Many plugins (and themes) use user levels, you shouldn’t use them in yours. They are still used in WordPress probably to offer backward compatibility with the huge number of plugins and themes that use them. WPCS will throw a warning whenever it busts user levels in code.
If your aim is security, the only directory writable by the web server should be uploads. Yes, it means no easy updates, but in a secure environment the web server should not be able to write to directories in which there is executable code. If you have so many updates that SFTP becomes too much … Read more
Since i was also looking for some sort of keeping submitted images, i found this simple plugin, which gave me a bit insight: https://wordpress.org/plugins/store-file-uploads-for-contact-form-7/ Also if you read a bit on the mentioned “file-uploading-and-attachment” topic in cf7, you should get the point: For security reasons, specifying files outside of the wp-content directory for email attachments … Read more
by default the editor role should not have access to plugins nor appearance menu. But maybe this roles is already customised in your installation? here is a list of editor default capabilities via functions.php you can remove everything in the appearance menu like so: $role_object = get_role( ‘editor’ ); $role_object->remove_cap( ‘edit_theme_options’ ); to remove access … Read more
You have to add yourself to group www-data. sudo usermod -a -G www-data yourUserName Don’t forget the -a, which appends the new group to your existing groups. Otherwise you loose all other groups.
Are you sure that a _doing_it_wrong notice isn’t being issued? You won’t see the notice visibly output on the page because that would break the JSON response. But if you look in the headers of the response you should see a X-WP-DoingItWrong header. It should also appear if you use a plugin like this to … Read more
You need to give the editor role the ‘edit_theme_options’ permission, but that will also unlock other theme options like widgets to those users.
Sometimes hosting providers will implement mod_security (and not mention anything). Or else, mod_security was already on but a recent installation of a plugin or theme may have exposed this new problem for you. You can try these four things… Add the following to your .htaccess file (add to .htaccess, don’t replace the other stuff already … Read more
WRT to your question “need to apply the class if another class is present and the user’s role is (whatever)” The easiest was to do this, isn’t in the code, but yet in the CSS. You can target an element that has more then once class. So, using your class PARTNER_STAR and if your other … Read more
The WP-Security plugin is pretty good for this, and a few other wordpress security related things, it is my solution to lock down basics on security for every wordpress install I do.