Questions tagged [security]
Strengthening themes, plugins and core installation to prevent intrusion.
0
votes
2answers
26 views
Block any other domains from using my server
Seems someone has set their domain to use my server. It's not a mirror, the database and everything works and updates with mine. He's basically stealing my content, and he's showing up on google ...
0
votes
0answers
29 views
Robots.txt file not updating
One of our website robots.txt file is not getting updated,deleted .htaccess and robots.txt file from root folder from one of the suggested answers
Why does Google Webmaster Tools say my whole site is ...
0
votes
2answers
32 views
Security concerns with external links
In this article I read, that using <a href="" target="blank"> is related to some security issues. They recommend rel=noopener.
How do I implement this in my WP-Installation? Which file is the ...
0
votes
1answer
13 views
Why am I sometimes getting a 404 error when I try to update a page with Elementor?
When updating a page with Elementor, we're occasionally receiving a 404 error.
Most of the time we can update the page just fine, but when we try to add a <script> tag or a button with a custom ...
0
votes
1answer
26 views
Are SVG image files safe to upload? Why WP defines them as a security risk? [duplicate]
I'd like to upload a map of the USA in a SVG format however I am prevented from doing so because of a 'security risk'.
Any ideas why this is? Is it safe to do so?
Thanks
0
votes
1answer
20 views
Running multiple security plugins
Is it a bad idea to run more than one plugin that offers simialar seciruty features.
I'm planning to use wordfence for security and jetpack for backups. But i see jetpack offers security features as ...
0
votes
1answer
15 views
My wordpress site has “https://” on it but when I go to Dashboard and click visit site, it removes the “https://”
We have an internal website that is accessible only if you have an office 365 employee logins. It's hosted on bluehost and we have activated the https feature of it. Our site is running on WordPress ...
0
votes
1answer
28 views
Handling nonces for actions from guests to logged-in users
Imagine the following scenario:
John has an account on my website, but is currently not logged in.
He clicks the "upvote" button on an article, but is redirected to the login page because only logged-...
7
votes
4answers
631 views
Why escape if the_content isnt?
The built in function the_content runs through several filters, but does not escape output. It would be difficult for it to do so, as HTML and even some scripts must be allowed through.
When ...
1
vote
1answer
48 views
Is echo get_the_term_list and get_field in a template file considered safe?
Is using get_the_term_list and get_field in the manner below consistent with accepted standards for safely displaying taxonomy terms as links in a table and custom field text beneath headings in a ...
0
votes
4answers
49 views
How can I backup my site if it gets hacked?
Today I want to ask you something which is really important what if my WordPress website https://thecodezine.com gets hacked or my jetpack plugin security is broken?Will I lose everything? Is there no ...
0
votes
1answer
24 views
how do I secure my WP website from hackers? [closed]
I appreciate if someone helps me to secure my website from being hacked. Is there any helpful plugin to use?
0
votes
0answers
13 views
Block unauthenticated users from downloading png (or other data) files
How can I block users from direct downloading image files ( if they are not authenticated)?
I want to enable download just when user pass authentication header (JWT). Currently I have JWT enabled for ...
0
votes
2answers
142 views
Someone keeps changing my SITEURL (mysql injection or xss?) [closed]
I've twice had my site's url changed in the database. This is the only piece of data being altered. Whoever is doing this is then redirecting the site to a script at this location:
somelandingpage [...
0
votes
1answer
27 views
Where to store sensitive uploaded file?
I'm developing a plugin. Where is the best place to store a user uploaded file that is sensitive in nature? It should not be web accessible.
Given the encoding of the file, it's necessary that it be ...
0
votes
2answers
27 views
Developer/Designer asking for admin access
I have a Wordpress website and want a customized home-page built with Elementor plugin for my website. I am not good at designing attractive pages so I contacted one small firm to help me out with ...
0
votes
1answer
11 views
https rewrite not working for All in one security Brute force > rename login url
I am trying to set 2 security measures that seems not to work together:
https on the site, using a server redirect + Module rewrite in htaccess :
<IfModule mod_rewrite.c>
RewriteEngine On
...
0
votes
1answer
24 views
Will there be security updates for WordPress 4.9.9
Since WordPress 5 is out im wondering if there are still security updates for WordPress 4.9.9 or do I need to update to WordPress 5 as soon as possible?
0
votes
0answers
19 views
How can I ascertain that my previously hacked WordPress site are now free of malicious code? [duplicate]
I am almost certain that someone cracked my FTP password using Bruteforce attacks. After that, they injected malicious code in my 3 different websites. Two are hosted on WordPress and one is entirely ...
0
votes
2answers
32 views
White screen of death on admin pages after moving wp-config up two levels for security
I moved the wp-config to the hosting root and put it in a new directory and then I included it from the WordPress directory like so: include("../../my-fast-cars/fast-cars.php"); this gave me white ...
1
vote
1answer
25 views
Auth cookie value security risk?
A short question this time:
How much of a security risk is it when an third party gets access to WordPress auth cookie?
Can they for example simply copy the cookie and "be" logged in as the user who ...
0
votes
1answer
21 views
Security question - Display a General Custom Login Error Message
I need to change the information given on Wordpress' Login page and the Lost password page so that hackers cannot easily see if a username or email is associated with an existing account.
At the ...
0
votes
0answers
40 views
The in-famous Unable to locate WordPress Content directory (wp-content) and the Direct Method
I've been receiving this error for several years in all my Wordpress installations.
The solution has been always the same: the classic snipet where you add a filter for "filesystem_method" with direct ...
0
votes
1answer
23 views
Is a very simple theme secure enough?
I am very very new to Wordpress theme development and after creating one, I want to know if any threats will face it.
There is no way i receive any data from visitors, including no comments received. ...
0
votes
1answer
14 views
Security: Critical backend outside of wordpress
For starters, apologies for my miserable knowledge of web development.
I have been developing a simple website for my startup and have encountered some security concerns. Knowing my limited knowledge ...
1
vote
0answers
26 views
Good way to block users within a multisite setup without deleting them?
This is probably a common problem with multiple possibilities to solve. However I am asking for an easy solution as I guess I am not the first one to have this problem.
Assume we have a huge company ...
0
votes
1answer
27 views
Security: AWS (shared hosting) claims template file malicious
Recently, our hosting platform (AWS) notified us of a malicious template file:
/wp-content/uploads/tcb_lp_templates/templates/tcb2-bright-content-page.tpl
On closer closer inspection, there are quite ...
0
votes
1answer
28 views
Cannot access wp admin of Wordpress website (security plugin issue) [closed]
I was using all in one WP security and White Label plugin in one of my wordpress website.
I had custom wp-admin login url. After moving host i realized i cannot login via custom url. Also, wp-admin ...
1
vote
0answers
28 views
Plugins Deleted
I have a client whose site was broken by a plugin and instead of deactivating plugins, they deleted some kind of 'visual editor' plugin.
We managed to get the site back up and running and updated all ...
0
votes
1answer
60 views
Is it best to avoid using $wpdb for security issues?
I'm using WordPress Multisite with multilingualpress.
In order to get the href, outside of my navbar, to the page with the appropriate language, I am using an SQL query that queries $wpdb within the ...
0
votes
0answers
22 views
scripts in Wordpress pages are filtered
I have rich snippet scripts I'd like to place on my wordpress pages, for instance:
<script type='application/ld+json'>{"@context": "http://www.schema.org", "@type": "Event", "name":" Reading &...
0
votes
1answer
41 views
Need help for WordPress User Session Management?
I need help regarding WordPress session management. Follow these steps::
Bug: Session management and break authentication.
Steps to reproduce:
Log in to your account using browser 1.
Now, login to ...
0
votes
0answers
19 views
Any way to analyze suspicious password reset requests?
My WP site was recently hacked. I've removed the fake user account that was created, checked for hidden users in the database via phpMyAdmin, I believe I've found most of the added and hacked files ...
0
votes
0answers
24 views
Password protect multiple pages
Is it possible to have the "password protected page" feature of WordPress apply to more than one page? I have multiple pages I wish to protect with the same password, but I don't want people to keep ...
0
votes
2answers
28 views
How to add domain security certification, in WordPress website?
When I visit website using Wordpress Dashboard, browser is showing 'cPanel, Inc. Certification Authority';
But, when I access it directly typing the domain in the URL Bar, no Certification icon is ...
0
votes
1answer
26 views
Should I manually resolve WP Core File security issues or await a subsequent WP release?
Using the Google Developer Tools, I can see that some of WordPress' JavaScript Libraries contain known security vulnerabilities; some a few months old.
With this in mind, should I consider ...
0
votes
1answer
18 views
permalinks constantly needs re-saving
I have my WP running on an Nginx environment, with Wordfence, WP Rocket, and Search&Filter plugins installed (along with some others). Permalinks are working just fine, except /search permalink ...
0
votes
1answer
266 views
Verify nonce in REST API?
I would like to understand the best practices regarding nonce validation in REST APIs.
I see a lot of people talking about wp_rest nonce for REST requests. But upon looking on WordPress core code, I ...
4
votes
2answers
430 views
can not upload file .vtt on wordpress 5.0.1
I updated my site to wordpress 5.0.1, but now I can not upload file .vtt anymore. This function works properly on wordpress 4.9.8
0
votes
1answer
62 views
Who updates the wp-admin/core file?
I can see it's a CDN file and I can't access it. My security plugin alerted me that there had been a modification to the wp-admin/core file, but I didn't change anything. I haven't updated to 5.0 yet. ...
1
vote
0answers
34 views
Best practices to assert current_user_can() with guests
In WordPress, a guest can do a lot of things, such as reading posts.
However, this always returns false for guests:
add_action('wp', function() {
global $post;
/** @var WP_Post_Type $pto */
...
1
vote
1answer
213 views
WP Admin AJAX Security - using POST to include a relative URL
I have set up several WordPress Admin AJAX scripts (that run only in the Admin panel) that currently all use separate actions, functions and nonce's.
The only "real" difference between these scripts ...
1
vote
1answer
26 views
Admin username and password
I use ceber security plugin which protects my site again malicious attacks etc.
I checked today and there were over 20 lock outs. I checked ip addresses and there were no constituencies, they were ...
-1
votes
1answer
31 views
Is my WP site being hacked?
In the past month or so I've seen 3 or 4 new users signing up each day with "awkward" usernames (letters/numbers). Then, a few days later, they start changing their password. And then a few days later ...
0
votes
1answer
260 views
Where i should not use if (!defined('ABSPATH')) { exit; }?
I think this best way to prevent direct access..
<?php if (!defined('ABSPATH')) { exit; }?>
i have used this on all my php files..can it create problems?
any files on WordPress theme i should ...
1
vote
0answers
19 views
Should I check for privileges before hooking into `wp_ajax_$handle` or after?
Should I heck for privileges before even hooking the wp_ajax_hook_name or in the function that I've hooked to it?
The first way:
if( current_user_can( 'manage_options' ) ) {
add_action( '...
0
votes
1answer
29 views
How can I have more confidence that WP plugins aren't getting and storing user data?
How can I have more confidence that WP plugins aren't getting and storing user data? This is in regard to making my website GDPR-compliant.
Perhaps an automatic scanning tool?
Are there any existing ...
0
votes
2answers
61 views
How do I test to ensure that my wp-config file is protected?
Since order allow,deny is deprecated in 2.4 I wanted to rewrite the rules in my .htaccess file to use the new rules. Previously I was using:
<files wp-config.php>
order allow,deny
deny ...
0
votes
0answers
44 views
Ninja Forms security issue
I am working on a WordPress site where there is a security problem found by "WPScan" with the Ninja Forms plugin. Unfortunately, I cannot do these scans myself and only have this info:
The file /wp-...
8
votes
3answers
1k views
Does this .htaccess security setting really work?
What does this .htaccess do?
Am I correct in thinking that all it does is prevent automatic brute force attacks?
So, to access the wp-login.php you have to manually type in the URL of the domain so ...
