Basic File/Post restriction plugin
Have you tried Members? One of the best I’ve worked with so far.
security
How ‘secure’ are loops?
This loop looks pretty sure to me. You aren’t exposing any raw SQL anywhere, so injection attacks shouldn’t happen.
Data Validation, dynamically generated fields (select for example)
As long as you do not allow anyone to edit/add new countries to your list I don’t see any problems. The content of $ctry_code_sel is only controlled/modified by you. If, on the other hand, you allow users to modify any data you use to generate the select, you should use escaping methods directly during generation, … Read more
Trying to understand nature of hacking
It looks like your server is using Apache’s Combined Log Format. So here’s what’s actually in your logfile lines: 91.207.9.226 {Remote client’s IP address} – {Remote user ID, generally unused} – {Authenticated user ID, unused in most cases} [23/Apr/2013:17:41:19 +0530] {Date} “GET / HTTP/1.1” {Request – here they asked for your site’s home page, essentially} … Read more
Unwanted Links and Spam WordPress Pages and Posts
I forgot to activate Akismet. 🙂
Allowing access to certain WordPress created pages or posts with htaccess / htpasswd
Allowing access to certain WordPress created pages or posts with htaccess / htpasswd
Malware/Permission bug removal?
Malware/Permission bug removal?
Restrict Content for only Contributors via .htaccess
You can create a custom page template for downloads and use something similar to the following: if (current_user_can(‘contributor’)) { echo “<h2>Download Page</h2>”; } else { echo ‘You do not have access to this page”; } You would need additional code to show the file you are offering for download. Alternatively you could set another cookie … Read more
How to rewrite rules for WP-security in Nginx?
Please try this: 1) Save the rewrite rules to the file: /absolute/path/to/wp_security.conf. 2) Then include it in your NginX configuration file, with the line: include /absolute/path/to/wp_security.conf; and place it in the server context: server { #… cut … ## # include the Better WP Security configuration file ## include /absolute/path/to/wp_security.conf; location / { try_files $uri … Read more
Able to go to WordPress admin even after deleting auth cookies from request headers
If you take out the Cookie header, Dev HTTP Client still sends whatever cookies you have for that site. You can verify this with Charles Web Debugging Proxy