Require that emails be verified before registration is completed. Captcha Use Honeypot Project Install Akismet Require Facebook, Twitter, or another service for registration. You won’t be able to stop all spam but you can fight the majority of them.
It doesn’t provide any serious defense against a targetted attack. If your server is being targetted then, as you say, they will port scan you and find out where your doors are. However, moving SSH off the default port of 22 will deter some of the non-targetted and amateur script kiddie type attacks. These are … Read more
You can move the wp-config file one level up. You can also create a .htaccess file and upload it to your uploads folder with this code: <Files ~ “.*..*”> Order Allow,Deny Deny from all </Files> <FilesMatch “.(jpg|jpeg|jpe|gif|png)$”> Order Deny,Allow Allow from all </FilesMatch> Or install a plugin for security which also scans your installation so … Read more
You do it the same way you protect the company from head of Sales running off with your client list, or the head of Accounting embezzling funds, or the Stock manager from running off with half the inventory, largely: Trust, but verify. At the very least, I would require that all passwords for all Administrator … Read more
functions.php is not more nor less secure than any other file in your WordPress installation, just like post meta is not more nor less secure than any other table in your WordPress database. That means that they are secure until your site is hacked. So question become “is WordPress secure?” and I think that: that … Read more
Plugins on wordpress.org has always been a debateble question for me. According to my opinion all plugins submitted to wordpress.org should be tested thoroughly and should be bug free. However, I come across many highly used plugins that are not up to scratch. More that 50 percent of plugins I’ve tested have some kind of … Read more
It may be coming from theme or plugin you are using. Sometimes developers forget to remove any echo statement (or any other debugging approach) which they use while developing. You can first disable all plugins. If this still comes up, then it is somewhere there in the active theme. If this goes away after you … Read more
If you’re wanting to limit by a capability (built in or custom) you can use current_user_can() and pass the appropriate capability. if( current_user_can(‘manage_options’) ) { echo “Hi there user who can manage options’; } Keep in mind that the post or page content is one chunk and you would need to do something much more … Read more
Don’t do it? Passwords meant to be remembered not stored, and once you store them in extractable format (i.e. without hashing or other sort of many to one transformation) they become a less effective security measure. As with any security related question, you have to start with defining what is it that you trying to … Read more
I think your paradigm is not optimal. You are starting on premise of “WordPress Ajax endpoint is slow” and your solution is to “build alternate authentication scheme”. This completely spells trouble. Anything security should be reused as much as possible and coded by people specializing in security. Trade-off of reimplementing security for the sake of … Read more