If you give the provider full admin, they can technically do anything to your server that PHP would be able to do (by using the editor part of a given theme to add whatever commands they like). PHP is capable of running command line scripts, just to name one scary permission they would inherit. Depending … Read more
I had to also change the owner of the root web directory. chown apache:apache . # or chown apache:apache /var/www/html Edit by Otto: Chloe, as you asked for more information than I could reasonably put into a comment, I’m appending this on to your answer. I hope that is okay. If not, feel free to … Read more
»The only truly secure system is one that is powered off, cast in a block of concrete and sealed in a lead-lined room with armed guards – and even then I have my doubts.« (Gene Spafford) The lost password feature might potentially be a risk, but if you are keeping it or not is just … Read more
You cannot be 100% sure you are safe. Check this Security reading from WordPress. That been said, there are some things you can do. Keeping WordPress Updated Keeping theme and plugins Updated Use Strong Passwords You can use a Security Plugin, although it’s arguable. When a client request it I use Sucuri. Change the Default … Read more
The plugin has a filter drh_allow_rest_api which determines whether the current user has full access and can skip the whitelist check. By default this is just is_user_logged_in(): /** * Allow carte blanche access for logged-in users (or allow override via filter) * * @return bool */ private function allow_rest_api() { return (bool) apply_filters( ‘dra_allow_rest_api’, is_user_logged_in() … Read more
Check to see if a person is logged in: <IfModule mod_rewrite.c> RewriteCond %{REQUEST_FILENAME} (.*) RewriteCond %{HTTP_COOKIE} !wordpress_logged_in_([a-zA-Z0-9_]*) [NC] RewriteRule .* – [F,L] </IfModule> The same applies as it did 10 years ago. This code in .htaccess doesn’t have anything to do with how WordPress might be setting cookies. And this does not “check to see … Read more
I would definitely not advise you to enforce this policy. For example, I can enumerate through your list of authors by simply entering yoursite.com/?author=1, yoursite.com/?author=2, etc into my browser. This will take me to your author pages. If your users were savvy enough, they might have set their public display name in Users/Your Profile to … Read more
This isn’t a question of quantity. You have to understand what each plugin does to say whether it is necessary or not. Let’s say we have three “security” plugins: One enforces strong passwords. One blocks aggressive log-in attempts. One sends you an email when your PHP version is behind the latest security release. Having these … Read more
I know that when i disable the WordPress updates its mainly to allow me to first test the updates and then go and update in my clients sites instead of them just clicking links around and usually messing things up.
First of all, report whoever is doing it. You obviously could block anything with a query-string that contains screw-you, but that’ll only help in this case. Maybe Drop any requests with HTTP/1.0 (browser don’t use it, and “good” bots like google don’t either, but if you need to provide access to special tools, you might … Read more