Brute force attacks seem to the be most common vulnerability on WP installs Brute force attacks are not WordPress vulnerability. They are password vulnerability, if bad passwords are used. They are common, but if they are “the most common” in occurrences and, more importantly, breaches is questionable. rate limiting ought to be relatively easy to … Read more
No, the requests will still happen, even if it results in a 404. If you keep logging, you’ll also notice attempts to log in to Drupal, Joomla, and other major CMS, including server exploits for IIS Apache and Nginx This is because they’re automated opportunistic requests, they’re not actually looking at your site, they’re only … Read more
To register some new user? Go ahead. As a general purpose registration system? No. Don’t do that. You lose a lot of functionality, like the ability to reset passwords. Take a look at the volume of code in wp-login.php. You are losing virtually all of that and replacing it with about a dozen lines. Other … Read more
wordpress do not encrypt anything at client side, but encryption on client side do not help at all with security, it just make password stronger but do not help at all against Main In The Middle, or eaves dropping attacks. No matter how strong is your password encryption, if you send it over HTTP, once … Read more
Looking at PhpDocs for login_redirect filter I found out that the third param could be a WP_Error object instead of a WP_User: $user WP_User object if login was successful, WP_Error object otherwise. So a working code sample for you would be: function dls160216_login_redirect( $redirect_to, $request, $user ) { if ( ! is_wp_error( $user ) ) … Read more
Your non-wordpress application cannot see the WP cookie because the WP session cookie is only set for the path that WP is installed in (/blog in your example). You can configure WP to create the session cookie for the root path “https://wordpress.stackexchange.com/” so your non-wordpress application can manage it by modifying your wp-config.php, add – … Read more
You are missing quotation marks, closing tags, almost everything: <div class=”account_links”> <?php if ( is_user_logged_in() ) { echo ‘<a href=”https://wordpress.stackexchange.com/my-account/” title=”My Account Page”>MY ACCOUNT</a> <span> | </span> <a href=”http://wordpress.stackexchange.com/my-account/customer-logout/”>LOGOUT</a>’; } else { echo ‘<a href=”https://wordpress.stackexchange.com/my-account/” title=”Login Page”>LOGIN</a> <span> | </span> <a href=”http://wordpress.stackexchange.com/my-account” title=”Create an Account”>REGISTER</a>’; } ?> </div> that should do it.
WordPress triggers a custom hook when certain meta is updated, user meta counts. See updated_{$meta_type}_meta. Here’s an example use case: add_action(‘updated_user_meta’, function( $meta_id, $user_id, $meta_key, $_meta_value ) { switch ( $meta_key ) { case ‘mobile_number’: case ‘address’: $user = new \WP_User($user_id); // user wp_mail($user->user_email, ‘Profile updated’, ‘Profile updated.’); // admin wp_mail(get_bloginfo(‘admin_email’), ‘Profile updated’, “Profile updated … Read more
Don’t edit your wp-config.php file directly. Instead, with PHPMyAdmin, access your database and check for the table _options. You should see entries there for site_url and home_url change those values back to what you need
You may need to use your hosting accounts phpMyAdmin to edit the wp_options table. There are two spots (rows) in that table that contain the URL of your WP site. Change both of the values to your URL, and you should be able to access things.