I wouldn’t bother with the readme file as probably no hacker bothers to check your WP version before trying to hack into the site. Will not bother with anything in /wp-includes and /wp-admin because I trust the core team to make that code secure in the default installation, and those file don’t contain any information … Read more
I just encountered the same issue. After quick analysis I found that this file is allowing remote access of your website to a third party which is pretty much dangerous. This is found in wordpress websites that are using nulled wordpress plugins. This file is being generated from these two files bundled inside nulled plugins: … Read more
After upvoting @pieter’s answer…. In recent time I came to the realization that it is much better to handle “bad” data gracefully when it is used (usually it means escaping, but also validation) than at input time. Data corruption can happen not only because of some rouge process “shitting” over your data, but also when … Read more
Just to add to the answer by @birgire, check this post on how to hide the fact that you are using WordPress. I also think that no post basically covers this, but it really help nothing following and applying everything to hide the fact you are using WordPress and to secure WordPress, and your code … Read more
Correct me if I’m wrong, but far as I know, You don’t access directly to any of the files, the apache user does. Meaning, the user browser talks to the server’s httpd process which will get the file from the filesystem. So, i think that if you get a 404 on the browser when directly … Read more
Here is a little snipit of code that I used for my site while it was under construction <?php /* ROUGH METHOD OF DENY ACCESS */ $underconstruct = array(121, 46, 124, 97); if(!is_user_logged_in() && !in_array(get_the_ID(), $underconstruct)) { wp_redirect(get_permalink(121)); exit(); } ?> I put this at the top of my header.php. the $underconstruct array is the … Read more
Though I am no expert in XSS, I do know some of the ways someone can abuse these techniques. For example, I was once pointed to the fact that visitors were able to execute javascript via the search field of a website, because the input of the search field didn’t get stripped of it’s html … Read more
Securing a multi-user permission structure
hSite has no css on mobile [closed]
How to allow internal links using wp_kses filtration