The PHP files in the wp-includes directory will do nothing when accessed directly. They are designed to be include()‘d in an existing PHP script, such as on the front-end or in the dashboard. Your Options -Indexes entry in the .htaccess file simply prevents a list of the files in a directory when no index.php is … Read more
1, the nonce lifetime is about 24 hours by default actually. take a look at wp_verify_nonce function. To be more accurate, the lifetime is controlled by filter apply_filters( ‘nonce_life’, DAY_IN_SECONDS ); 2, if the lifetime value makes you doubt if it is “an implementation side-effect”, you may want to add_filter(‘nonce_life’,create_function(‘$v’, ‘return 60*5;’)); to shorten the … Read more
You could create a dummy user (with no rights) and log in every visitor using this dummy user. This could be done pretty easily: wp_set_auth_cookie($uid, true); wp_set_current_user($uid); But in my opinion that’s a rather flawy workaround. Your main problem is that all pages for not-logged-in users come from the page-cache. That also means that all … Read more
As pointed out in the comments by @kaiser, your question is very similar to this question. In fact, the question itself holds the answer. To disable all feeds add the following code… function itsme_disable_feed() { wp_die( __( ‘No feed available, please visit the <a href=”‘. esc_url( home_url( “https://wordpress.stackexchange.com/” ) ) .'”>homepage</a>!’ ) ); } add_action(‘do_feed’, … Read more
Option 1 – Process some data on your system I wouldn’t place all of the plug-in’s processing on your own server, but pick one or two vital functions and keep them hosted on your system. Then require an API key for each site that uses the plug-in so that they can communicate with your server. … Read more
About changing the login url, i already did by mysel. It help me protect my site and prevent brute force You can change it in htaccess. But you also need to add the filter to replace old login url in wordpress. Example to my website: File .htaccess: RewriteRule ^signin(.*) wp-login.php?%{QUERY_STRING} In your theme or custom … Read more
You can safely move it as far as I know…. but what do you mean folder? Up one level would already be a folder…. if your site is in html, or public_html or whatever, you place the wp-config file in whatever folder holds your html or public_html folder like if your path is /home/content/u/s/e/user/html/ And … Read more
Short answer: No. You can use normal strings for actions, md5’ing them doesn’t change anything. The nonce is built from three main pieces of information: Time: The current time() divided by 43200 is worked into the nonce. This is what lets the nonce be changed every 12 hours (43200 seconds in 12 hours). The action … Read more
The password strength meter in the latest versions of WordPress uses a library called “zxcvbn”, made by Dropbox in 2012. The library is available for free on Github: https://github.com/dropbox/zxcvbn An explanation of the library is here: https://blogs.dropbox.com/tech/2012/04/zxcvbn-realistic-password-strength-estimation/ But the short version is that it analyzes patterns in the password instead of being a simple “does … Read more
You should pass the special wp_rest nonce as part of the request. Without it, the global $current_user object will not be available in your REST class. You can pass this from several ways, from $_GET to $_POST to headers. The action nonce is optional. If you add it, you can’t use the REST endpoint from … Read more