I’m currently working on a plugin to do this on a large scale, since I have multiple sites that I want to sync; but I don’t mind sharing the info with you. I understood [from what you said] that the user’s credentials have already been verified on site2 – so there’s no need to use … Read more
@birgire has a right answer And they can use WPScan for example, with a brute force attack on wp-login.php I recommand to rename your login page, you can do it manually or with a plugin.
Correct way check nonce (security) using old Options API
ok, so it seems I overlooked a previous question asked here on stackexchange. For anyone interested, the solution might be found here: brute force attack even though it is limited by IP
I found the problem. The links to the Network Admin are incorrect. For example, network users have: http://my-local-cms.dev/wp-admin/network/ It should be (if wordpress core is located in backend/) http://my-local-cms.dev/backend/wp-admin/network/ If you visit the first link and add /backend/ before wp-admin in the browser, then the network admin will behave correctly. Fix Edit 2017-08-30 New solution: … Read more
I’ve had a look at WordPress’ core code and couldn’t find anything really useful to add a filter on the post password. You could use the filter wp_insert_post_empty_content, it is used to check whether the required fields of the post are set or not (e.g.: title). Here is an example on how it could be … Read more
Coding a plugin on WordPress; when should I sanitize? [duplicate]
WordPress Content Security Policy and Subresource Integrity
Nonces, AJAX, script variables & security in WordPress
Should I add the IP of the server that hosts my sites to the list of authorized IPs in the wp-admin/.htaccess?