We will use the my_force_login() function that will force the users to login when they press on a specific category. Wp-login.php if ( ( empty( $redirect_to ) || $redirect_to == ‘wp-admin After this condition ends write this part if ($user_name == “student”) { wp_safe_redirect(“http://www.domain.co.il /?cat=4”); } else { wp_safe_redirect($redirect_to); } Inside the condition write the … Read more
My (managed) dedicated server, with several sites (not all of which use WP) has been hacked. OK, it happens. Not the end of the world. Today, I find permissions changed to 200 – which I suspect might have been done by my service provider (although I’ve not received notification, nor yet an answer to my … Read more
wrote something long and decided to delete because the Tl;Dr is use a good password and stop pretending to have a knowledge in how to secure sites, you are more likely to bring down the performance of the site (your reverse DNS code) or lock yourself out then actually preventing an attack. Security is about … Read more
Security – Ajax and Nonce use [closed]
File Upload Permissions
No. This is a security risk. Not only morality question. I checked some of these plugins and found most of all of these are infected. For instance, they will use base64encode functions and evaluate in the end to send info from your web site to URLs in Panama, Iran or like. They may write to … Read more
From the code it seems like your warning comes from doing the redirect too late. redirects should be done, as a rule of thumb, not later then the init action. And after the redirect you should die() (I don’t think the wp_redirect does it for you) As for security, it is not enough to check … Read more
WordPress is also an XML-RPC server. So I guess these bots tried to gain access through the XML-RPC protocol via the xmlrpc.php file in your WordPress root directory. It’s possible to login and most likely your security plugin is picking up failed login attempts when wp_authenticate() is called and the wp_login_failed hook is activated. Here’s … Read more
XMLRPC is as secure as the rest of WordPress. All of the requests need to be authenticated with username and password credentials that exist on your site already. That means, if someone has a login for your site, they can use the XMLRPC interface (if it’s turned on). But anonymous users can’t get in. The … Read more
After studying carefully 🤓 the WordPress REST API Handbook concerning Home / REST API Handbook / Extending the REST API / Routes and Endpoints Home / REST API Handbook / Extending the REST API / Adding Custom Endpoints I realized I made a couple of mistakes. Therefore, I wanted to share with you my findings. … Read more