In short no. The long answer. As an admin they have complete control of the content and options of the site, and (usually) what code is executed on the server. You can disable plug-in & theme editing/installing: define( ‘DISALLOW_FILE_EDIT’, true ); define( ‘DISALLOW_FILE_MODS’, true ); (in your wp-config.php) but they can still do ‘damage’ by … Read more
Renaming admin user on multisite install by MySQL
For doing this you have to change Post Visibility Settings This can be done when you are posting a post. just see on right side or near publish button there will be a visibility option which is public by default this can be edited.. Visibility: Public just click edit and choose password protected radio botton … Read more
How do I get around “Sorry, this file type is not permitted for security reasons”?
WP is reasonably secure for default use cases. In typical workflow it will call wp_check_filetype_and_ext() to verify that file uploaded is of allowed type. It can get considerably more questionable in regards to security if you customize it to work with non–default kinds of files and you might need to implement your own security checks. … Read more
You should always sanitize all inputs regardless of who or where they are coming from. Not only is it good practice (which helps ensure that you don’t accidentally get comfortable skipping it and miss it elsewhere), but it ensures that that particular feature is secure in the future. For example, you may wish to expand … Read more
There is no need to stop “plugin enumeration”, just use plugins from a good home and make sure you have restrictive file permission setting on your server. In theory you can use htaccess to mask the original location of the plugin on the disk and write some code to serve any JS and CSS file … Read more
My first thoughts are to SSL the entire site due to the nature of the project. There are also things you can do to forms to make them safer, when recently reading the Stripe payment gateway documentation they suggest not adding a name attribute to the fields in the form until the final second with … Read more
I didn’t test it but I think you could use this plugin https://wordpress.org/plugins/wp-ban/ that should solve these issues
Hide username discovery