You can make it so no one can register by clicking off “Anyone can register” in your Admin. Furthermore, you can choose a really good password, install a login lockdown plugin and enable logins over https. In most cases this is secure enough. If your really paranoid you can allow access to only your IP … Read more
This should do it: add_action(‘admin_notices’, ‘https_the_content’); function https_the_content() { global $post; if(!$post->post_content) return; //change src to use the current url scheme $post->post_content = str_replace(array(“src=\”http://”, “src=”http://”), array(“src=\”//”, “src=”https://”), $post->post_content); return $post->post_content; }
Add this to your functions.php. I’m not sure if this does any pre-processing though. add_filter(‘comment_text’, ‘wp_filter_nohtml_kses’);
The WP-Security plugin is pretty good for this, and a few other wordpress security related things, it is my solution to lock down basics on security for every wordpress install I do.
I figured I’d just look in the Android application’s source code to see how it communicates. You can quickly see XML-RPC in the source. So another way to access the blog is using WordPress XML-RPC support. It was improved and enabled by default in version 3.5 very recently. I don’t understand why they brought it … Read more
This is a false alarm. Many “Security Programs” do that. That’s called FUD. WordPress does not check the Referer header, because it is often empty, and real spammers send the site URL as Referer anyway. But all comment field are sanitized, so no harmful code will be injected. Install an anti-spam plugin, and everything is … Read more
I figured it out. Turns out that using the field name was the culprit. It appears that name and other field names like attachment, attachment_id, etc will cause WordPress to produce a 404 error. There’s a whole list of reserved terms in the Codex.
Only way to base access on url users come from is to rely on $_SERVER[‘HTTP_REFERER’], but as official php docs says: Not all user agents will set this, and some provide the ability to modify HTTP_REFERER as a feature. In short, it cannot really be trusted. One chance is to use a secret key and … Read more
If you are printing the URL out, say to the front end… that is, it is to be displayed as a normal URL to a visitor etc. then: esc_url() If you are going to use the URL in, say, a WordPress redirect (or anything else that sends http header ‘location’, then you will need: esc_url_raw() … Read more
Login pages are not made of wood and continuous attacks do not weaken them. The whole point of having strong passwords is that however many attacks are performed against the user the probability of successful guess in your lifetime is zero. Best way to protect your user accounts are by having strong password. If you … Read more