You’ll want directories to have 755 and files to have 644. you can navigate to your www directory and use these 2 commands: find . -type d -print0 | xargs -0 chmod 0755 # For directories or find . -type f -print0 | xargs -0 chmod 0644 # For files (Obviously don’t input the # … Read more
No. WordPress sanitizes the search query. To use the sanitized search query, use the_search_query() to echo, or get_search_query() to return, the search query. Edit Based on your edit: Don’t use $_GET[‘s’]. Use get_search_query(). Don’t use $_GET[‘cat’]. Use get_the_category(). All $_GET and $_POST data should be assumed to be inherently unsafe, and should be sanitized/validated accordingly.
The TLDR No, it is not, for various reasons, but fundamentally it’s a security via obfuscation, a misleading/bad concept Breaking it Down Question by Question I have downloaded a theme from WordPress theme directory (abc) and i renamed it to (xyz). Great, .org plugins have a review process and get taken down or adjusted if … Read more
You do cite experience with WP going back farther than that of mine… Yet I do not see these issues as that major. What scale of sites are we talking about? It’s fairly slow I feel this is bit too much of generalization. Slow can be put in context of specific hardware, tasks and level … Read more
As suggested by @Jeff Mattson, hours of research and testing suggest that this is probably due to mod_security. I also investigated the likelihood of it being due to Suhosin, but I don’t think it’s to blame. Here’s the deal. It doesn’t really help if we verify that the problem is due to mod_security. We don’t … Read more
Yes, you can do this and it does not matter if plugins are different for the two sites, as you are not not using the same tables or anything. Still, if you use plugins that are badly written and build resource urls on top the home url, these will have issues (404 errors mostly).
That is basically the way WordPress does it and pretty much the only way to do it, simply have your receiving PHP function create a new nonce add send it back with your response, then just update the value on your JS before the next round.
Searching this Stack, I can see two possible solutions for this question (not tested). One The answer is not fully developed, but can provide some insight. Restricting access to files within a specific folder Two How to Protect Uploads, if User is not Logged In? Frank Bueltge’s answer seems interesting but the code is quite … Read more
As already suggested in a comment above of mine, technically a (cookie based) session is limited to one IP at a time by using the Safer Cookies (WordPress Plugin). This does not prevent another login with the same username and password because it is a feature of WordPress to allow you to login multiple times … Read more
First: Remove those 777 permissions. You need this only in cases with conflicting ownership. Try to run PHP as FastCGI – for example per .htaccess: AddHandler php-cgi .php # or AddHandler php-fastcgi .php Set up a notification mail for every 404 request. You will be surprised how many attacks the average blog gets each day. … Read more