How do I protect user_activation_key?
How do I protect user_activation_key?
security
How can I safely hide the fact that my website runs on WordPress? [closed]
How can I safely hide the fact that my website runs on WordPress? [closed]
Large Session Tokens
No idea what happened, but the end user was having issues with his computer and somehow it was hanging on to those cookies. Since they weren’t expired, nothing we did to remove them did a lot of good but getting the end user to clear cookies/cache resolved the issue. I’d love to know more about … Read more
Do I have to face security problems if I changing default role to Contributor
No, that generally should be fine. Should, because the more access a user has, the more bugs he generally can trigger (or exploit), but from a conceptual point of view, it should be fine. I personally wouldn’t feel too secure with random people having access to my WP backend, but that might just be an … Read more
Verifying that I have fully removed a WordPress hack?
Have you identified the exploit vector? If not, you may be leaving yourself open to future exploit. Other things to consider: Change WordPress admin user passwords – done Change Hosting account user password Change FTP passwords Change MySQL db user password – done Change the db table prefix Update your wp-config nonces/salt Check your directory/file … Read more
Force to use STRONG users password and implement rule to prevent REUSE [closed]
You might want to start here https://codex.wordpress.org/Customizing_the_Login_Form which discusses customizing the login form, and has info on the code file used therein. You will need to ‘hook’ into the login form using available hooks (also detailed at the above link). Also, my comment above: “Password history rules imply that you will need to save previous … Read more
Reset Password policy
Reset Password policy
Logout USER form backoffice after 30 minutes of inactivity [closed]
Logout USER form backoffice after 30 minutes of inactivity [closed]
404 redirect wp-login and wp-admin after changing login url [closed]
Untested with your code but assuming it will be automated bots hitting your login pages you should get them straight off your site with something like this: RedirectMatch 301 wp-login.php http://www.google.com RedirectMatch 301 wp-admin http://www.google.com
Is wp_kses the right approach in sanitizing this string?
Is wp_kses the right approach in sanitizing this string?