37 votes

What security concerns should I have when setting FS_METHOD to "direct" in wp-config?

What's the risk? On a poorly configured shared host, every customer's PHP will execute as the same user (let's say apache for discussion). This setup is surprisingly common. If you're on such a ...
Mark's user avatar
  • 471
33 votes
Accepted

Best way to eliminate xmlrpc.php?

Since WordPress 3.5 this option (XML-RPC) is enabled by default, and the ability to turn it off from WordPress dashboard is gone. Add this code snippet for use in functions.php: // Disable use XML-...
Charles's user avatar
  • 2,287
30 votes
Accepted

WordPress 4.7.1 REST API still exposing users

This code snippet will hide the users, posts, and comments endpoint results and give 404 as the result, while the rest of the API calls keep running as they were. ::UPDATE:: add_filter('rest_endpoints'...
BlueSuiter's user avatar
  • 1,178
15 votes
Accepted

What are nulled themes?

Nulled theme basically mean cracked/hacked. The distributors of such themes often hide popups/ads inside to earn money, which you can't see until a user complains about it or you check the website on ...
knif3r's user avatar
  • 401
14 votes
Accepted

Should we use plugins that aren't available from the official WordPress site?

There is no definite answer as each plugin, whether available in a repo or not, should be handled on its own merit. Also, who says that that plugin caused your site to get hacked, it might have being ...
Pieter Goosen's user avatar
12 votes
Accepted

Does WordPress sanitize arguments to WP_Query?

It's actually a good question. Of course user input cannot be trusted, but also sanitizing the same value twice "just in case" isn't the best solution for a problem. The only real answer to ...
Álvaro Franz's user avatar
11 votes
Accepted

Which WP functions do you need to use esc_html() or esc_url() on?

Any that return data. If a function outputs internally, then it's taken responsibility for escaping if a function returns the data for use, it will be unescaped to avoid double escaping, it's your ...
Tom J Nowell's user avatar
  • 59.2k
11 votes

Verify nonce in REST API?

You should pass the special wp_rest nonce as part of the request. Without it, the global $current_user object will not be available in your REST class. You can pass this from several ways, from $_GET ...
Lucas Bustamante's user avatar
10 votes
Accepted

Why "Contact Form 7" doesn't update PHPmailer library?

PHPMailer is not part of the plugin, it is shipped with WordPress. So it is up to WordPress to keep it up to date. There is a patch already in ticket #37210. In the mean time, you can create a mu-...
fuxia's user avatar
  • 107k
10 votes
Accepted

esc_attr() right way and use

No you don't need esc_attr() function to print out fixed static text. You only need it to print out dynamic or generated text, so that if the attributes have any special characters that may break ...
Fayaz's user avatar
  • 8,909
10 votes
Accepted

What is the difference between esc_html filter vs attribute_escape filter?

It would appear that out of the box, there isn't a difference function esc_html( $text ) { $safe_text = wp_check_invalid_utf8( $text ); $safe_text = _wp_specialchars( $safe_text, ENT_QUOTES );...
Tom J Nowell's user avatar
  • 59.2k
10 votes
Accepted

Why escape if the_content isnt?

If I were a hacker with access to the database, wouldn't I just add my code to a post's content? If you've got access to the database, chances are that you've got enough access that escaping isn't ...
Jacob Peattie's user avatar
9 votes

Best way to eliminate xmlrpc.php?

When you have the ability to block it via your web server's configuration, @Charles' suggestions are good. If you can only disable it using php, the xmlrpc_enabled filter is not the right way. Like ...
tweber's user avatar
  • 191
9 votes

Can someone explain the use cases of esc_html?

esc_html__( string $text, string $domain = 'default' ) Retrieve the translation of $text and escapes it for safe use in HTML output. so esc_html__() use to make internationalize as well as security ...
Shamsur Rahman's user avatar
9 votes

WordPress 4.7.1 REST API still exposing users

/** * Wrap an existing default callback passed in parameter and create * a new permission callback introducing preliminary checks and * falling-back on the default callback in case of success. */ ...
drzraf's user avatar
  • 191
9 votes
Accepted

Are there procedures to prevent malicious plugin updates?

TLDR: No. It's all about trust. So there are some very basic checks on wp.org but generally this can happen (and probably also does happen from time to time). Of course if something like this happens ...
kraftner's user avatar
  • 5,598
9 votes

Does this .htaccess security setting really work?

It appears to prevent any POST requests to wp-login.php that aren't made from a page on my-domain.com. When the browser sends a POST request, say after submitting a form, it will include a HTTP ...
Jacob Peattie's user avatar
9 votes

Why escape if the_content isnt?

I'm actually an engineer at VIP who does a lot of code review :) I flag a lot of missing escaping. but does not escape output Not quite, it doesn't escape on output, which is surprising to most ...
Tom J Nowell's user avatar
  • 59.2k
8 votes

wp_verify_nonce vs check_admin_referer

NO! BEWARE !!! Don't count on check_admin_referer() without correct parameters! Because, in some cases it may not die() (as opposed to your expectations), instead it will just return the false ...
T.Todua's user avatar
  • 5,789
8 votes
Accepted

How do I technically prove that WordPress is secure?

Tell your client to read up on cybersecurity, because his premise is nonsense. Security through obscurity has been discredited since 1851 (yes, that's one and a half century ago). The opposite is also ...
cjbj's user avatar
  • 14.5k
8 votes
Accepted

Where i should not use if (!defined('ABSPATH')) { exit; }?

The point of that code is to prevent any PHP inside the file from being executed if the file is accessed directly outside a WordPress context. ABSPATH is defined by WordPress, so if it's missing when ...
Jacob Peattie's user avatar
8 votes
Accepted

Sanitize get_query_var() url parameters

There's a slight disconnect between your question title and the actual question. It sounds like you're using a plugin (or developing a plugin?) that allows for some front-end sorting. If it's a ...
butlerblog's user avatar
  • 4,986
7 votes

How does admin-ajax.php work?

For unauthenticated and untrusted users, you'll want to make two specific exceptions to your VPN / Firewall / Apache .htaccess, which are: example.com/wp-admin/admin-post.php example.com/wp-admin/...
haz's user avatar
  • 630
7 votes

Best way to eliminate xmlrpc.php?

We are using the htaccess file to protect it from hackers. # BEGIN protect xmlrpc.php <files xmlrpc.php> order allow,deny deny from all </files> # END protect xmlrpc.php
Jorin van Vilsteren's user avatar
7 votes
Accepted

Understanding SVG vulnerabilities in Wordpress related to a specific fix

This article has a bunch of great answers to your questions. I highly recommend checking it out to learn more about the scale of this issue, but I can give a quick rundown. SVG, since it's XML based,...
socki03's user avatar
  • 1,932
7 votes

Is it good to rename theme folder downloaded from WordPress.org?

Renaming the theme is unlikely to do any good. The theme might break and you may miss out on (security) updates. And it most likely won't help you really obscure the theme, because often enough the ...
cjbj's user avatar
  • 14.5k
7 votes
Accepted

Protecting direct access to PDF and ZIP unless user logged in (without plugin)

RewriteCond %{REQUEST_FILENAME} -s RewriteRule ^wp-content/uploads/([^/]*\.(pdf|zip))$ filecheck.php?file=$1 [QSA,L] This actually looks OK, except if you have additional subdirectories within the /...
MrWhite's user avatar
  • 3,881
7 votes

Does this .htaccess security setting really work?

What this doesn't prevent: Brute Force all it does is prevent automatic brute force attacks? No. This does not prevent brute force attacks. In a brute force attack, an attacker has control over ...
tim's user avatar
  • 243
6 votes

Getting a List of Currently Available Roles on a WordPress Site?

For those which have multilingual site, function function wp_roles_array() { $editable_roles = get_editable_roles(); foreach ($editable_roles as $role => $details) { $sub['role'] =...
Jasom Dotnet's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible