As per comment it is hard to answer this without knowing specifics of setup. In general there are two generic approaches to this: Prevent unwanted terms from being returned by filtering get_terms_args or other available hooks. Prevent unwanted terms from being saved (or cancel them right after) by hooking somewhere in wp_insert_post(). The more complex, … Read more
As far as i know you cannot rename wp-admin. Many themes and plugin uses wp-admin in path. So if you rename it then all your plugins and themes will be broken. If you don’t want your users to access wp-admin then restrict it using .htacess If anyone access your wp-admin url redirect them to other … Read more
Some underlying functionality borrowed from http://wordpress.org/extend/plugins/auto-expire-passwords/ , and tweaked. Untested, but along the lines of what you are looking for, so YMMV. function custom_forced_password_reset( $user ) { update_user_meta( $user->ID, ‘password_was_force_reset’, true ); } add_action( ‘password_reset’, ‘custom_forced_password_reset’ ); // Ensure all new register users have the flag set function custom_forced_password_user_register($user_id){ update_user_meta( $user_id, ‘password_was_force_reset’, true ); } … Read more
I am setting up Subdomain based MU on my domain. Just remember, what used to be called “WordPress MU” is now “WordPress Multisite.” It’s not a separate application, just a configuration setting you use within WordPress. Will I be better off setting the MySQL user’s domain as localhost, 127.0.0.1 or with a wildcard %.mydomain.com? Which … Read more
Akismet comes pre-installed with WordPress. You will, however, need to activate it from the ‘Plugins’ menu and sign up for an API key (free plans are available). And no, captchas are not needed (Akismet catches almost everything), but you can find a plugin to add one if you wish. If you’re concerned about sercurity, I … Read more
That security hole in W3 Total Cache was associated with data leaking through an exploit, and not explicitly with hackers changing code (that could happen afterwards, of course, but what you show isn’t this). The exploit has been fixed so just make sure your plugin is up to date. If unsure, disable / delete the … Read more
If you worry only about the admin panel then esc_html will be enough as it will convert every “<” into < eliminating the possibility of having a valid HTML tags inserted. But if you add the CSS to the generated HTML you might need to strip any HTML tag it may contain by using the … Read more
That is the response it gives when it you have the “Intrusion Detection” or the “Login Limits” features enabled, and the plugin has intentionally blocked you. It can block you by either username or by IP address. The plugin can be configured to email somebody when a lockout occurs with the reason for that lockout. … Read more
We experienced this just last night. xmlrpc.php Lots of traffic to xml-rpc.php is a classic sign of a WordPress pingback attack. By default, pingbacks are turned on in WP. A non-malicious user/website uses this mechanism to notify you that your website has been linked-to by them, or vice versa. A malicious user can exploit this. … Read more
I’m sure you’ve googled ‘khabarnaak’ – it’s a Pakistani talk show. It’s more likely to be an automated scraper trying to find content rather than an attack. The request does not look like it has been crafted for a WordPress site. Two ways to stop it are: Block the IPs making the request. Add ‘Deny … Read more