A simple solution I use in a .htaccess: RewriteCond %{REQUEST_URI} !^/wp-admin [NC] RewriteCond %{QUERY_STRING} author=\d RewriteRule ^ – [L,R=403] It is similar to @jptsetme’s answer, but it works even when the query string is /?dummy&author=5, and the search pattern for RewriteRule is very fast: You often see a capture ([0-9]*) in regular expressions for this. … Read more
Usually, you don’t need it. But … there is at least one edge case: If a theme file is a template part, and it is using global variables from the calling context (parent file), and register_globals is on, and it is just using these variables without any security check … … an attacker can call … Read more
This code snippet will hide the users, posts, and comments endpoint results and give 404 as the result, while the rest of the API calls keep running as they were. ::UPDATE:: add_filter(‘rest_endpoints’, function(){ $toRemove = [‘users’, ‘posts’, ‘comments’]; foreach($toRemove as $val) { if (isset($endpoints[‘/wp/v2/’.$val])) { unset($endpoints[‘/wp/v2/’.$val]); } if(isset($endpoints[‘/wp/v2/’.$val.’/(?P<id>[\d]+)’])) { unset($endpoints[‘/wp/v2/’.$val.’/(?P<id>[\d]+)’]); } } return $endpoints; }); … Read more
Roles are stored in the global variable $wp_roles. The ideal function is get_editable_roles() from /wp-admin/includes/user.php function get_editable_roles() { global $wp_roles; $all_roles = $wp_roles->roles; $editable_roles = apply_filters(‘editable_roles’, $all_roles); return $editable_roles; } The “editable” part is because it offers other plugins a chance to filter the list in case someone other than admin has ‘edit_users’ privilege (and … Read more
This is just, how I understood the idea of the WordPress File API. If it is wrong, please downvote 🙂 Okay. If you upload a file, this file has an owner. If you upload your file with FTP, you login and the file will be owned by the FTP user. Since you have the credentials, … Read more
Unfortunately it’s not currently possible nor does there appear to be will to consider it as a modification as you can see by this recent thread on the wp-hackers list and this ticket on trac. If you’d really like to see this be revisited I’d suggest: Present your case on wp-hackers but be forewarned your … Read more
If you have a good full backup of your website, restore your site from it (recommended). Install and set up WordFence plugin (as in case of no backup). If you don’t have good backup: Immediately delete all files from this list. Get a clean copy of your version of WordPress, and clean copy of your … Read more
Only checking if the cookie exists, is not much of a strict protection. To get a stronger protection, you can pass or “proxy” all requests to the uploaded folder (exemplary uploads in the following example) through a php script: RewriteCond %{REQUEST_FILENAME} -s RewriteRule ^wp-content/uploads/(.*)$ dl-file.php?file=$1 [QSA,L] All requests to uploaded files (which includes images in … Read more
Have you identified the exploit vector? If not, you may be leaving yourself open to future exploit. Other things to consider: Change WordPress admin user passwords – done Change Hosting account user password Change FTP passwords Change MySQL db user password – done Change the db table prefix Update your wp-config nonces/salt Check your directory/file … Read more
The biggest WordPress giveaways are between the <head> </head> tags. Example WordPress head content output by The Twentyten Theme and how to remove: <link rel=”profile” href=”http://gmpg.org/xfn/11″ /> Remove directly from header.php <link rel=”stylesheet” type=”text/css” media=”all” href=”http://example.com/wp-content/themes/twentyten/style.css” /> Hide WordPress by calling your stylesheet from another location and change the wp-content directory. WordPress requires your theme … Read more