It’s not the code in the form, but how you process the form’s data. I put this in my main ‘include’ file; it sanitizes all input data. The key is to never trust the form data without verifying it is valid. This code helps in that. // this sanitizes all gets/posts for security $_GET = … Read more
Security of your WP site is more than that (admin user, database password), although that is a good start. I’d create admin-level user that is not named ‘admin’, with a strong password. You could even change the user id so that it’s not #2 (it’s easy enough to enumerate users by id). create a strong … Read more
Although this is not the place for hacking questions … a quick look seems to indicate attempts to get database credentials, and to upload files that can be executed later. One file it looks for (and tries to inlcude) is ‘command.php’. So take a look if that file is there. You could also look at … Read more
How to store sensitive user data (passwords)
As you hint at, it sounds like intuitively very bad design to have one key for all users that’s hard coded in your app. You can’t retract that key without breaking the app for all users, and you can’t limit access easily if one user e.g. overloads your API. If you do this, you may … Read more
Securing WordPress running on Azure platform
If not, how do I clean the incoming variables? In most cases you don’t, get_posts calls WP_Query internally, and WP_Query performs some sanitization, namely via wpdb->prepare. However, for what you’re trying to do, this is the wrong approach. Just use a standard search.php template with a standard post loop, and use input fields that have … Read more
hide theme files for admin beneath root
You can add the following in your functions.php file to deregister the old included jQuery and register the new jQuery. Using a newer version of jQuery might make some plugins stop working, so you’ll have to check to see if all your plugins will work with the newer version. function mytheme_register_scripts() { wp_deregister_script( ‘jquery’ ); … Read more
Is it okay to use an ACF field to store a password for a protected area of a page?