Tips & Tricks
WordPress Security Hacks
Hi guys this is my first post on wpcult the great site Austin built. Hope you guys find it usefull.
If you run a blog using the wordpress software then your blog is a target to hackers. Below I will list some hacks and just how they can help you keep your business/site safe.
The following is code to Block Bad Queries and protect your blog from malicious URL Requests.
Place the following code into a text file and name it what ever you like for example blockbadqueries.php upload it to your plugin folder and activate it in your wordpress admin just as you would any other Plugin
<?php
/*
Plugin Name: Block Bad Queries
Plugin URI: http://perishablepress.com/press/2009/12/22/protect-wordpress-against-malicious-url-requests/
Description: Protect WordPress Against Malicious URL Requests
Author URI: http://perishablepress.com/
Author: Perishable Press
Version: 1.0
*/
global $user_ID; if($user_ID) {
if(!current_user_can(‘level_10’)) {
if (strlen($_SERVER[‘REQUEST_URI’]) > 255 ||
strpos($_SERVER[‘REQUEST_URI’], “eval(“) ||
strpos($_SERVER[‘REQUEST_URI’], “CONCAT”) ||
strpos($_SERVER[‘REQUEST_URI’], “UNION+SELECT”) ||
strpos($_SERVER[‘REQUEST_URI’], “base64”)) {
@header(“HTTP/1.1 414 Request-URI Too Long”);
@header(“Status: 414 Request-URI Too Long”);
@header(“Connection: Close”);
@exit;
}
}
}
?>
This Great plugin was made by Jeff Starr of Digging into WordPress
Protecting your blog with .htaccess
.htaccess files have lots of possibilities. below is some code that will help protect your wordpress from modification of _REQUEST and/or GLOBALS and scripts injection.
This is real simple just paste the following code into your .htaccess file. Always make a backup of your .htaccess before editing, better to be safe.
Options +FollowSymLinks
RewriteEngine On
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
RewriteRule ^(.*)$ index.php [F,L]
Thanks to Oussama for this great hack
Tips & Tricks
How to: show/hide a widget in WordPress with jQuery
In a previous post I talked about how to show/hide a single div html code with a search inside. Today I’d like to show you how I implemented jQuery into my new theme.
As seen in the current theme, I am using jQuery to animate the show/hide or as known as the css style display: none;.
Since I am using a custom child theme on my site, and have Hybrid theme as my parent, the widgets or sidebar section is different than may be in your theme. But just apply the the style’s as follows to your theme.
First make sure that your WordPress site is calling jQuery, by plugging in this code into your header.php file above the <?php wp_head(); ?> text:
<?php wp_enqueue_script('jquery'); ?>
Then anywhere above the </head >, plug this code in:
<script type="text/javascript">
function toggleWidgets() {
$('#primary h3.widget-title').addClass('plus');
$('#primary h3.widget-title').click(function() {
$(this).toggleClass('plus').toggleClass('minus').next().toggle(180);
});
}
$(document).ready(function() {
toggleWidgets();
}
</script>
That’s it. Pretty simple huh.
So lets go over what the code does.
$('#primary h3.widget-title').addClass('plus');
This line finds all <h3> tags with the class widget-title inside the ID parameter of #primary and adds a class of plus.
Then
$('#primary h3.widget-title').click(function() {
$(this).toggleClass('plus').toggleClass('minus').next().toggle(180);
});
Will apply a click function. When the H3 tag is clicked it will remove the class plus and add the class minus.
Then the code that says .next will then toggle the “next” element after the <h3> title.
Tips & Tricks
How to: Create a fbshare.me shortcode
Social networks are everywhere. I am sure you’re on facebook. Well why not at a facebook share script to your site?
Don’t know PHP that well?
Well here is a simple way to add a share script like fbshare.me to your site, via shortcodes.
Paste the following code in your functions.php file in order to create your shortcode:
function fbshare_script() {
return '<div class="fbshare"><script src="http://widgets.fbshare.me/files/fbshare.js"></script></div>';
}
add_shortcode( 'fbshare', 'fbshare_script' );
Once done, you can display the facebook share button anywhere on your posts. In WordPress editor, make sure you are in HTML mode and insert the following: [fbshare].
When your post will be published, the shortcode will be replaced by the fbshare.me button.
Last week I wrote how to “Use WordPress to print a RSS feed for Eventbrite attendees“. It was pretty popular, but then I found myself in a place that was more annoying. Trying to incorporate that into a blog post or page.
Without having to download a plugin that will allow PHP to be executed inside a post, I would have to create a template file and use that. Which is what I did, and it works just fine. But for some reason I forgot all about shortcodes! With a shortcode, I could generate all the PHP in the functions file and then just call the shortcode when/where I want.
Okay, so lets show the completed PHP code:
function attendee_feed_print_2009() {
global $wpdb;
include_once( ABSPATH . WPINC . '/rss.php' );
$rss = fetch_rss( 'http://www.eventbrite.com/rss/event_list_attendees/384870157' );
$items = array_slice( $rss->items, 0 );
if ( empty( $items ) ) echo '<ul style="list-style-type: none; list-style-image: none; list-style-position: outside;"><li>No items</li></ul>';
else
foreach ( $items as $item ) : ?>
<ul style="list-style-type:none; list-style-image:none; list-style-position:outside; margin-bottom: 0px">
<li><!--<strong><?php echo $item[ 'title' ]; //User name ?></strong><br />-->
<?php echo $item[ 'content' ][ 'encoded' ]; ?>
<hr style="border: 1px solid #ddd; margin-bottom: 8px" />
</li>
</ul>
<?php endforeach;
}
Now, this code has to be changed for it to work as a shortcode. We’ll have to return the function and not print/echo it.
I also wanted to be able to use multiple instances of the code with different feeds. To do so I had to create a argument to extract from the completed short code. I found a demo at: Alex Mansfield’s post.
Remember this:
function attendee_feed_print_2009() {
global $wpdb;
include_once( ABSPATH . WPINC . '/rss.php' );
$rss = fetch_rss( 'http://www.eventbrite.com/rss/event_list_attendees/384870157' );
We are going to update it to read as follows ( changes in bold ) :
function attendee_feed_print_2009( $rss_nbr ) {
global $wpdb;
extract( shortcode_atts( array( 'rss' => ''), $rss_nbr ) );
include_once( ABSPATH . WPINC . '/rss.php' );
$rss = fetch_rss( $rss );
And the final code with the fields updated to return the arguments ( put into your functions.php file ( in between <?php ?> ) ) :
function attendee_feed_print_2009( $rss_nbr ) {
global $wpdb;
extract( shortcode_atts( array( 'rss' => ''), $rss_nbr ) );
include_once( ABSPATH . WPINC . '/rss.php' );
$rss = fetch_rss( $rss );
$items = array_slice( $rss->items, 0 );
$rss_html = '<div id="eventbrite-attendee-list" style="clear:both;">';
if ( empty( $items ) ) $rss_html .= '<ul style="list-style:none;"><li>No attendees, yet.</li></ul>';
else
foreach ( $items as $item ) :
$rss_html .= '<ul style="background:none; list-style:none; margin:0px">';
$rss_html .= '<li style="background:none; list-style:none;">';
$rss_html .= $item[ 'content' ][ 'encoded' ];
$rss_html .= '<hr style="border: 1px solid #ddd; margin-bottom: 10px" />';
$rss_html .= '</li>';
$rss_html .= '</ul>';
endforeach;
$rss_html .= '</div>';
return $rss_html;
}
And lets not forget to add the shortcode function!
add_shortcode( 'eventbrite-attendees', 'attendee_feed_print_2009' );
Final outcome with look like this `[eventbrite-attendees rss="http://your-rss-feed.com/"]`
I’ve created this into a plugin!
Download the plugin: http://wordpress.org/extend/plugins/eventbrite-attendees-shortcode/
Review: WP-DBManager
This powerful plugin is a must-have for WordPress users. With WP-DBManager you can manage your WordPress database and allows you...
Welcome
Hello, welcome to a new WordPress community site. Join the ever growing and oh so popular WP Cult. Here we...
Top Membership plugins
Membership plugins/scripts for WordPress paid and free we will review them here today. Ultimate Membership Pro Ultimate Membership Pro is...
The Top 10 Best Free Android Retro Games of all time
Retro games are games that usually refer to 80’s and early 90’s games that have been endeared into the heart...
-
Pages4 months agoWrite For Us – Guest Post
-
Showcase4 months ago
StylizedWeb.com
-
News4 months ago
How to: Show/Hide any div box with jQuery in WordPress
-
Tips & Tricks3 months ago
Remove the title attribute using jQuery
-
Tips & Tricks1 week ago
How to: show/hide a widget in WordPress with jQuery
-
Plugins1 day ago
Top Membership plugins
-
Tips & Tricks4 months ago
Limit the characters that display on the_title
-
Guest Post2 days ago
The Top 10 Best Free Android Retro Games of all time
Mamas
May 25, 2010 at 6:49 am
that its great tip but does it work for WP that host in free hosting ( not in self hosting )
Social Media Optimization
May 25, 2010 at 11:48 pm
I read this article. I think You put a lot of effort to create this article.Thanks for this post.
Andrea
May 29, 2010 at 8:30 pm
Congratulations on your first post. Thanks for the info on the plug in!
Market Samurai
May 30, 2010 at 3:07 am
I recently had a few of my wordpress blogs hacked and went through a arduous process of trying to make them more secure. I might have to add this to the list.
tuning
May 31, 2010 at 5:46 pm
thanks for this tips!
William@Create Wealth
May 31, 2010 at 8:15 pm
hey! great stuff for a first post, keep up the good work 🙂 looking forward to more, now I gotta check my WP security!
Pingback: Blogging Tips 1
Hover Coupon
June 6, 2010 at 10:01 am
Thanks. I am going to be starting up a WordPress blog soon when 3.0 goes final so this should be useful.
discount air jordan shoes
June 14, 2010 at 1:06 pm
Many wordpress software users do not know about the hacking on wordpress Thanks for sharing such a useful information soom
Bluetooth Compatible Headsets
June 16, 2010 at 3:58 am
Hey being your first blog it is really attractive and all the best you have made a good start…
Instant Focus Memory Supplement
June 17, 2010 at 11:39 pm
Thank you for the really helpful tips.
klaasj
June 21, 2010 at 6:18 am
This help me to get remove some annoying spam control and injection for some of my blogs
diseño web
June 22, 2010 at 3:51 am
Nice post and your site is very cool, I like it very much.
Kevin Tan
June 23, 2010 at 9:17 pm
Thanks for this Miguel. I will certainly look into this considering I haven’t really tried to protect my blog very well from hackers.
barış özcan
June 24, 2010 at 4:56 am
wellcome personal web page…
mezar işleri
June 24, 2010 at 4:58 am
It is a good idea to plot the data so that you can explore its features.
An exploratory plot of your data enables you to identify discontinuities
and potential outliers, as well as the regions of interest.
Thanks…
Giochi Super Mario
July 4, 2010 at 6:03 am
Thanks been looking for some more protection for our blog
Does it work on wordpress 3.0?
Kids Rolling Suitcases
July 4, 2010 at 6:37 pm
Hi Miguel,
Thanks for the info. I just downloaded WordPress 3.0, and I have heard that the first releases of newer versions can be vulnerable to attacks, so I am trying to do anything possible to keep my site safe. Thanks again for the info.
Rowan
July 5, 2010 at 6:53 pm
Thanks for yet another good post! These tips help me to trudge through the waters of wordpress security, so I feel that this gives me a leg up!
Compare Web Hosts / Compare Web Hosting
July 7, 2010 at 3:34 am
Welcome to the world of blog, I think you’re off to a solid start.
Pixelbox Design
July 12, 2010 at 3:36 pm
Excellent Article, Added to favs, keep up the good work.
Charlotte Lawyers
July 15, 2010 at 1:40 am
Protecting is a must in our blog cause we spend our precious time in updating our blog. Computer hackers now a days, wordpress blogs is there favorite. Some blogger protect their blog by frequently changing their passwords and they also keep WordPress installation up to date .
L4NiK
July 16, 2010 at 4:22 pm
Tnx. Useful article!
Site5 Rebate
July 17, 2010 at 2:19 pm
I am planning on making a WordPress blog in a few months. Right now I am reading HTML/CSS books, Php and MySQL to learn how to do things right. This security script is very interesting and I hope that by the time I am done with my blog, hopefully by next year, I will have a very strong grasp on a variety of programming languages and will understand exactly that the above script means!
Candida Pugliesi
July 18, 2010 at 1:44 pm
WE had our site hacked a few months ago, and if I had seen this post beforehand, it probably would have been prevented. Thanks for sharing this with the community.
Steve Marino
July 20, 2010 at 3:33 am
Thanks for sharing. Although it would be more preferable if WordPress would take care of these issues themselves rather than relying on nice people like to you do their job for them.
Willy
July 22, 2010 at 1:13 am
All my wordpress sites have been hacked earlier despite the security plugins I earlier installed. I will implement your tip. Hope it will plug the hole.
Purple Heart
July 23, 2010 at 12:33 pm
Is there anything that can not be hacked. I just setup my first wordpress blog. Now I have to figure out how to stop the hackers… How do you update or edit the code for wordpress?
Ryan Wilson
July 23, 2010 at 7:21 pm
I’m using WordPress a lot and thank you for the helpful informations and tips.
Pixelbox Design
July 24, 2010 at 5:17 pm
Excellent Article, keep up the good work.
blogb4
July 27, 2010 at 12:30 am
Thank you, i’ll use this method for my blog, because i have several blogs with WP
flybar
July 27, 2010 at 10:33 am
This is great stuff! All WP newbies should check this out even if they’re just starting. You wouldn’t want to build your site for months and build traffic only to be hacked. Even if you do get it back, there are irreparable damages like lost reputation and lost income during the span that your site was hacked.
Hey Zappy
July 28, 2010 at 10:56 am
IS this still good or necessary with the WordPress 3.0 version ?
aem intakes
July 29, 2010 at 1:08 am
Thanks for this useful info mate! I am using wordpress and this surely would be helpful!
Hair loss
July 29, 2010 at 8:23 pm
Thanks for this wonderful plugin.. I will install this for sure..
SQL Training
July 29, 2010 at 11:35 pm
Thanks a lot for this great post on WordPress Security. I will be using this tip to make my blog more secured and robust.
Hotels Bowral
August 3, 2010 at 8:31 pm
I love blogs like these – choice code and easy to understand. Thanks matey!
Sydney House Cleaning
August 3, 2010 at 8:33 pm
Isn’t it great when you find EXACTLY what you’re after? That’s what I got when I came here. Many thanks 🙂
Computer Tips
August 6, 2010 at 1:53 pm
Your first post and this is also the first thing everyone should do before starting the wordpress blog.Thanks man,I have implemented your suggestions in my blog
Jane
August 10, 2010 at 11:18 am
Thanks for the article. Very helpful
Rick
August 10, 2010 at 7:13 pm
Hey, is your site still up? I hope so, just found it and its great. Keep it up!
Online Fashion
August 15, 2010 at 6:22 am
no wonder i couldnt install themes on wp! grrr…
marcolins
August 19, 2010 at 10:16 pm
i am using wordpress and it looks so useful for me to post my articles.but i never meet the thing as u said above,what is the hackers,can you help me?
cyrano
August 22, 2010 at 1:38 pm
thanks for this article. i ve a website and i m aware of hacking problem.
Claudia
August 22, 2010 at 11:57 pm
Thank you for great article. Where else could anyone get that kind of information in such a perfect way of writing. Good work
workwear clothing
Gartoo
August 24, 2010 at 8:41 am
Interesting article, with so many bloggers using premade tools to create their sites, it really opens up the opportunities for hackers. I wonder if you could elaborate what the code is actually preventing?
SQL Training
August 25, 2010 at 3:56 am
It is really very important to have our WordPress site secured to keep our business safe…..I think this code will certainly help me make my blog secure
ripzipfx2004@yahoo.com
August 27, 2010 at 2:38 am
welcome, excellent read. keep it coming hacker
The Eye
August 29, 2010 at 12:04 am
Nice post because very useful information and i am using WP
Thanks
Car wash franchise
August 31, 2010 at 7:13 pm
Thanks for the post but i think if it is easy to hack any WordPress it will affect many people badly so I found your post is very useful and could give warning to blog owners.