security

wp enqueue script – How to securely set dynamic HTML content with JavaScript?

Question

Description I have implemented a frontend script that gets a few text options from the server via wp_add_inline_script. When the user does an action the content should dynamically change to one of the given texts.I want

Josef Wittmann 2 months 0 Answers 0 views

security – WP-JSON: Cross Origin Resource Sharing Vulnerability?

Question

I am testing the security of a webpage owned by the company I work for. I noticed that an arbitrary origin is accepted. In the screenshot below, you'll see that I added that example origin which was reflected in the response accordingly. I am no

UbuntuNoob 2 months 0 Answers 0 views

plugins – How do I fix “IP Location Error: Failed to locate IP address” error?

Question

I realized that the wordfence scan gives server state error(scan stage failed) and here is the some part of the log file of this problem: [Nov 26 04:08:57:1669435737.893317:2:info] Attempting to resume scan stage (1 attempt(s) remaining)…

Ronomor 2 months 0 Answers 0 views

How can I turn on SHORTINIT via functions.php

Question

I want to turn on the SHORTINIT constant in my WordPress site to speed up my admin-ajax. The problem is I know I can define it to be true in wp-config, but I am wanting to do it via the functions.php. How can I do that? Also, any suggestions or code I can use in functions.php to speed up my a

Rajin Sharwar 3 months 0 Answers 0 views

security – Securing REST API wp-json/wp/v2/users endpoint

Question

I am fiddling with the WP REST API to allow updating users through a Javascript connector. I am using JWT plugin for this purpose. The issue is that o

Riccardo 4 months 0 Answers 0 views

uploads – How to parse an image that was just uploaded to make sure it doesn’t contain malicious code?

Question

Let's assume that an user has just uploaded an image. How do we make sure that the image doesn't contain hidden PHP code that will run once the image is on the server? The most common (and, for practical purposes, the only one) attack pa

Mark Robinson 5 months 0 Answers 0 views

Prevent direct access to WordPress plugin assets?

Question

I was wondering if there was a simple way to prevent direct access to asset files within a WordPress plugin. Primarily javascript files. I'm developing a plugin that's meant to be used only in the admin dashboard, and I would like the javascript f

Dan 7 months 0 Answers 0 views

security – htaccess if requested url is /wp-admin

Question

I need some help with my .htaccess. I want this lines only execute if the url is not /wp-admin. Header add Content-Security-Policy "default-src 'self';" Header add Content-Security-Policy "script-src 'self';" My ide

hendrik-eg 8 months 0 Answers 0 views

security – User media folder for each users on registration

Question

i need to create a "user folder" in media library for user registration using usermeta field, for example "billing_company".. so, my purpose is to procect file url inside that folder from unlogged users and logged users with different usermeta field/emai

Fabio 8 months 0 Answers 0 views

plugins – Website show Google Ads when we have no Google Ads linked to our website

Question

Today we noticed that one of our website has started showing random Google Ads on our website when we have not added any Google Ads to our website. I would appreciate if someone can help in case they have faced such scenario. I am not sure

Learning 10 months 0 Answers 0 views