You need to stop listening to people who says PHP and WordPress is not secure. Its how you do it. You can do it in WordPress, without using BuddyPress. In fact you don’t even need it for anything. All you need to make default users contributors, and a small plugin which takes care of their … Read more
Just use the post_password_required() conditional: <?php if ( post_password_required() ) { // Post is password-protected; do something } else { // Post is NOT password-protected; do something else } ?>
Yes it is still relevant, WordPress is very subject to query based attacks. It is more common and easier to attack bad plugins/themes, so even if your WordPress version is kept up to date, it’s still a good idea. There is a better plugin called Mute Screamer, it uses a central PHPIDS database. http://wordpress.org/extend/plugins/mute-screamer/
wp_authenticate_username_password in wp-includes/user.php and wp_check_password in pluggable.php I would advise against meddling with these though unless you’re removing the wordpress user authentification and putting your own in, e.g. http://wordpress.org/extend/plugins/simple-ldap-login/. For the best part, not using the admin username, making the first account a non super admin, not using wp_ database prefix, putting salt values in … Read more
…is there any other plugin out there that will do EXACTLY this Not a plugin, but yes – this is the standard behavior of the comment moderation system in WordPress. BUT if ANY user visits bob.com and posts a comment containing the blocked email, website url or any other blocked material, then the IP of … Read more
WordPress is only as secure as you make it. Open registrations should not be a problem if you: Use CAPTCHA for registrations. Use double opt-in: have users verify their email after they register. By default, registered users must be subscribers and after they are verified, you can set them as authors. WordPress users cannot by … Read more
You got hacked. Use http://sitecheck.sucuri.net/ to check to see sucuri detects the signature. Tell your host; if they don’t want to help, consider changing hosts to someone more secure, like Recommended WordPress Web Hosting See FAQ: My site was hacked « WordPress Codex and How to completely clean your hacked wordpress installation and How to … Read more
Only benefit… It is easy to remember, I suppose…
Validate input values and sanitize outputting data. Take a read good article about Data Sanitization and Validation With WordPress, it will make you understanding these principles better.
wpdb::_insert_replace_helper() will escape the data: return $this->query( $this->prepare( $sql, $data ) ); But still … the base64 encoded string looks odd. That should have been four separate parameters, I think.