security

Security issue with ‘paged’ and ‘posts_per_page’ parameters taken directly from a POST request?

Currently we have the following typecasting in the WP_Query class (see here): $q[‘posts_per_page’] = (int) $q[‘posts_per_page’]; if ( $q[‘posts_per_page’] < -1 ) $q[‘posts_per_page’] = abs($q[‘posts_per_page’]); elseif ( $q[‘posts_per_page’] == 0 ) $q[‘posts_per_page’] = 1; and here: if ( isset($q[‘page’]) ) { $q[‘page’] = trim($q[‘page’], “https://wordpress.stackexchange.com/”); $q[‘page’] = absint($q[‘page’]); } Instead of running the query for … Read more

Does this code indicate an exploit?

The _wp_http_referer field is generated by the wp_referer_field() function. I’m not familiar with the hidden send field – however, I’d wager it’s a nonce field. In all likelihood this pair of hidden inputs was generated by a call to the wp_nonce_field() function with ‘send’ as the $name argument and the $referer argument set to true. … Read more

Replace domain in database

I agree that the Better Search and Replace plugin is great for search/replace of the WP database. But be aware that there are many other things you need to do to recover a hacked site. There are many places to get that info, but when I do it, I change all credentials/passwords: database, FTP, hosting, … Read more

How to obfuscate wp-config.php or code

I am not sure why you would like to obfusicate your wp-config.php file. It is not accessible from the outside world and WordPress needs to be able to read the file. If you are going to obfusicate it’s quite easy to get it de-obfusicated. Since you need to alter the WordPress core (not recommended) to … Read more

Prevent editor from adding script or form

By default, editors and admins in a single site installation have the unfiltered_html capability, which means they can insert any JavaScript and forms. If you want to disallow that, you can remove that capability from the editor role as described in Why is javascript allowed in my post content? or using a plugin like Members. … Read more

Switching between security plugins is a risk?

First thing is: a good plugin should always remove its trace when uninstalled completely. Any changes, whether plugin install, enabling new feature etc. should not be done on live server. We developers always do tests on a local server. And a good one for anybody could be Local by Flywheel. If you are desperate to … Read more

Moving wp-config.php outside root folder where we have multiple wordpress websites for enhanced security [duplicate]

Move wp-config.php to its new location somewhere above “public_html” and add a new “skeleton” wp-config.ph in the WordPress directory e.g. <?php include(‘/dir_above_public_html/priv-applecom/wp-config.php’); ?> The wp-config.php script is included by other WordPress files. So to include this from a non default location we can simply 1. move our “real” wp-config from the WordPress directory to where … Read more

+ More