security

Standard Method for Securing a WordPress Site

If you are looking for some kind of “set it up and forget it” security solution, then you are going to be disappointed. There are things that can help mitigate risks, such as firewalls and obscuring your installation, but ultimately a site will only be as secure as the software that runs it and the … Read more

Replacing nav-menus.php file with standard clean one?

To answer your question, you can find the original file in the WordPress Github repository. However, when a WordPress website is hacked and has malware infected files it is recommended to reinstall the entire site with a clean install (without plugins), check the database for infected entries and change all (WordPress, database, etc) passwords. When … Read more

Passing form data on submit

First check that it’s not empty, then typecast to a string value as a security precaution, because it’s always possible for this to be submitted as an array; e.g., by an attacker. Then unslash, sanitize, and continue by checking length and anything else that you’d like to validate. if ( ! empty( $_POST[‘contact_msg’] ) ){ … Read more

Where to store publicly-accessible files

I think that would depend how you’ve made your site private? I’ve used this plugin to set sites to private https://wordpress.org/plugins/jonradio-private-site/ It also has settings to exclude any URLs from being set to private. There are a bunch of other plugins that do similar thins.

DISABLE wordpress upgrade page

You can actually do this on the web host without actually any PHP code. Using the same procedure as is recommended to deny access to wp-config.php, you can also deny access to upgrade.php. All you need to do is create a file named .htaccess in wp-admin and put the following in it: <files upgrade.php> order … Read more

+ More