I guess there is $_SERVER[‘HTTP_ORIGIN’] property which can be helpful for this point, or even HTTP_REFERER, hooking into the init hook to make sure nothing runs until this origin is allowed, something like: add_action(“init”, function() { global $pagenow; if ( “xmlrpc.php” !== $pagenow ) return; // xmlrpc.php only $domains = array( “example.com” ); // domains … Read more
By default passwords are encrypted using 8 passes of MD5. There are other ways to configure the password encryption. (https://codex.wordpress.org/Function_Reference/wp_hash_password) The hashes are based on custom keys setup in the wp-config file when creating the site. They are stored locally and not on WordPress.com You can make users register to leave comments or you can … Read more
Assuming a developer that is/stays current on relevant security issues creates/manages the site, and a HIPAA compliant (per the regulations) hosting environment is used, forms, uploading, etc. is fine. If you proceed, note that compliance is more than technical. Policies/procedures have to be in place for using/managing the solution as well as incorporating the solution … Read more
GET puts all your params on the URL like; http://example.com/thing?foo=bar&x=y For POST you could include all that information but it won’t show in the URL. http://example.com/thing Obviously if you’re thinking about security, using POST is more ideal because your params won’t show in access logs or accidentally picked up by search engines or whatever. Sending … Read more
Well. If I’m not wrong, you are looking for a way to hide what files are in your plugin directory? Just keep an index.php file in your plugin directory. And as an extra layer of security, add this code at the very beginning of all of your PHP files- // If this file is called … Read more
Currently we have the following typecasting in the WP_Query class (see here): $q[‘posts_per_page’] = (int) $q[‘posts_per_page’]; if ( $q[‘posts_per_page’] < -1 ) $q[‘posts_per_page’] = abs($q[‘posts_per_page’]); elseif ( $q[‘posts_per_page’] == 0 ) $q[‘posts_per_page’] = 1; and here: if ( isset($q[‘page’]) ) { $q[‘page’] = trim($q[‘page’], “https://wordpress.stackexchange.com/”); $q[‘page’] = absint($q[‘page’]); } Instead of running the query for … Read more
You shouldn’t move the file because you’d have to change other files which include wp-config.php and these files will be overridden at your next update, but you can move the content of the file ( at least your credentials) to another file two levels up and include() this file in your wp-config.php This solution should … Read more
The default public search query variable is s but not q. So when you use q, on a vanilla WP install, no posts filtering is done, as expected. You don’t have to take care of possible SQL injections, for the default search query, as it’s taken care of by the core. Here’s an example when … Read more
You can use anyone plugin from below: 1) Strong Password Generator 2) Force Strong Passwords 3) Minimum Password Strength Hope this will helps you.
The _wp_http_referer field is generated by the wp_referer_field() function. I’m not familiar with the hidden send field – however, I’d wager it’s a nonce field. In all likelihood this pair of hidden inputs was generated by a call to the wp_nonce_field() function with ‘send’ as the $name argument and the $referer argument set to true. … Read more