ...
1
vote
1answer
168 views
Wordpress not seeing .htaccess rules
I'm currently building a small business website and I'm hosting on a home server, and have hit a roadblock with not being able to enhance security because of Wordpress not following any of the rules I'...
0
votes
1answer
28 views
Is it necessary to do validation again when retrieving data from database?
I do validation when saving data to database like following:
$data = validate($data);
update_post_meta($post_id, 'my_post_meta', $data);
The question is, do I need to do validation again when read ...
0
votes
0answers
18 views
captcha on wordpress site visting
I create website in wordpress and hackers try to hack my site. So I put itheme Security pulgin. I saw log taht tries to hack site. I want to put google captcha on first website visit? Can you please ...
0
votes
1answer
19 views
Secruity Questions on a timer
I am doing some research for a project and one requirement from the client is that to create an account a user must create security questions on account creation. I think this should be easy with a ...
1
vote
1answer
290 views
404 redirect wp-login and wp-admin after changing login url
I've successfully changed the login page to a custom url, using this codes:
This one into wp-config.php
define('WP_ADMIN_DIR', 'secret-folder');
define( 'ADMIN_COOKIE_PATH', SITECOOKIEPATH . ...
0
votes
1answer
142 views
Is it secure to use admin-ajax.php in front?
I would like to know if it is secure to use admin-ajax.php for your ajax requests on the front.
0
votes
0answers
27 views
Wordpress and dorking - Security
There are many good guides like "ultimate-guide-wordpress-security" out there providing many great explanations on how to harden and secure WordPress enabled websites.
However, one vulnerability ...
0
votes
0answers
46 views
Exporting and importing users - will passwords be the same?
I am using a membership plugin which creates users to access certain pages of our website.
I have recreated the membership site using a clean install and database of WordPress.
If I export the users ...
1
vote
1answer
49 views
Is there a way for a user to have an alias?
In the 80s I was the owner of a Apple support BBS (single user/one phone line).
I created a way for a user to have an alias linked to their user account.
The alias had the ability to post and any ...
1
vote
0answers
111 views
Logout USER form backoffice after 30 minutes of inactivity [closed]
I looking for to logout user from backoffice after 30 minutes of non activity except Administrator role.
Thanks.
1
vote
1answer
585 views
Where to store OAuth 2.0 client id and secret?
I'm building some functionality within one of my WordPress sites that integrates with a third-party API, and that API uses OAuth 2.0.
I use both the client ID and secret every time I need a new ...
0
votes
1answer
18 views
Chrome Dev Tools console says every page in my blog has link to http://maps.google.com [closed]
Viewing any page of my blog at https://www.rephunter.net/blog/ with the Chrome Dev Tools console open gives a Mixed Content error message.
The problem is that I cannot find where that link is, and to ...
5
votes
2answers
675 views
How do WordPress Nonces Work?
I am trying to understand how WordPress nonces work in terms of security. nonce stands for a number used once, but according to WordPress, it can be valid for up to 24 hours, which makes no sense. It ...
