security - Read For Learn

Could a user account with a stolen password compromised entire WP site?

Any subscriber can’t do any harm to your site even if he wants it. https://wordpress.org/support/article/roles-and-capabilities/

Problem with permissions in wp-content/plugins

Best thing to do is check the WP docs themselves for correct file/folder permissions and how to change them, if needed: http://codex.wordpress.org/Changing_File_Permissions Typically, all files should be owned by your user (ftp) account on your web server, and should be writable by that account. On shared hosts, files should never be owned by the web … Read more

Basic File/Post restriction plugin

Have you tried Members? One of the best I’ve worked with so far.

How ‘secure’ are loops?

This loop looks pretty sure to me. You aren’t exposing any raw SQL anywhere, so injection attacks shouldn’t happen.

Data Validation, dynamically generated fields (select for example)

As long as you do not allow anyone to edit/add new countries to your list I don’t see any problems. The content of $ctry_code_sel is only controlled/modified by you. If, on the other hand, you allow users to modify any data you use to generate the select, you should use escaping methods directly during generation, … Read more

Trying to understand nature of hacking

It looks like your server is using Apache’s Combined Log Format. So here’s what’s actually in your logfile lines: 91.207.9.226 {Remote client’s IP address} – {Remote user ID, generally unused} – {Authenticated user ID, unused in most cases} [23/Apr/2013:17:41:19 +0530] {Date} “GET / HTTP/1.1” {Request – here they asked for your site’s home page, essentially} … Read more

Unwanted Links and Spam WordPress Pages and Posts

I forgot to activate Akismet. 🙂

Allowing access to certain WordPress created pages or posts with htaccess / htpasswd

Malware/Permission bug removal?

Restrict Content for only Contributors via .htaccess

You can create a custom page template for downloads and use something similar to the following: if (current_user_can(‘contributor’)) { echo “<h2>Download Page</h2>”; } else { echo ‘You do not have access to this page”; } You would need additional code to show the file you are offering for download. Alternatively you could set another cookie … Read more

+ More