You should (if available) submit the code you are working with, even if just a snippet, so we can assess your process in relation to your question. The short answer however is YES, it is safe, so long as you, prevent input fields being displayed on user profile page for certain user roles prevent unauthorized … Read more
You can use wpdb insert function. It’s better in every way. It can care about data’s escapeing itself and it’s shorter. You can use your own query anyway but I would recommended this article for reading https://codex.wordpress.org/Data_Validation#Database
RewriteCond %{REQUEST_FILENAME} -s RewriteRule ^wp-content/uploads/([^/]*\.(pdf|zip))$ filecheck.php?file=$1 [QSA,L] This actually looks OK, except if you have additional subdirectories within the /uploads directory? An alternative is to include an additional condition on the original rule that only rewrites the request if the request ends in .pdf or .zip. For example: RewriteCond %{REQUEST_URI} \.(pdf|zip)$ [NC] RewriteCond %{REQUEST_FILENAME} -s … Read more
There is a plug-in that will send you an email whenever an update becomes available (security updates and otherwise). This will be one of the easiest ways to get notified via email: Update Notifier Alternatively, there are usually emails on the WP-Testers email list immediately following an update. You can always subscribe to that to … Read more
I won’t repeat any of the good advice in Squish’s answer. You should also read this article on WordPress security. I’m just going to cover the specifics of what I learned from my episode. My attack is a kind of black hat SEO known as “hideMeYa”: http://siteolytics.com/black-hat-seo-technique-demystified/ Basically, the attacker slips a bunch of hidden … Read more
Does it need it? Probably not (other than this edge case, props @bravokeyl). Should you add it? In my opinion, yes: From a coding/architecture POV, you’re declaring “this file needs WordPress”. Any direct hit to one of your theme’s files (curious users, bots, “script kiddies” etc.) has the potential to leak a little bit of … Read more
With a dynamic CMS like WordPress, there is no real way to “lock it down.” As the web evolves, formerly unknown security holes are discovered and patched in new versions. In reality, unless you’re always running the latest version of WordPress (currently 3.0.4), your site is in some way vulnerable. If you don’t intend to … Read more
If you read WordPress Nonces in Codex, they have explained it pretty fairly. some of the key points are: always assume Nonces can be compromised. Nonces are a hash made up of numbers and letters. WordPress Verifies any https request with both nonces and user cookies. I believe point #3 is, in short, is how … Read more
Use the admin-ssl plugin. For stuff outside of wp, use rewriite rule in apache
esc_html() does two things: Checks for invalid UTF8 in a string. Converts a number of special characters into their HTML entities, specifically deals with: &, <, >, “, and ‘. Using it instead of __(), _e and other i18n functions protects your website from possible errors that can occur with unaware translators who may use … Read more