I wouldn’t say security concern – since you’re using this plugin within the admin (I presume after the user has been authenticated i.e. after admin_init), then already you’ve got protection against any Jon Doe posting a form to your script. What it does provide, is an additional layer of authentication. All it really boils down … Read more
There’s much more than just those three functions. As it would be too much to write 5 blog posts (or even a whole book) about it, I’m just going to give you some reads as starting points: One of the rare good articles on WP Tuts+ 1) QueryPosts.com is the way to read source code, … Read more
Network Admin URL is shown to anyone before accessing a blog
Are un-sanitized theme options more vulnerable to malicious scripts than the theme editor?
You can instruct IIS to provide to wp-login a redirect_to parameter towards wp-admin/; this will do the trick: <rule name=”login” patternSyntax=”ECMAScript”> <match url=”^loginUrl/?” /> <action type=”Rewrite” url=”wp-login.php?redirect_to={UrlEncode:http://{HTTP_HOST}/wp-admin/}” /> </rule> By the way, thanks for posting this question, it’s helping me to understand better the working of redirects and rewrites in IIS. I found this reference … Read more
To disable directory browsing all you have to do is drop in a blank index.html file into the wp-content\uploads directory, each subsequent sub-directory also would need a blank index file, there are plugins that can automatically do this for you. ps. Get a better host, there is no reason they should disallow you having your … Read more
It should be fine and secure, as Horttcore mentioned it isn’t making any database or backend changes it is simply displaying the tinymce editor. There are other plugins you could use of course but I don’t see any problems doing exactly what you are doing. To answer your other question, I believe the text/visual switch … Read more
As already suggested in a comment above of mine, technically a (cookie based) session is limited to one IP at a time by using the Safer Cookies (WordPress Plugin). This does not prevent another login with the same username and password because it is a feature of WordPress to allow you to login multiple times … Read more
Malware installation during plugin update?
Can I Remove xmlrpc.php completely?