I won’t repeat any of the good advice in Squish’s answer. You should also read this article on WordPress security. I’m just going to cover the specifics of what I learned from my episode. My attack is a kind of black hat SEO known as “hideMeYa”: http://siteolytics.com/black-hat-seo-technique-demystified/ Basically, the attacker slips a bunch of hidden … Read more
Does it need it? Probably not (other than this edge case, props @bravokeyl). Should you add it? In my opinion, yes: From a coding/architecture POV, you’re declaring “this file needs WordPress”. Any direct hit to one of your theme’s files (curious users, bots, “script kiddies” etc.) has the potential to leak a little bit of … Read more
With a dynamic CMS like WordPress, there is no real way to “lock it down.” As the web evolves, formerly unknown security holes are discovered and patched in new versions. In reality, unless you’re always running the latest version of WordPress (currently 3.0.4), your site is in some way vulnerable. If you don’t intend to … Read more
If you read WordPress Nonces in Codex, they have explained it pretty fairly. some of the key points are: always assume Nonces can be compromised. Nonces are a hash made up of numbers and letters. WordPress Verifies any https request with both nonces and user cookies. I believe point #3 is, in short, is how … Read more
Use the admin-ssl plugin. For stuff outside of wp, use rewriite rule in apache
esc_html() does two things: Checks for invalid UTF8 in a string. Converts a number of special characters into their HTML entities, specifically deals with: &, <, >, “, and ‘. Using it instead of __(), _e and other i18n functions protects your website from possible errors that can occur with unaware translators who may use … Read more
This has very little to do with wordpress, but if this answer will help eliminate the usage of session, it might be worth it…. Sessions are stored on the hard disk of the server. This is problematic in a shared hosting scenarion because the session directory is most likely readable and writable by all process … Read more
From the codex: wp_filter_kses should generally be preferred over wp_kses_data because wp_magic_quotes escapes $_GET, $_POST, $_COOKIE, $_SERVER, and $_REQUEST fairly early in the hook system, shortly after ‘plugins_loaded’ but earlier then ‘init’ or ‘wp_loaded’. The first set is then preferred. More of a question of, “is stripping slashes more secure than not?” They both use … Read more
In a perfect world, you don’t need sanitize your querys because the WordPress ORM avoids sql injections going to the database, but is extremely recommended to clean your input data, particularly if is input data provided by a visitor. For example, you can use something like this: $name = sanitize_text_field( $_POST[‘name’] ); // WP_Query arguments … Read more
Normal cookies, as used by WordPress to keep you logged in for a certain period, are the way to check whether a user is logged in. Even if you close your computer they will be there when you switch it on again. Session tokens are something different. They are meant to transfer information between several … Read more