Questions tagged [security]
Strengthening themes, plugins and core installation to prevent intrusion.
938
questions
0
votes
0
answers
8
views
Wordpress - Security Question at Login from User's Meta Data
How can I add KBA (Knowledge-based authentication) Field at the time of login in WordPress? That field can be anything submitted by the user at the time of registration. For example … At the time of ...
0
votes
0
answers
27
views
Move data from wp-config to another file
I heard, that is possible to move that data:
define('DB_NAME', 'moja_baza');
define('DB_USER', 'moj_user');
define('DB_PASSWORD', 'moje_haslo');
define('DB_HOST', 'moj_host');
define('DB_CHARSET', '...
- 1
0
votes
0
answers
22
views
How to parse an image that was just uploaded to make sure it doesn't contain malicious code?
Let's assume that an user has just uploaded an image. How do we make sure that the image doesn't contain hidden PHP code that will run once the image is on the server? The most common (and, for ...
0
votes
0
answers
14
views
Hide plugins and theme from public
I like to hide all or some of my plugins and themes and CMS from public such that the users cannot detect which plugins/themes/CMS I used to build my website.
Please let me know if it is possible to ...
- 103
0
votes
2
answers
68
views
Prevent direct access to Wordpress plugin assets?
I was wondering if there was a simple way to prevent direct access to asset files within a WordPress plugin. Primarily javascript files.
I'm developing a plugin that's meant to be used only in the ...
- 285
0
votes
1
answer
30
views
How can i ensure that SQL statements are not displayed if an enduser types the wrong variable name in the URL
My question is similar to this. It is about security of my wordpress site which has custom pages that call variables on the url.
An example of my url looks like this:
https://mysitevvv.ke/mysite1/...
1
vote
1
answer
22
views
Restrict Access without Creating Users
I'm building a plugin which receives quote data form a third party api and uses it generate a post of type 'quote' which, on the front end, comprises an acf_form which the customer is required to fill ...
- 521
0
votes
0
answers
13
views
User media folder for each users on registration
i need to create a "user folder" in media library for user registration using usermeta field, for example "billing_company".. so, my purpose is to procect file url inside that ...
- 1
0
votes
1
answer
74
views
reCaptcha doesnt appear in comment (manual or plugin)
I tried the following:
https://www.quora.com/How-can-I-insert-Captcha-code-in-WordPress-theme-without-using-any-plugin
https://codeforgeek.com/add-google-recaptcha-wordpress/
https://pluginsforwp.com/...
- 61
0
votes
0
answers
21
views
Wordpress search shows protected content
I have noticed many times that WordPress search results reveal protected/locked content. Is it a security issue or do search results show the webpage as viewed by the admin?
Sometimes, the content of ...
- 1
0
votes
1
answer
38
views
404/500 error on content images if Referer header is from another domain [closed]
Not very familiar with WordPress so I'm not sure what's causing this.
Essentially, we have a few image assets stored under wp-content. When we access some assets (i.e. cmssubdomain.apex.com/wp-content/...
- 113
1
vote
1
answer
68
views
Escape when echoed
I've been trying to submit a plugin for review and I keep having problems with the echo line.
The last version I sent was like this.
<option value="">
<?php _e( '- Default', ...
- 17
0
votes
1
answer
120
views
How to correctly escape an echo
In WordPress they recommend that I should escape any part of the code of my plugin that shows data to the user, I have made most of the corrections but this specific case I don't know how to escape ...
- 17
0
votes
1
answer
14
views
Website show Google Ads when we have no Google Ads linked to our website
Today we noticed that one of our website has started showing random Google Ads on our website when we have not added any Google Ads to our website.
I would appreciate if someone can help in case they ...
- 101
1
vote
1
answer
51
views
What's the point of forbidding access to wp-config.php?
Probably a dumb question...
the hardening doc suggests setting up your web server so that it prevents access to wp-config.php. If you do this, and a client tries to access the file, Apache returns 403 ...
- 27
1
vote
1
answer
211
views
Is there any point setting the keys and salts in wp-config.php?
I'm auto-generating WordPress (5.9.3) sites on a VPS. I could, as part of the generation script, create random strings for the various keys and salts in wp-config.php. However, there doesn't appear to ...
- 27
0
votes
0
answers
12
views
How to create separate login for authors/moderators/subscribers?
I am working on a simple blog on marketing niche. However, few others have shown interest and is willing to join as authors.
We know that in wordpress the importance to keep the login url unguessable. ...
- 1
0
votes
1
answer
18
views
Are major WordPress updates mandatory for security?
I have created a web site, I want to activate minor updates (for security) on it and disable major updates (to avoid problems with themes or plugin or my functions.php which could become incompatible ...
0
votes
0
answers
40
views
i moved wp-config.php outside of public html and this broke my website
I moved it back and the website started working again.
I tried moving wp-config to secure my wordpress site
here is what i did:
created another file config.php
downloaded wp-config and copied all the ...
- 1
0
votes
1
answer
36
views
Reject all malicious URL requests functions.php
this might not be the right place as it's a question about a function snippet that relates also to the server and log files.
I have been trying to block access to my site from bad query attempts which ...
- 1
0
votes
1
answer
76
views
Is it safe to upload JSON files to upload folder?
I'm using wp_upload_bits to upload JSON files to my WP's upload folder. I get the error "Sorry, this file type is not permitted for security reasons"
Is it safe to upload JSON file anyway?
- 15
1
vote
1
answer
41
views
Remove style `?ver=` from `/wp-admin/upgrade.php`
Using style_loader_src hook to remove the version query works just fine, but on /wp-admin/upgrade.php the version queries won't go away.
Is there a way to also remove the versions strings from the /wp-...
- 193
0
votes
0
answers
39
views
Security of a Wordpress Plugin
What security mechanisms exist in Wordpress to ensure that a popular plugin doesn't contain malicious code which for example tries to gain access to the database or make downstream DDOS attacks?
- 111
2
votes
0
answers
32
views
Should I add the IP of the server that hosts my sites to the list of authorized IPs in the wp-admin/.htaccess?
All of my sites were recently hacked and I had to restrict access to the WordPress admin.
The logs are now full of denied connections, but I also see errors coming from the IP of the server that ...
- 123
0
votes
0
answers
91
views
Can I disable xml-rpc by setting it to false?
I've been searching about it and came across with this snippet code, will it disable safely the xml-rpc?
// set below line to false in /public_html/xmlrpc.php
...
define( 'XMLRPC_REQUEST', true );
......
- 101
1
vote
0
answers
108
views
Is there any risk setting Wordpress file permissions and FS method to 'direct' on localhost?
After installing a fresh WordPress on my computer using XAMPP, I got this message when I tried uploading a theme:
Connection Information
To perform the requested action, WordPress needs to access ...
0
votes
0
answers
21
views
Uploading attachment (pdf) and prevent download for anonymous user
I have a website which is public available and there we have "internal" area, these are simply pages with the visibility set to protected.
So wordpress ask the visitor for the password (the ...
- 1
0
votes
1
answer
56
views
should I escape a literal url added in functions.php
I added a snippet to my functions.php file to add credit card icons in the woocommerce checkout page. The icons are in my media library so I added the url of the image.
This is not an input and it ...
0
votes
0
answers
67
views
Wordpress Database - wp_usermeta and the correct number of session_tokens rows
I've been doing some security research for lack of a better term in our database re: specific users and how they access the site.
In the wp_usermeta table in the WordPress database, I recently noticed ...
- 101
0
votes
1
answer
128
views
Content-Security-Policy blocks Wordpress check boxes from being activated
I have a Content-Security-Policy for my Wordpress Website (LAMP-Server):
set Content-Security-Policy "base-uri 'self'; default-src 'self'; font-src 'self' data: https://fonts.gstatic.com; frame-...
- 11
0
votes
2
answers
69
views
Why would you use esc_attr() on internal functions?
I see a lot of these in premium themes/plugins.
#1 - Why would you escape this? It's your own data. For consistency?
function prefix_a() {
$class_attr = 'a b c';
// Some more code.
...
- 147
0
votes
2
answers
38
views
Outgoing new connection to linked Websites - why?
I host a Wordpress site and wanted to fine-tune my firewall. Therefore I blocked all outgoing NEW connections, except to the wordpress servers for updates.
This works fine - but I noticed, as soon as ...
- 11
0
votes
0
answers
22
views
Monitor wordpress all external calls
I'm running wordpress on my own apache server.
Is It possible somehow to monitor/log all external access wordpress are doing? (to internet)?
like when it's sending mail, plugins are making homecalls ...
- 15
0
votes
1
answer
80
views
How can I disable new plugin and theme install, but allow updates?
I've already tried the DISALLOW_FILE_MODS constant, but it disables plugin updates as well, which is not what I need. I need automatic theme and plugin update checking, and the ability to install the ...
- 1
1
vote
0
answers
194
views
Headers Content-Security-Policy CSP Major Issue
Im trying to add CSP :
Header add Content-Security-Policy "script-src 'self';" - to my htaccess,
seems like this line keeps breaking my site, The blocks gets broken, Unable to edit ...
- 11
1
vote
0
answers
469
views
How to Change The WordPress Login URL Without Plugin
I'm looking for a way to change the wordpress admin login url from site.com/wp-login.php or sit.com/wp-admin.php to my custom login url like site.com/mylogin.
I want to this without using plugin or ...
- 21
0
votes
2
answers
102
views
System setting changed by system user
Last week we received an email from our WordPress saying that the admin email got changed to admin@example.com
By checking the logs using the WP Activity Log plugin, I can see that the action was done ...
- 51
0
votes
1
answer
147
views
how to prevent wordpress admin from logging in via woocommerce my-account page
website administrator can login using woocommerce my-account page.
is there any way to prevent this and change the login page for admin? I mean the admin username, email and password will be ...
- 21
0
votes
0
answers
76
views
Should wordpress nonce be placed in html form or in javascript file
This example is specifically related to woocommerce but apparently the same question also applies to wordpress. Hence I believe this question is relevant to this forum. Here goes the example:
I create ...
- 101
0
votes
1
answer
22
views
portfolio site - about this site section - is it safe to post some code
I am re-bulding my portfolio site using Underscores theme. I have an about page with the section "About this site". Since I plan to apply for web dev jobs in the near future, I think its a ...
- 41
0
votes
1
answer
38
views
how much information can we hide when using wordpress cms?
Just have my fist website up and running with WordPress.
Using the tool like Wappalyzer and WPScan. A lot of webite is being exposed.
I already use hide my wp plugin(s). but still received this ...
- 3
1
vote
0
answers
16
views
Is it possible to access the wp-admin from one instance while keeping WP_HOME pointing to the balancing url?
I have a Wordpress running in a load balancer scheme with two instances. For security reasons, i've decided to block wp admin access from the public url and allowing it from one of the instances.
...
- 121
0
votes
0
answers
26
views
Help to Create a Simple Plugin to make a post
im new on wordpress development,for study purposes I need some help to create this simple plugin:
one text box
one button
Explanation:
I insert a value inside a text box.
I click on the button and ...
- 11
1
vote
1
answer
90
views
File Type Is Not Permitted - Cronjob
I am currently developing a cron job that downloads a xml file from an external source and stores it within wordpress media.
For debugging proposals, I have installed the plugin Advanced Cron Manager, ...
- 63
1
vote
0
answers
45
views
Securing/Escaping Output of file content - reading via fread() in PHP
I am working on securing the content read from a file via the fread() function.
private function readfile_chunked($file) {
$chunksize = 1024 * 1024;
// Open Resume
$handle = @fopen($file, ...
- 11
0
votes
1
answer
56
views
Is there a way to globallly apply esc_html( ... ) to all inputs and anchors to filter out XSS markup?
I'm new to XSS prevention only 2 years into WP development, so I am hoping there's an easy solution. Installing a plugin designed to prevent XSS abuse is not an option. I need to programmatically, ...
0
votes
0
answers
20
views
How to enable wp-admin and wp-login only over highport
For security reasons we want to make our Wordpress login over wp-admin and wp-login only available over highport.
We have a multisite-installation (with two websites).
On the internet I didn't found ...
- 1
1
vote
1
answer
95
views
Can I write 'RewriteCond' using 'functions.php'?
I want to add 'rewrite condition' in .htcaccess but unfortunately I don't have access of that.
Can I write conditions in functions.php ? If yes, how to achieve that ?
I want to add these lines:
...
- 39
0
votes
1
answer
45
views
Validating ajax search
Is there a way to prevent user from entering <img src=x onerror=alert(test)> script tag to the form?
My current search page is using ajax to load search result upon entering on the input field. ...
0
votes
0
answers
582
views
Content-Security-Policy implementation with WordPress W3Total Cache plugin installed
Documentation about this says to avoid inline script and css
Error:
Refused to execute inline script because it violates the following Content Security Policy directive:
What I have used so far:
...
