WordPress uses scripts and styles from these folders to function. You can not hide them, there is no security concerns with these folders, only public files can be accessed directly. Everything else can not. Dont waste your time here. If you want to be secure add things like captcha, login limits, and strong passwords to … Read more
This sounds like bad news. There are many technical and legal hurdles involved in collecting bank info online. It is easy to mess up. All SSL does is protect information in transit between a browser (person filling the form) and the server. Once it gets to the server you need to handle it properly. If … Read more
Even when WordPress is running version 3.1, sites are still being defaced. Even? There had been one major and five security releases since that version. If you are implying that 3.1 should be reasonably secure – it is not. but the only answer seems to be outdated WordPress sites What had you done to exclude … Read more
Well we found one reason anyway – it looks like you can bring up a list of authors using ?author=1 query, which I hadn’t even known existed. Here’s an article that explains how and how to fix it: https://www.wp-tweaks.com/hackers-can-find-your-wordpress-username/
Try this one instead http://wordpress.org/extend/plugins/si-contact-form/ The safest thing to do is just have no contact form and a plain old email link.
What permissions should I set on each of wp folders? Users will need to upload various assets (images, pdfs, office docs, audio, video). I found this article here that seems helpful, but would like to get some input from folks having done this? This will be the same as any other web server. Whatever user … Read more
You’re misinterpreting the is_admin() function. It’s not a tag to check whether or not the user is an admin, it’s a template tag to check if you’re on an admin page. From the Codex: This Conditional Tag checks if the Dashboard or the administration panel is being displayed. This is a boolean function, meaning it … Read more
RE: Username – admin Since version 3.0 the installer asks the user to provide a username for the main account, you obviously won’t get this option if you upgrade from an older version(because it’s not a new installation). You can see an image of this here: http://codex.wordpress.org/Installing_WordPress#Step_5:_Run_the_Install_Script RE: Blocking malicious users There’s no real effective … Read more
The parent directory (which I don’t have access to) uses htpasswd, but I can override this for my directory only by adding Satisfy Any to .htaccess. This fixes the issues I was having. I’m ok with disabling the authentication temporarily to run a scan and turning it back on afterwards. More info on disabling htpasswd … Read more
Yes, this seems to be appropriate use of insert() method, which does call prepare() method on data internally. Note that %s is considered to be default for it and can simply be omitted, if no other data and formats are involved.