Search type Search syntax
Tags [tag]
Exact "words here"
Author user:1234
user:me (yours)
Score score:3 (3+)
score:0 (none)
Answers answers:3 (3+)
answers:0 (none)
isaccepted:yes
hasaccepted:no
inquestion:1234
Views views:250
Sections title:apples
body:"apples oranges"
URL url:"*.example.com"
Favorites infavorites:mine
infavorites:1234
Status closed:yes
duplicate:no
migrated:no
wiki:no
Types is:question
is:answer
Exclude -[tag]
-apples
For more details on advanced search visit our help page
Results tagged with Search options answers only user 736

Strengthening themes, plugins and core installation to prevent intrusion.

3
votes
The only way to do this would be to whitelist the allowed arguments, being very careful to limit them so as not to introduce an DOS attack vector. Having said that, this is not how most infinite scro …
answered Sep 13 '16 by Tom J Nowell
9
votes
escaping is to generate valid HTML, the added security it provides is just a nice side effect. To prevent users accidentally breaking markup There are many reasons to escape, but fundamentally … for markup validation, for security, etc Having said that, escaping is not validation, escaping is not sanitisation. Those are separate steps that happen at different points in the life cycle …
answered Mar 27 by Tom J Nowell
1
vote
If the file isn't an image, its mime type is checked against the allowed list. As your example would generate a text mimetype, and it's an allowed file extension, it passes through. There should be n …
answered Jan 9 '18 by Tom J Nowell
2
votes
What you're doing at the moment is okay, but there are far far better ways to do it. The problem of man in the middle attacks here is that to insert yourself between wordpress.org and a server at a d …
answered Apr 4 '14 by Tom J Nowell
2
votes
indicate the author, custom meta, user meta, etc Instead, consider marking the admin as a subscriber, and reassigning the posts to a brand new user. TLDR yes it will improve security, but mainly because you cant hack a site if it's completely broken …
answered Apr 11 '13 by Tom J Nowell
2
votes
large spikes, sometimes as consistent background noise. If you're worried about your security though, I'd suggest that you: Add a brute force login mechanism, such as the one included in Jetpack, or … isn't anything you can do to eliminate the possibility short of a major breakthrough in computer security research. Moving your login page will either break things, or it'll only work for those bots …
answered Apr 11 '15 by Tom J Nowell
2
votes
wp-config.php includes files, it's not just a config file, and WordPress isn't built to allow putting the file 2 levels up. However, WordPress already supports loading wp-config.php from 1 level up. …
answered Feb 14 by Tom J Nowell
0
votes
Always use the most recent version of WordPress, security fixes are always made to the latest version. The only time this isn't the case is in that rare situation that an older version of WordPress …
answered Apr 5 '16 by Tom J Nowell
0
votes
No, I would expect wp_user_update to have been what gets used, but I find your motives dubious, and cannot think of a reasonable use for what you want to do But if you really want to go down this pat …
answered Aug 13 '17 by Tom J Nowell
8
votes
small speed loss is magnified thousands of times But consider that if you're not careful you may compromise the security of these functions by undoing the escaping they added, or adding unescaped … you value the security of your code Does this mean I should just use esc_html? No, escaping is all about setting expectations. If you're expecting an attribute, use esc_attr. Just because it's functionally the same at the moment, doesn't mean that won't change in the future with a security release …
answered Apr 24 '17 by Tom J Nowell
10
votes
Any that return data. If a function outputs internally, then it's taken responsibility for escaping if a function returns the data for use, it will be unescaped to avoid double escaping, it's your r …
answered Jan 6 '18 by Tom J Nowell
2
votes
No, functions.php would generate PHP fatals if loaded directly as it uses the WordPress API. If functions.php tried to bootstrap and load WordPress however, then yes, it would be necessary, but if yo …
answered Jun 18 '16 by Tom J Nowell
2
votes
themes and plugins may be secure: http://ocaoimh.ie/exploit-scanner/ Also make sure all other WordPress installs on the server are similarly secure. For more details on securing your WordPress install, you can search this site and elsewhere, WordPress security is a heavily documented subject. …
answered Jun 26 '12 by Tom J Nowell
9
votes
your database. Depending on the security of your install, they can create a user for themselves, log in, upload a plugin via zip with a PHP Shell script, and start issuing commands or use the site …
answered Sep 3 '14 by Tom J Nowell
3
votes
validate all data at entry, and that is where you should focus your efforts. What your doing improves your security but by how much depends on where the data is coming from. I recommend you escape all data on input and output, but do it out of habit rather than for specific exceptional cases …
answered Jun 28 '12 by Tom J Nowell

15 30 50 per page