But recent months, several sites of my clients were hacked and I’m concerned about this problem. In my experience pattern of hacks in quick succession indicates a common link. Typically it is vulnerable plugin/theme or incompetent hosting. If you do not consider the option of password brootforcing, how hackers can get access to the file … Read more
If you’re going to add the nonce field to an HTML string, you have to specify that you don’t want it echoed. That’s the fourth parameter; see https://core.trac.wordpress.org/browser/tags/3.3.1/wp-includes/functions.php#L1952 $formDisplay .= wp_nonce_field( ‘contact-form’, ‘_wpnonce’, true, false );
TimThumb has never been bundled with WordPress, it is/was entirely a third-party theme/plugin issue.
The answer is in your question. I try this when login as admin and editor. The roles have the unfiltered_html capability that allows them to put whatever HTML they choose, including <script> tags, where ever they choose. Is is a security risk? Only if you give folks you don’t trust admin and/or editor roles. Or … Read more
In my opinion, the only way to do this (within the context of WordPress) is: if ( ! defined( ‘ABSPATH’ ) ) // Or some other WordPress constant exit; The second technique is vague and does give the same level of checking (it only checks that the filename of the main PHP file matches itself, … Read more
If the “attack” is distributed, the only thing you can do is to change the url of the login endpoint. This should be easy to do with web server config (block /login and friends, map some other “slug” to wp-login.php). This will also break the automatic redirect from /wp-admin to /login which is a good … Read more
First of all, this is intentional behaviour, as relayed in a Slack discussion described in this ticket (this has likely been discussed in other places, but that’s the first I found): tl;dr: CORS is built for CSRF protection, but WordPress already has a system for that (nonces), so we “disable” CORS as it gets in … Read more
Is WordPress MultiSite secure & how much can it scale? WordPress.com — single best example of WordPress Multisite at a large scale. Period. As for the expertise to be able to maintain and manage the cluster — which you should question yourself — it’s a different story. By creating admins for each subdomain, what security … Read more
I believe the correct solution here is to just update the $capability component of the admin_menu items rather than just remove them from the menu structure. Try this: /** Set ‘administrator’ cap for particular menu items **/ function update_admin_menu() { global $menu, $submenu; $menu[10][1] = ‘administrator’; // Media foreach( $submenu[‘upload.php’] as &$item ) { $item[1] … Read more
I’d recommend setting up an API, and also ensuring the sites are HTTPS (have an SSL certificate) to encrypt communication between the servers. If you don’t have one already, there are free certifiers such as https://letsencrypt.org/