From quick look at the code the post data mostly goes straight into wp_insert_post(), which is a low level function and serves to just store whatever you give it. If you want to enforce the check you could make use of wp_import_post_data_raw filter and probably wp_kses_post().
15 in two days is nothing. I’ve seen thousands per day. If your passwords are good, don’t worry about it but please make sure the passwords are good by nerd standards and not by common standards. If it really worries you, there are plugins out there like Limit Login Attempts that can help and I … Read more
But how to know what is my WP namespace? namespacing a function, in WP land, just means prefixing it with something that makes it more unique and unlikely to conflict with anything else. Generally that means you do both a “vendor” and a “package”. For instance, if I’m building a plugin, my function upload mimes … Read more
No, and what you want is DRM and not security. The base of any measure of security is that only you have “root” level access to the server as the root user will be able in the end to overcome any DRM measure you try to implement. If a contract will not stop him from … Read more
Yes. If you use the generator to create the salts then add them to your wp-config.php file you can start reaping the benefits of much greater security. Any current sessions will be invalidated so you’ll have to log back in but otherwise there shouldn’t be any noticeable change. Automatic generation of random salts was added … Read more
Try looking at this: How to store username and password to API in wordpress option DB? tl;dr: use OAuth, if the web service supports it, or if the web server is run by yoursefl Store the data encrypted in the database, using as encryption wordpress installation-wide unique keys, ad you can see in the link.
Based on the date displayed by your version of OpenSSL, it seems you are seeing the full version displayed there. Open SSL 1.0.1 was released on March 14th, 2012. 1.0.1a was released on April 19th of 2012. So, I’m going to go ahead and assert that openssl version -a is the proper, cross-distro way to … Read more
This sounds like the wrong way around and always having the danger of forgetting or misconfiguring something. If you need content separation, just use a network install. It has a little more overhead of admin but it out of the box ensures the content separation you seek.
I had some problem with Mod_Security, login , Rest API (mobile app access), … You can change roles of Mod_Security
You don’t want to be messing around with that. Look at the following hook: https://codex.wordpress.org/Plugin_API/Action_Reference/wp_login You should do something like: function check_test_user() { // Your code here } add_action(‘wp_login’, ‘check_test_user’); The hook will run as part of the Login process and saves you modifying core WordPress files.