Questions tagged [security]
Strengthening themes, plugins and core installation to prevent intrusion.
0
votes
0answers
13 views
Probably hacked “WordPress” website is automatically created the folders that I delete to clean it up [on hold]
It looks like one of my WordPress websites was recently hacked. Now, the WordPress directory has a folder called "VO" and it has random folder with names like "what-are-you-doing" etc.
It is almost ...
0
votes
1answer
24 views
Prevent WordPress website from redirecting to spam [on hold]
One of my WordPress websites in being redirected to random spammy URLs when clicked from Google SERPs.
It happened once when I visited the website from my laptop. Then when I searched for the same ...
0
votes
2answers
27 views
White screen of death on admin pages after moving wp-config up two levels for security
I moved the wp-config to the hosting root and put it in a new directory and then I included it from the WordPress directory like so: include("../../my-fast-cars/fast-cars.php"); this gave me white ...
1
vote
1answer
24 views
Auth cookie value security risk?
A short question this time:
How much of a security risk is it when an third party gets access to WordPress auth cookie?
Can they for example simply copy the cookie and "be" logged in as the user who ...
0
votes
1answer
20 views
Security question - Display a General Custom Login Error Message
I need to change the information given on Wordpress' Login page and the Lost password page so that hackers cannot easily see if a username or email is associated with an existing account.
At the ...
0
votes
0answers
28 views
The in-famous Unable to locate WordPress Content directory (wp-content) and the Direct Method
I've been receiving this error for several years in all my Wordpress installations.
The solution has been always the same: the classic snipet where you add a filter for "filesystem_method" with direct ...
0
votes
1answer
22 views
Is a very simple theme secure enough?
I am very very new to Wordpress theme development and after creating one, I want to know if any threats will face it.
There is no way i receive any data from visitors, including no comments received. ...
0
votes
1answer
14 views
Security: Critical backend outside of wordpress
For starters, apologies for my miserable knowledge of web development.
I have been developing a simple website for my startup and have encountered some security concerns. Knowing my limited knowledge ...
1
vote
0answers
26 views
Good way to block users within a multisite setup without deleting them?
This is probably a common problem with multiple possibilities to solve. However I am asking for an easy solution as I guess I am not the first one to have this problem.
Assume we have a huge company ...
0
votes
1answer
27 views
Security: AWS (shared hosting) claims template file malicious
Recently, our hosting platform (AWS) notified us of a malicious template file:
/wp-content/uploads/tcb_lp_templates/templates/tcb2-bright-content-page.tpl
On closer closer inspection, there are quite ...
0
votes
1answer
25 views
Cannot access wp admin of Wordpress website (security plugin issue) [closed]
I was using all in one WP security and White Label plugin in one of my wordpress website.
I had custom wp-admin login url. After moving host i realized i cannot login via custom url. Also, wp-admin ...
1
vote
0answers
27 views
Plugins Deleted
I have a client whose site was broken by a plugin and instead of deactivating plugins, they deleted some kind of 'visual editor' plugin.
We managed to get the site back up and running and updated all ...
0
votes
1answer
37 views
Is it best to avoid using $wpdb for security issues?
I'm using WordPress Multisite with multilingualpress.
In order to get the href, outside of my navbar, to the page with the appropriate language, I am using an SQL query that queries $wpdb within the ...
0
votes
0answers
19 views
scripts in Wordpress pages are filtered
I have rich snippet scripts I'd like to place on my wordpress pages, for instance:
<script type='application/ld+json'>{"@context": "http://www.schema.org", "@type": "Event", "name":" Reading &...
0
votes
1answer
34 views
Need help for WordPress User Session Management?
I need help regarding WordPress session management. Follow these steps::
Bug: Session management and break authentication.
Steps to reproduce:
Log in to your account using browser 1.
Now, login to ...
0
votes
0answers
18 views
Any way to analyze suspicious password reset requests?
My WP site was recently hacked. I've removed the fake user account that was created, checked for hidden users in the database via phpMyAdmin, I believe I've found most of the added and hacked files ...
0
votes
0answers
20 views
Password protect multiple pages
Is it possible to have the "password protected page" feature of WordPress apply to more than one page? I have multiple pages I wish to protect with the same password, but I don't want people to keep ...
0
votes
2answers
28 views
How to add domain security certification, in WordPress website?
When I visit website using Wordpress Dashboard, browser is showing 'cPanel, Inc. Certification Authority';
But, when I access it directly typing the domain in the URL Bar, no Certification icon is ...
0
votes
1answer
26 views
Should I manually resolve WP Core File security issues or await a subsequent WP release?
Using the Google Developer Tools, I can see that some of WordPress' JavaScript Libraries contain known security vulnerabilities; some a few months old.
With this in mind, should I consider ...
0
votes
1answer
17 views
permalinks constantly needs re-saving
I have my WP running on an Nginx environment, with Wordfence, WP Rocket, and Search&Filter plugins installed (along with some others). Permalinks are working just fine, except /search permalink ...
0
votes
1answer
64 views
Verify nonce in REST API?
I would like to understand the best practices regarding nonce validation in REST APIs.
I see a lot of people talking about wp_rest nonce for REST requests. But upon looking on WordPress core code, I ...
4
votes
2answers
265 views
can not upload file .vtt on wordpress 5.0.1
I updated my site to wordpress 5.0.1, but now I can not upload file .vtt anymore. This function works properly on wordpress 4.9.8
0
votes
1answer
54 views
Who updates the wp-admin/core file?
I can see it's a CDN file and I can't access it. My security plugin alerted me that there had been a modification to the wp-admin/core file, but I didn't change anything. I haven't updated to 5.0 yet. ...
1
vote
0answers
34 views
Best practices to assert current_user_can() with guests
In WordPress, a guest can do a lot of things, such as reading posts.
However, this always returns false for guests:
add_action('wp', function() {
global $post;
/** @var WP_Post_Type $pto */
...
1
vote
1answer
106 views
WP Admin AJAX Security - using POST to include a relative URL
I have set up several WordPress Admin AJAX scripts (that run only in the Admin panel) that currently all use separate actions, functions and nonce's.
The only "real" difference between these scripts ...
1
vote
1answer
24 views
Admin username and password
I use ceber security plugin which protects my site again malicious attacks etc.
I checked today and there were over 20 lock outs. I checked ip addresses and there were no constituencies, they were ...
-1
votes
1answer
30 views
Is my WP site being hacked?
In the past month or so I've seen 3 or 4 new users signing up each day with "awkward" usernames (letters/numbers). Then, a few days later, they start changing their password. And then a few days later ...
0
votes
1answer
97 views
Where i should not use if (!defined('ABSPATH')) { exit; }?
I think this best way to prevent direct access..
<?php if (!defined('ABSPATH')) { exit; }?>
i have used this on all my php files..can it create problems?
any files on WordPress theme i should ...
0
votes
0answers
16 views
Should I check for privileges before hooking into `wp_ajax_$handle` or after?
Should I heck for privileges before even hooking the wp_ajax_hook_name or in the function that I've hooked to it?
The first way:
if( current_user_can( 'manage_options' ) ) {
add_action( '...
0
votes
1answer
28 views
How can I have more confidence that WP plugins aren't getting and storing user data?
How can I have more confidence that WP plugins aren't getting and storing user data? This is in regard to making my website GDPR-compliant.
Perhaps an automatic scanning tool?
Are there any existing ...
0
votes
2answers
59 views
How do I test to ensure that my wp-config file is protected?
Since order allow,deny is deprecated in 2.4 I wanted to rewrite the rules in my .htaccess file to use the new rules. Previously I was using:
<files wp-config.php>
order allow,deny
deny ...
0
votes
0answers
20 views
Ninja Forms security issue
I am working on a WordPress site where there is a security problem found by "WPScan" with the Ninja Forms plugin. Unfortunately, I cannot do these scans myself and only have this info:
The file /wp-...
7
votes
3answers
1k views
Does this .htaccess security setting really work?
What does this .htaccess do?
Am I correct in thinking that all it does is prevent automatic brute force attacks?
So, to access the wp-login.php you have to manually type in the URL of the domain so ...
-1
votes
1answer
20 views
How to resolve these findings from security audit
I am working on a corporate project and they are running security audit by consultants and they found the following issues regarding Wordpress. I managed to get a lot of issues resolved using headers ...
-1
votes
1answer
38 views
Are image addresses security relevant?
I have a website, where images are like:
<img src="upload/test.jpg"/>
But I checked some larger sites and they have a different src as:
<img src="imgrur.com/9keqqq"/>
My question is, ...
0
votes
0answers
21 views
Share a single database or multiple databases
I currently have a live site on its own database (prefix wp_).
I want to install a new region-specific site on subdirectory (e.g. domain.com/my).
The blog will always be on the first site (domain.com/...
0
votes
0answers
48 views
Deny php execution in /wp-includes - using .htaccess in /wp-includes VS root folder
Trying to secure my WP site. In an attempt to deny php execution from the wp-includes folder wondering if these two methods are effectively doing the same thing?
1) add new .htaccess file to root of ...
0
votes
1answer
34 views
Is it possible to use WP-CLI in a plugin (or theme)?
Is it possible to use WP-CLI in a plugin (or theme)?
Such as
$ret = \WP_CLI::execute('plugin list');
I want to use some subcommands from other plugins.
0
votes
0answers
30 views
How to safely pass post_id and user_id via AJAX to the backend (prevent user from changing it via JS)?
I'm having code (user rates post) where I'm passing user_id and post_id via AJAX to the back-end. My concern is that user can change values in JS and pass another’s user id or post id. How do I ...
0
votes
0answers
30 views
setup wordpress behind a firewall, how to detect host needed to add to whitelist?
I need to deploy my company website on my company server through firewall (image below)
The firewall 1 is done,
But I can't findout what, and how many host my wordpres server need to connect to.
Is ...
0
votes
0answers
18 views
Allowing upload of files without an extension based on MIME type
I am trying to allow the upload of files that match a specific mime type, regardless of what the extension is (and even if there is no extension at all.)
Currently, wordpress is blocking these ...
1
vote
1answer
279 views
Wordpress custom login form using Ajax
Description:
I would like to create a custom login form: username, password and remember field. This is the code I have:
Problem: /wp-admin/admin-ajax.php 503 ()
What I've tried:
PHP:
function ...
2
votes
1answer
118 views
How to handle security on a wordpress site? [closed]
I'm doing a draft of a WordPress site on localhost.
If I am using PHP snippets to do the sort of back-end functionality. How do I know that, when this goes to a real platform, the php code cannot be ...
1
vote
1answer
44 views
Store brute-force IP addresses
How can I store IP addresses which try to brute-force the login section or to login too frequent too fast?
I need to store all IPs, then use them in another application, sort of like a learning ...
2
votes
0answers
34 views
Coding a plugin on WordPress; when should I sanitize? [duplicate]
I am developing a custom plugin on WordPress for a client. Just a simple question: when I am using update_post_meta() and update_user_meta(), do I need to use the WordPress sanitization functions? I ...
1
vote
2answers
85 views
Generating an nonce for Content Security Policy and all scripts - How to make it match/persist for each page load?
Hooking into the script_loader_tag hook and generating random strings is no problem, but how can I generate them once per page load and use them in both wp_head and script_loader_tag?
I'd really like ...
1
vote
0answers
14 views
WordPress ACL (folder + permissions)
For certificate a web platform created with WordPress, they ask me to provide a snapshot of ACL maintained on application / configuration folder.
Screenshot must clearly show who all have access to ...
0
votes
1answer
35 views
I should enable automatic updates?
I have a small hosting company with a few hundred sites hosted on cPanel.
All my clients need to use a WordPress plugin from our company for compatibility issues.
So I have the option to make all ...
0
votes
0answers
350 views
Should I use Woocommerce rest api to create products
I am trying to create plugin that gets data from external application with wp_remote_post to create products in Woocommerce.
I have read about Woocommerce REST API but have not found any information ...
0
votes
1answer
44 views
Wordpress Password security related questions
Since i'm doing Wordpress hardening for a project and ran into some questions that I haven't found a good answer online. If anyone has had any experience with this kind of stuff or have any know-how ...
