Spam injected in w3 total cache page cache [closed]
It is prolly injected in your files. Look at the plugin files, search for eval or base64.
security
How can I password protect a WordPress site without requiring users to log in?
You could add a statement to the end that require them to answer a question if they dont have a cookie set and sets a cookie when they do, allowing them access to the site. I’m on my phone but something like this. <?php if($_POST[‘q’] == ‘answer’) { // set cookie } elseif($_COOKIE[‘q’] != ‘cookie’) … Read more
On new server, site got hacked, permissions a bit strange? Please help
You can… Learn about file permission (on wordpress) Install WordPress Firewall plugin (version 2 for 3+ versions) (this dissalow access to any folder or file indirectly) Hide Your WordPress Version Try to update plugins & Wp install Login Lockdown Plugin (this stops any brute force attemts) Verify that your theme doesnt show “publish by $username” … Read more
How to prevent plugins from sniffing/stealing other plugins’ options?
Actually, there’s not too much you can do. If an intruder has direct access to your site – where they can run get_option() or perform direct SQL queries – then you’ve already run into a problem. The safest bet here is to exercise your best judgement when installing new plugins. In other words, the best … Read more
Side effects of disallowing *.php requests in production environment?
My understanding: They are going to disallow *.php access from external HTTP requests. It should not cause a problem. It’s a common security measure to disallow extension access, and if you are using custom permalink structures, you can get around most of the needs to do so. Since quite a bit of your interactions with … Read more
Contact Form Security
You should use a nonce to protect yourself from CSRF attacks. Even though you’re not sending anything to the database, I’d suggest using some of the built in data validation functions (there is even a is_email function for you to use!) to strip out any HTML from your email. esc_html( striptags( $your_email_content ) ), for … Read more
Security updates to 3.3.2
Since WP 3.1.3 has come out, we’ve released: 3.1.4 – security update 3.2 3.2.1 – security update 3.3 3.3.1 – security update 3.3.2 – security update On a scale of 1-10, skipping a single security update is about a 3 (bad, but not catastrophic). Skipping 4 security updates, though, would be closer to an 8-9 … Read more
Is there any pre-existing plugin to track and block IPs with suspicious activity on my site?
I use http://wordpress.org/extend/plugins/limit-login-attempts/ which blocks IPs when login attempts exceed set limit you set. Limit Login Attempts blocks an Internet address from making further attempts after a specified limit on retries is reached, making a brute-force attack difficult or impossible. If you’re on a host where you can install and run root code, look at … Read more
Any known bugs that could cause disappearance of the wp_users table?
First … I assume you have a backup of your SQL to restore from? It seems odd that you have lost only one table – why not all the tables in the database? Not Hacked htaccess rules corrupt / wp supercache / permalinks?? When you say you can’t login .. is there an error? can … Read more
WordPress custom admin functions security
Read about “Nonces”. Create one and append it to your URL: $url=”example.php?filename=whatever&nonce=” . wp_create_nonce(‘my_sensitive_action’); When your request is fulfilled check for it: // here verify if the nonce was used before if(wp_verify_nonce($_GET[‘nonce’], ‘my_sensitive_action’)){ // it’s ok, it wasn’t used before } Also the validity of these nonces has a time limit, like one day or … Read more