If you know the sub-net of your VPN you could restrict access to /wp-admin via .htaccess using standard Apache rules. <Directory /var/www/wp-admin/> Order deny,allow Allow from 192.168.1.0/24 Allow from 127 </Directory> Obviously you’d need to adjust the directory and IP address subnet to suit your needs. To restrict access to a specific file: <Files _FILE_.php> … Read more
This article has a bunch of great answers to your questions. I highly recommend checking it out to learn more about the scale of this issue, but I can give a quick rundown. SVG, since it’s XML based, makes it really hard to decipher what is and what isn’t malicious. At one end, it opens … Read more
Have you tried updating the permissions for your WordPress files to 755 or 777? UPDATE 1 Thanks to @anu in the comments (~/Sites assumes you put websites are in the Mac’s default website directory): cd ~/Sites sudo chmod -R 777 * I just checked my httpd.conf file, which has the path /Applications/XAMPP/etc/httpd.conf and here is … Read more
What you (and probably 99% of the theme authors) are trying to do is just wrong. Users should not be expected to know CSS to customize a theme, and if they do need to go into such a low level, the right thing for them to do is to create a child theme and insert … Read more
According to the WP_Session_Tokens class documentation, this token is used to validate the user’s session. It does this by checking the provided token against the existing session tokens stored in the user meta table for that user. Session tokens are generated using the wp_generate_password function, and are 43 characters long. So no, it should not … Read more
I know this question is ancient, but no, it’s not very secure. Anyone with knowledge of the AJAX endpoint would be able to generate valid nonces, which defeats the purpose in the first place. That being said, nonces are a low level defence in the first place: they only stop the simplest of attacks. A … Read more
Contrary to what you have been looking at, esc_html does not strip all the HTML, it escapes it, meaning it encodes it into safe HTML entities that do not break HTML tags. wp_filter_nohtml_kses strips all the HTML. When in doubt always consult the source code. It is accessible online. esc_attr is short and sweet, uses … Read more
I found this: Exclude Users from Members directory on a BuddyPress based social network We will need to hook to ‘bp_ajax_querystring’ filter. The following code will allow to exclude the users from the members directory. They will be still listed in the friends list of other users with whom they are friends with. add_action(‘bp_ajax_querystring’,’bpdev_exclude_users’,20,2); function … Read more
If I follow the description right the vulnerability refers to PHP applications which read, trust, and use HTTP_PROXY environment value (which might be compromised). From quick search through WordPress core source code I found no instances of that value being accessed. Since WP ships its own HTTP client implementation its also not affected by upstream … Read more
Why not just disable comments and registration? This comes to mind also: (Redirect all requests to login page or admin pages to homepage. A little irreversible.) $currentURL = $_SERVER[“HTTP_HOST”] . $_SERVER[“REQUEST_URI”]; if (strpos($currentURL, ‘wp-admin’ ) or strpos($currentURL, ‘wp-login’ )) { header( ‘Location: ‘.site_url() ); } Caution: this stops you from logging in also. Edit: And … Read more