security

How can I disable new plugin and theme install, but allow updates?

This would probably make a job done, although using die is not the pretty way add_filter( ‘upgrader_package_options’, function( $options ) { if ( isset( $options[‘hook_extra’][‘action’] ) && $options[‘hook_extra’][‘action’] === ‘install’ && isset( $options[‘hook_extra’][‘type’] ) && in_array( $options[‘hook_extra’][‘type’], [ ‘plugin’, ‘theme’ ] ) { die(‘Plugins & Themes installation disabled!’); } return $options; } );

Reject all malicious URL requests functions.php

All publicly visible sites on the internet get hit with ridiculous URL requests fairly often. These come from script kiddies (low-rent cybercriminals, the kind of children who think they’re l33t or something) trying to get your site to misbehave and give them access using (mostly) old tricks that exploit long-fixed bugs. Some of the tricks … Read more

Are major WordPress updates mandatory for security?

Yes and no, it depends. When a security issue is fixed, it’s usually backported, so officially the answer is no, you don’t have to update to the latest major release. However Backporting only goes back so far though, and you’ll eventually be left in the dark given enough time. This would take many years currently, … Read more

+ More