Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [security]

Strengthening themes, plugins and core installation to prevent intrusion.

Filter by
Sorted by
Tagged with
0 votes
1 answer
19 views

404/500 error on content images if Referer header is from another domain [closed]

Not very familiar with WordPress so I'm not sure what's causing this. Essentially, we have a few image assets stored under wp-content. When we access some assets (i.e. cmssubdomain.apex.com/wp-content/...
user avatar
  • 113
1 vote
1 answer
55 views

Escape when echoed

I've been trying to submit a plugin for review and I keep having problems with the echo line. The last version I sent was like this. <option value=""> <?php _e( '- Default', ...
user avatar
  • 15
0 votes
1 answer
42 views

How to correctly escape an echo

In WordPress they recommend that I should escape any part of the code of my plugin that shows data to the user, I have made most of the corrections but this specific case I don't know how to escape ...
user avatar
  • 15
0 votes
1 answer
13 views

Website show Google Ads when we have no Google Ads linked to our website

Today we noticed that one of our website has started showing random Google Ads on our website when we have not added any Google Ads to our website. I would appreciate if someone can help in case they ...
user avatar
  • 101
1 vote
1 answer
40 views

What's the point of forbidding access to wp-config.php?

Probably a dumb question... the hardening doc suggests setting up your web server so that it prevents access to wp-config.php. If you do this, and a client tries to access the file, Apache returns 403 ...
user avatar
  • 25
1 vote
1 answer
169 views

Is there any point setting the keys and salts in wp-config.php?

I'm auto-generating WordPress (5.9.3) sites on a VPS. I could, as part of the generation script, create random strings for the various keys and salts in wp-config.php. However, there doesn't appear to ...
user avatar
  • 25
0 votes
0 answers
7 views

How to create separate login for authors/moderators/subscribers?

I am working on a simple blog on marketing niche. However, few others have shown interest and is willing to join as authors. We know that in wordpress the importance to keep the login url unguessable. ...
user avatar
0 votes
1 answer
17 views

Are major WordPress updates mandatory for security?

I have created a web site, I want to activate minor updates (for security) on it and disable major updates (to avoid problems with themes or plugin or my functions.php which could become incompatible ...
user avatar
0 votes
0 answers
28 views

i moved wp-config.php outside of public html and this broke my website

I moved it back and the website started working again. I tried moving wp-config to secure my wordpress site here is what i did: created another file config.php downloaded wp-config and copied all the ...
user avatar
0 votes
1 answer
23 views

Reject all malicious URL requests functions.php

this might not be the right place as it's a question about a function snippet that relates also to the server and log files. I have been trying to block access to my site from bad query attempts which ...
user avatar
  • 1
0 votes
1 answer
28 views

Is it safe to upload JSON files to upload folder?

I'm using wp_upload_bits to upload JSON files to my WP's upload folder. I get the error "Sorry, this file type is not permitted for security reasons" Is it safe to upload JSON file anyway?
user avatar
1 vote
1 answer
18 views

Remove style `?ver=` from `/wp-admin/upgrade.php`

Using style_loader_src hook to remove the version query works just fine, but on /wp-admin/upgrade.php the version queries won't go away. Is there a way to also remove the versions strings from the /wp-...
user avatar
0 votes
0 answers
33 views

Security of a Wordpress Plugin

What security mechanisms exist in Wordpress to ensure that a popular plugin doesn't contain malicious code which for example tries to gain access to the database or make downstream DDOS attacks?
user avatar
2 votes
0 answers
16 views

Should I add the IP of the server that hosts my sites to the list of authorized IPs in the wp-admin/.htaccess?

All of my sites were recently hacked and I had to restrict access to the WordPress admin. The logs are now full of denied connections, but I also see errors coming from the IP of the server that ...
user avatar
  • 123
0 votes
0 answers
52 views

Can I disable xml-rpc by setting it to false?

I've been searching about it and came across with this snippet code, will it disable safely the xml-rpc? // set below line to false in /public_html/xmlrpc.php ... define( 'XMLRPC_REQUEST', true ); ......
user avatar
1 vote
0 answers
24 views

Is there any risk setting Wordpress file permissions and FS method to 'direct' on localhost?

After installing a fresh WordPress on my computer using XAMPP, I got this message when I tried uploading a theme: Connection Information To perform the requested action, WordPress needs to access ...
user avatar
0 votes
0 answers
14 views

Uploading attachment (pdf) and prevent download for anonymous user

I have a website which is public available and there we have "internal" area, these are simply pages with the visibility set to protected. So wordpress ask the visitor for the password (the ...
user avatar
  • 1
0 votes
1 answer
52 views

should I escape a literal url added in functions.php

I added a snippet to my functions.php file to add credit card icons in the woocommerce checkout page. The icons are in my media library so I added the url of the image. This is not an input and it ...
user avatar
0 votes
0 answers
45 views

Wordpress Database - wp_usermeta and the correct number of session_tokens rows

I've been doing some security research for lack of a better term in our database re: specific users and how they access the site. In the wp_usermeta table in the WordPress database, I recently noticed ...
user avatar
0 votes
1 answer
59 views

Content-Security-Policy blocks Wordpress check boxes from being activated

I have a Content-Security-Policy for my Wordpress Website (LAMP-Server): set Content-Security-Policy "base-uri 'self'; default-src 'self'; font-src 'self' data: https://fonts.gstatic.com; frame-...
user avatar
0 votes
2 answers
62 views

Why would you use esc_attr() on internal functions?

I see a lot of these in premium themes/plugins. #1 - Why would you escape this? It's your own data. For consistency? function prefix_a() { $class_attr = 'a b c'; // Some more code. ...
user avatar
0 votes
2 answers
33 views

Outgoing new connection to linked Websites - why?

I host a Wordpress site and wanted to fine-tune my firewall. Therefore I blocked all outgoing NEW connections, except to the wordpress servers for updates. This works fine - but I noticed, as soon as ...
user avatar
  • 11
0 votes
0 answers
18 views

Monitor wordpress all external calls

I'm running wordpress on my own apache server. Is It possible somehow to monitor/log all external access wordpress are doing? (to internet)? like when it's sending mail, plugins are making homecalls ...
user avatar
0 votes
1 answer
43 views

How can I disable new plugin and theme install, but allow updates?

I've already tried the DISALLOW_FILE_MODS constant, but it disables plugin updates as well, which is not what I need. I need automatic theme and plugin update checking, and the ability to install the ...
user avatar
1 vote
0 answers
73 views

Headers Content-Security-Policy CSP Major Issue

Im trying to add CSP : Header add Content-Security-Policy "script-src 'self';" - to my htaccess, seems like this line keeps breaking my site, The blocks gets broken, Unable to edit ...
user avatar
1 vote
0 answers
255 views

How to Change The WordPress Login URL Without Plugin

I'm looking for a way to change the wordpress admin login url from site.com/wp-login.php or sit.com/wp-admin.php to my custom login url like site.com/mylogin. I want to this without using plugin or ...
user avatar
  • 21
0 votes
2 answers
102 views

System setting changed by system user

Last week we received an email from our WordPress saying that the admin email got changed to admin@example.com By checking the logs using the WP Activity Log plugin, I can see that the action was done ...
user avatar
  • 51
0 votes
1 answer
60 views

how to prevent wordpress admin from logging in via woocommerce my-account page

website administrator can login using woocommerce my-account page. is there any way to prevent this and change the login page for admin? I mean the admin username, email and password will be ...
user avatar
  • 21
0 votes
0 answers
28 views

Should wordpress nonce be placed in html form or in javascript file

This example is specifically related to woocommerce but apparently the same question also applies to wordpress. Hence I believe this question is relevant to this forum. Here goes the example: I create ...
user avatar
  • 101
0 votes
1 answer
21 views

portfolio site - about this site section - is it safe to post some code

I am re-bulding my portfolio site using Underscores theme. I have an about page with the section "About this site". Since I plan to apply for web dev jobs in the near future, I think its a ...
user avatar
  • 41
0 votes
1 answer
35 views

how much information can we hide when using wordpress cms?

Just have my fist website up and running with WordPress. Using the tool like Wappalyzer and WPScan. A lot of webite is being exposed. I already use hide my wp plugin(s). but still received this ...
user avatar
1 vote
0 answers
13 views

Is it possible to access the wp-admin from one instance while keeping WP_HOME pointing to the balancing url?

I have a Wordpress running in a load balancer scheme with two instances. For security reasons, i've decided to block wp admin access from the public url and allowing it from one of the instances. ...
user avatar
  • 121
0 votes
0 answers
24 views

Help to Create a Simple Plugin to make a post

im new on wordpress development,for study purposes I need some help to create this simple plugin: one text box one button Explanation: I insert a value inside a text box. I click on the button and ...
user avatar
  • 11
1 vote
1 answer
62 views

File Type Is Not Permitted - Cronjob

I am currently developing a cron job that downloads a xml file from an external source and stores it within wordpress media. For debugging proposals, I have installed the plugin Advanced Cron Manager, ...
user avatar
  • 63
1 vote
0 answers
35 views

Securing/Escaping Output of file content - reading via fread() in PHP

I am working on securing the content read from a file via the fread() function. private function readfile_chunked($file) { $chunksize = 1024 * 1024; // Open Resume $handle = @fopen($file, ...
user avatar
  • 11
0 votes
1 answer
30 views

Is there a way to globallly apply esc_html( ... ) to all inputs and anchors to filter out XSS markup?

I'm new to XSS prevention only 2 years into WP development, so I am hoping there's an easy solution. Installing a plugin designed to prevent XSS abuse is not an option. I need to programmatically, ...
user avatar
0 votes
0 answers
20 views

How to enable wp-admin and wp-login only over highport

For security reasons we want to make our Wordpress login over wp-admin and wp-login only available over highport. We have a multisite-installation (with two websites). On the internet I didn't found ...
user avatar
  • 1
1 vote
1 answer
76 views

Can I write 'RewriteCond' using 'functions.php'?

I want to add 'rewrite condition' in .htcaccess but unfortunately I don't have access of that. Can I write conditions in functions.php ? If yes, how to achieve that ? I want to add these lines: ...
user avatar
  • 39
0 votes
1 answer
39 views

Validating ajax search

Is there a way to prevent user from entering <img src=x onerror=alert(test)> script tag to the form? My current search page is using ajax to load search result upon entering on the input field. ...
user avatar
0 votes
0 answers
453 views

Content-Security-Policy implementation with WordPress W3Total Cache plugin installed

Documentation about this says to avoid inline script and css Error: Refused to execute inline script because it violates the following Content Security Policy directive: What I have used so far: ...
user avatar
0 votes
1 answer
22 views

Password minimum length in personal subscription [closed]

I have a personal registration area. I already have a condition to check that the password and the password confirmation are identical. I wanted to add a condition to check that the password does not ...
user avatar
  • 1
1 vote
1 answer
102 views

XMLRPC filtering through htaccess not working

My websites are hosted on a shared instance. They face regular xmlrpc DDoS. I've tried to put in place several mitigation practices to block those attacks : Installed a dedicated extension that ...
user avatar
  • 11
0 votes
0 answers
34 views

Validate nonce with post ID in AJAX

I'm trying to create a nonce in an AJAX form where I can pass in a post ID. Then, validate it of course. I want to confirm that if the action is intended, but also the post ID so someone cannot just ...
user avatar
  • 143
0 votes
1 answer
33 views

echo cutom css code to Wordpress page template file ? is this safe?

I created wordpress page template and i want to add this css code only in to inside of this template only.for the security concern should i escape?. can anyone help me to solve this?. here is the ...
user avatar
0 votes
3 answers
581 views

WordPress sites being filled with random PHP files

Two weeks ago when I tried to access one of my WordPress sites through the browser, I was redirected to an ad page. I went inside of the public_html directory and found tons of PHP files with random ...
user avatar
0 votes
0 answers
74 views

After limiting the access to my wp-login.php by IP through .htaccess, all my password-protected posts stopped working. What's the best solution now?

To avoid brute force and illegal access to my WordPress website, I've limited the access to the wp-login.php script by IP addresses, using the .htaccess file. In other words, only certain IPs can ...
user avatar
1 vote
1 answer
1k views

How to force Authentication on REST API for Password protected page using custom table and fetch() without Plugin

I am implementing the REST API with fetch() promises as requests on a Password protected page with a custom table without using a plugin (only using the WP REST API that has been merged into WordPress ...
user avatar
1 vote
0 answers
300 views

Frequently getting attacks on admin-ajax.php, wp-cron.php, xmlrpc.php and wp-login.php

I am running more than 500 WordPress website in my shared server, Frequently I am getting attacks on admin-ajax.php, wp-cron.php, xmlrpc.php and wp-login.php files. Due to that our server load is ...
user avatar
1 vote
0 answers
44 views

SQL Injection blocked by firewall

I have a WordPress site that is guarded by firewall. Today I got a notification of blocked SQL injection. I cannot understand what the hacker is trying to do with the query: https://example.com/?p=121%...
user avatar
  • 111
2 votes
3 answers
585 views

Using "wordpress_logged_in" to restrict direct access to uploads folder in 2021

I am looking at ways to restrict direct access to the Wordpress Uploads folder. I've read a handful of Stackoverflow and blog posts about using "wordpress_logged_in" in .htaccess to check if ...
user avatar

1
2 3 4 5
19