Connect with us

Tips & Tricks

WordPress Security Hacks

Published

on

Hi guys this is my first post on wpcult the great site Austin built.  Hope you guys find it usefull.

If you run a blog using the wordpress software then your blog is a target to hackers.  Below I will list some hacks and just how they can help you keep your business/site safe.

The following is  code to Block Bad Queries and protect your blog from malicious URL Requests.

Place the following code into a text file and name it what ever you like for example blockbadqueries.php upload it to your plugin folder and activate it in your wordpress admin just as you would any other Plugin

<?php
/*
Plugin Name: Block Bad Queries
Plugin URI:
http://perishablepress.com/press/2009/12/22/protect-wordpress-against-malicious-url-requests/
Description: Protect WordPress Against Malicious URL Requests
Author URI:
http://perishablepress.com/
Author: Perishable Press
Version: 1.0
*/
global $user_ID; if($user_ID) {
  if(!current_user_can(‘level_10’)) {
    if (strlen($_SERVER[‘REQUEST_URI’]) > 255 ||
      strpos($_SERVER[‘REQUEST_URI’], “eval(“) ||
      strpos($_SERVER[‘REQUEST_URI’], “CONCAT”) ||
      strpos($_SERVER[‘REQUEST_URI’], “UNION+SELECT”) ||
      strpos($_SERVER[‘REQUEST_URI’], “base64”)) {
        @header(“HTTP/1.1 414 Request-URI Too Long”);
 @header(“Status: 414 Request-URI Too Long”);
 @header(“Connection: Close”);
 @exit;
    }
  }
}
?>

 This Great plugin was made by Jeff Starr of Digging into WordPress

 

 

Protecting your blog with .htaccess 

.htaccess files have lots of possibilities. below is some code that will help protect your wordpress from modification of _REQUEST and/or GLOBALS and scripts injection.

 This is real simple just paste the following code into your .htaccess file. Always make a backup of your .htaccess before editing, better to be safe.

Options +FollowSymLinks
RewriteEngine On
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
RewriteRule ^(.*)$ index.php [F,L]

 

Thanks to Oussama for this great hack

Continue Reading
243 Comments

243 Comments

  1. Wordpress Designer

    June 21, 2011 at 5:52 pm

    I was a victim few months back on one of my sites…. but later discovered that reasons were more about me and not WP… anyways nice info… Hail Open Source, long live WP….!

  2. Bartending Jobs

    June 24, 2011 at 4:48 pm

    Congrats on your first post!

  3. nik@technojourney

    June 27, 2011 at 11:26 am

    I love to read the articles on wpcult… but don’t like it when some others write it instead of admin…

  4. bebek

    July 4, 2011 at 12:49 am

    wordpress is a safe script anyway. But your codes will be improve this. Thanks i will use .

  5. passdrugtest

    July 10, 2011 at 11:40 pm

    Good post .keep continue your post .i like your writing style.thanks for sharing.

  6. pubs in bolton

    July 12, 2011 at 4:16 pm

    Nice article great first post, Very informative and congrats on becoming the new site owner.

  7. Jorge

    July 14, 2011 at 3:27 pm

    This article is of 2010 and all the information is valid in 2011, you got a really nice blog and I’ll bookmark it to read all the articles.

  8. Toilet

    July 25, 2011 at 4:00 am

    That’s a very bad news that my wordpress blog is at risk of being hacked:/. You are doing a great job by informing us about such danger.

  9. sheric

    July 25, 2011 at 7:33 am

    Thank you very interesting.

  10. Ashley

    August 2, 2011 at 4:35 pm

    Thanks for the code. I have been looking for something to block bad queries and protect my blogs from malicious URL requests.

  11. Dell Parts

    August 2, 2011 at 9:22 pm

    Good research Miguel
    great work you have done

  12. bhayden96@bestmassagechair

    August 5, 2011 at 3:18 am

    Greatttttt!what a blog,man.i found it really interesting and i am going to bookmark this..Don’t quit posting ,you are a writer…..:-)

  13. موقع زواج

    August 7, 2011 at 7:34 am

    good words
    thank you

  14. Wordpress Plugins

    August 8, 2011 at 4:16 am

    This post provides best security for my WordPress Plugin to avoid the hacking.. I am just using this code right now..

  15. Leonardo Casci

    August 9, 2011 at 4:08 am

    great article, you should write more often! keep it up

  16. business cartoon

    August 18, 2011 at 9:34 pm

    I m fully satisfied with the post that how to remove the hacking or not to hacking the word press because it results in a negative effect.we will be careful about that.

  17. Stock Market Blog

    August 21, 2011 at 9:39 am

    When I had my hosting company, one of my client’s blogs kept getting hacked. I fixed it a half a dozen times before told him that he has to fix his own issues – pointed him to posts like this around the internet.

    Good stuff!

  18. Raief

    August 24, 2011 at 1:19 am

    Always looking for security info. This is still up-to-date.
    Much appreciated, bookmarked, rt’d, fb’d, and dugg.

  19. Hello Kitty Shop

    August 26, 2011 at 5:45 am

    Yes, website Security is very important, and i have a wordpress blog too, thanks for the post.

  20. Michael Dorf

    September 2, 2011 at 10:53 pm

    Nice first post! I’ve used Block Bad Queries in a couple of blogs and it worked exceptionally well. I like plugins that require minimal configuration! Thanks!

  21. West Africa Gold Exploration

    September 7, 2011 at 4:31 pm

    Its been a while since i read such a nice article just like this.

  22. Painting Antique Furniture

    September 7, 2011 at 4:35 pm

    Interesting Article. great job for the this site.

  23. windows addict

    September 10, 2011 at 1:30 am

    This is very interesting, You’re a very skilled blogger. I have joined your rss feed and look forward to seeking more of your great post. Also, I have shared your site in my social networks!

  24. max

    September 21, 2011 at 4:38 am

    Really good article, good to know about these security issues with my blog.

  25. casey dennison

    September 21, 2011 at 4:32 pm

    Thanks this is very useful. I will use this for all of my blogs.

  26. Joe

    September 24, 2011 at 3:28 am

    thanks for sharing!!! 😀

  27. sporting goods

    October 11, 2011 at 5:38 pm

    Nice code. I will try it.

  28. buy cheap backlinks

    October 11, 2011 at 10:23 pm

    Great article. It is always good to add in extra layers of safety, especially when it comes to protecting your business or name.

  29. Singles Holidays

    October 13, 2011 at 2:39 am

    I am an electrical & electronics engineer, and i am thinking about joining APPIN institute of ethical hacking & IT security bcoz I am interested in this field, so will there be better career options for me in this field after having an international diploma certification in ethical hacking?

  30. Stuart

    October 17, 2011 at 5:30 am

    Great post, and hope you keep writing for the site. We are moving our site to WordPress so will be implementing these tips to keep it secure.

  31. David Josh

    October 18, 2011 at 10:21 pm

    Thank you for the code, I was looking for something like this for long, my website has been hacked once and I needed something urgently to safe guard, shall try this. Thanks !

  32. Rob Benwell

    October 19, 2011 at 3:33 am

    Thank you for sharing this tool. Now I know that I’m in a safe hand. More Power!

    Rob Benwell

  33. Bryan McKenzie

    October 23, 2011 at 12:00 pm

    This has happened to me once before. Thanks for sharing this information, it’s always good to be cautious about these things and keep our websites protected. For a lot of people it’s their livelihood!

  34. Kredit

    October 24, 2011 at 5:19 am

    Hey, thanks for the good tips. Am always in search of good safety information for WordPress. They are easy to implement even for beginners.

  35. yonobae

    October 25, 2011 at 8:34 am

    Your postings are really very informative, that’s why I can’t help myself but come back and see what you posted again for me to gain knowledge. Thank you.

  36. S3bY

    October 26, 2011 at 5:30 am

    I was hacked one and since than I started paying more attention to security!
    So thank for this post..I will implement it right away!

  37. soniya

    October 26, 2011 at 11:29 pm

    very informative thanks lotttt

  38. Seo

    October 28, 2011 at 2:13 am

    This is great post,very useful! I think i will improve my website security…

  39. albert @ fantasy stock market

    October 30, 2011 at 3:03 pm

    Thanks for the great info on protecting my blog!

  40. Grid

    October 30, 2011 at 8:59 pm

    I think i have to improve my web security ASAP.

  41. gender predictor

    October 31, 2011 at 11:14 pm

    thanks for sharing the article, this is very useful for us

You must be logged in to post a comment Login

Leave a Reply

Tips & Tricks

Can′t add pagination on WooThemes Thick Theme

Published

on

Everything I have tried has led to nothing. And I have tried six way’s from Sunday to get my main posts to paginate.

example one:

<?php $paged = (get_query_var('paged')) ? get_query_var('paged') : 1; 
query_posts('offset=1&showposts=' . get_option('woo_other_entries') . '&cat=-' . $GLOBALS['ex_asides'] . '&paged=$paged' ); ?>

example two:

<?php 
global $myOffset; 
global $wp_query;
$myOffset = 1;
$paged = intval(get_query_var('paged')) ? get_query_var('paged') : 1;
$temp = $wp_query;
$wp_query= null;
$wp_query = new WP_Query();
$wp_query->query(array(
	'offset' => $myOffset,
	'category__not_in' => array($GLOBALS['ex_asides'],7,84),
	'paged' => $paged,
	'showposts' => get_option('woo_other_entries'),
	)); ?>

example three:

<?php 
global $myOffset;
$myOffset = 1;
$wp_query = new WP_Query();
$wp_query->query(array(
	'offset' => $myOffset,
	'category__not_in' => array($GLOBALS['ex_asides'],7,84),
	'paged' => $paged,
	'showposts' => get_option('woo_other_entries'),
	)); ?>

And after those tries, I just can’t get more pages beyond the option’s that I choose, and can only pull an archive via the browse more link.

Any suggestions or anything?

Continue Reading

Tips & Tricks

Pulling custom fields from outside the loop

Published

on

In the last post “Creating a custom widget” I showed you how to create a custom widget. Well in this post I will show you how I used my custom widget to display all post with a certain custom field from outside the WordPress loop.

In the last post I used this tag:

<?php include(TEMPLATEPATH . '/includes/showcase.php'); ?>

Now I will show you what the file showcase.php has:

<ul>
<?php
global $wpdb;

$sql = "SELECT wposts.*
	FROM $wpdb->posts wposts, $wpdb->postmeta wpostmeta
	WHERE wposts.ID = wpostmeta.post_id
	AND wpostmeta.meta_key = 'gallery-url'
	AND wposts.post_status = 'publish'
	AND wposts.post_type = 'post'
	ORDER BY wposts.post_date DESC LIMIT 8";

$pageposts = $wpdb->get_results($sql, OBJECT);
$output = $pre_HTML;

foreach ($pageposts as $post) : setup_postdata($post);  ?>

<li><a href="<?php echo get_post_meta($post->ID, "gallery-url", $single = true); ?>" title="Link to <?php the_title(); ?>">
<img src="<?php echo get_post_meta($post->ID, "image", $single = true); ?>" alt="<?php the_title(); ?>" /></a></li>

<?php endforeach; ?>

</ul>

That’s it! The most important item you may want to change for your own custom field is the line : AND wpostmeta.meta_key = 'gallery-url'. Where you would change the text in bold to match your own custom field value.

Update:

Check out Austin from PressedWords comment below.

With his great advise I was able to figure out why all my attempts to use the query_post weren’t working. it came down to this line of code: <?php echo get_post_meta($post->ID, "gallery-url", $single = true); ?>, that was what I had in my code, and the $post->ID is the reason my code would not echo or print the custom field’s value. Solution? replace $post->ID with get_the_ID(). HA, so simple.

Continue Reading

Tips & Tricks

Creating a custom widget

Published

on

Today let’s learn a simple quick trick on how to create a custom widget. For my example I will show you how I created my Showcase widget located in the middle, to the right of the posts.

First under your functions.php file type in the following:

<?php // Custom Widget
function MyCustomWidget() { ?>
<li class="widget">
    <h2 class="heading">Latest Showcase</h2>
        <ul>
        	<?php include(TEMPLATEPATH . '/includes/showcase.php'); ?>
        </ul>
</li>

<?php }

register_sidebar_widget('The Custom Widget for Showcase', 'MyCustomWidget'); ?>
  • Always make sure your code is between the <?php and ?> for it to work.
  • Once we call the function, the rest is assuming html code that you may or may not need.
  • For instance, you may just put in a picture and call it a day. But my code starts with <li< because my sidebar’s start and end with <ul<.
  • Any way, once your done, just set the final “register_sidebar_widget('the widget title', 'the name of the function');

That’s it! Now you have a custom widget with what ever you want!

Continue Reading

Random Search Terms

Title

Recent Posts: Fully Net Worth . com

Hero Fiennes Tiffin Net Worth: How Rich is the English Actor?

Hero Fiennes Tiffin Net Worth: How Rich is the English Actor?

Hero Beauregard Faulkner Fiennes-Tiffin is an English actor and model. He is best known for playing the role of a character named Hardin Scott in the 2019 film called After that was a big hit among the younger audiences. As of 2020, Hero Fiennes Tiffin net worth is estimated to be $700,000. Fiennes was born […]

Cash Nasty Net Worth: How Much He Makes From YouTube?

Cash Nasty Net Worth: How Much He Makes From YouTube?

Cash Nasty is an American Youtuber who is known for running the Youtube channel called WhatChaMaCalling. Moreover, he is also on Twitch where he runs a channel called CashNastyGaming. As of 2019, Cash Nasty net worth is estimated to be $1.5 million. He was born on December 4, 1990  in Vidalia, Louisiana. Nasty has always been […]

DaBaby Net Worth: How Rich is the Rapper Actually?

DaBaby Net Worth: How Rich is the Rapper Actually?

Jonathan Lyndale Kirk, who is better known by his stage name as DaBaby, is an American rapper. He is best known for his hit debut album which was called Baby on Baby and even made it to the number 7 of the reputed Billboard Hot 100. As of 2019, DaBaby net worth is around $3 […]

Payton Moormeier Net Worth: How Rich is the Tik Tok Star Actually?

Payton Moormeier Net Worth: How Rich is the Tik Tok Star Actually?

Payton Moormeier is a social media personality who is best known for his lip-sync videos on the popular platform called TikTok where he has more 8.8 million followers where his videos have received close to 350 million likes which is an absolutely mammoth number, especially considering that he is still only 16 years old. As […]

Trending