$.ajax results in 403 forbidden
$.ajax results in 403 forbidden
security
Blocking wp-login in HTACCESS has also blocked password protected pages
Unfortunately a Password Protected post uses the wp-login.php file to process the password authentication for a post. So your Apache snippet of blocking all but those specific IPs is going to apply to anything that is password protected as well. You can get nerdy and read code. In here you can see that Post Password … Read more
Can someone do something to my website if I posted a snapped image of the header and covered my logo? (On reddit, when explaining a question)
Can someone do something to my website if I posted a snapped image of the header and covered my logo? (On reddit, when explaining a question)
Block JSON access over the net
You have two way to proceed: 1) Use the .htaccess file to exclude the folder from begin listed 2) Exclude the json files from crawlers scan by adding them inside the robots.txt file.
WordPress Database Re-installed (Hacked)
It looks like one of your plugins/themes is vulnerable and allows anyone to modify your database. For example ThemeGrill themes have such vulnerability lately. Another possibility is that your site got hacked and there’s some backdoor placed on it. In both cases you should: check all your site clean it update it secure it.
Should I prevent access to .htaccess and wp-config.php files?
Should I prevent access to .htaccess and wp-config.php files?
Specific Page/Post Need to Stay Non SSL
I have found a solution. This plugin gives the option of set SSL on or off based on post or page https://really-simple-ssl.com/downloads/really-simple-ssl-per-page/
Why does my admin email address keep changing to something random?
if your admin email changes, I suppose it’s not a good signal, so it’s very important understand why it’s happening. Some malware usually have this behaviours, so I think you can start from: have you checked if your plugins, theme and WP core are updated to latest versions? if no – backup all and proceed … Read more
Security when outputing wp_oembed_get code
wp_ombed_get() will only process URLs from whitelisted oEmbed providers. The list of supported providers is available here. This means the only code that can be output is embed code from those providers. These are the same providers that WordPress supports for URLs in content, or the embed block in the block editor, so you be … Read more
prevent anonymous access to WordPress site (non-admin site)
Add this to the top of your header.php file, or a file that will be loaded at the top of every page. <?php if(!is_user_logged_in()) { wp_redirect(‘/wp-login.php’); exit; } ?> Someone will probably point out a reason why not to do this, but it’s the first thing that came to mind.