Tips & Tricks
WordPress Security Hacks
Hi guys this is my first post on wpcult the great site Austin built. Hope you guys find it usefull.
If you run a blog using the wordpress software then your blog is a target to hackers. Below I will list some hacks and just how they can help you keep your business/site safe.
The following is code to Block Bad Queries and protect your blog from malicious URL Requests.
Place the following code into a text file and name it what ever you like for example blockbadqueries.php upload it to your plugin folder and activate it in your wordpress admin just as you would any other Plugin
<?php
/*
Plugin Name: Block Bad Queries
Plugin URI: http://perishablepress.com/press/2009/12/22/protect-wordpress-against-malicious-url-requests/
Description: Protect WordPress Against Malicious URL Requests
Author URI: http://perishablepress.com/
Author: Perishable Press
Version: 1.0
*/
global $user_ID; if($user_ID) {
if(!current_user_can(‘level_10’)) {
if (strlen($_SERVER[‘REQUEST_URI’]) > 255 ||
strpos($_SERVER[‘REQUEST_URI’], “eval(“) ||
strpos($_SERVER[‘REQUEST_URI’], “CONCAT”) ||
strpos($_SERVER[‘REQUEST_URI’], “UNION+SELECT”) ||
strpos($_SERVER[‘REQUEST_URI’], “base64”)) {
@header(“HTTP/1.1 414 Request-URI Too Long”);
@header(“Status: 414 Request-URI Too Long”);
@header(“Connection: Close”);
@exit;
}
}
}
?>
This Great plugin was made by Jeff Starr of Digging into WordPress
Protecting your blog with .htaccess
.htaccess files have lots of possibilities. below is some code that will help protect your wordpress from modification of _REQUEST and/or GLOBALS and scripts injection.
This is real simple just paste the following code into your .htaccess file. Always make a backup of your .htaccess before editing, better to be safe.
Options +FollowSymLinks
RewriteEngine On
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
RewriteRule ^(.*)$ index.php [F,L]
Thanks to Oussama for this great hack
Everything I have tried has led to nothing. And I have tried six way’s from Sunday to get my main posts to paginate.
example one:
<?php $paged = (get_query_var('paged')) ? get_query_var('paged') : 1;
query_posts('offset=1&showposts=' . get_option('woo_other_entries') . '&cat=-' . $GLOBALS['ex_asides'] . '&paged=$paged' ); ?>
example two:
<?php
global $myOffset;
global $wp_query;
$myOffset = 1;
$paged = intval(get_query_var('paged')) ? get_query_var('paged') : 1;
$temp = $wp_query;
$wp_query= null;
$wp_query = new WP_Query();
$wp_query->query(array(
'offset' => $myOffset,
'category__not_in' => array($GLOBALS['ex_asides'],7,84),
'paged' => $paged,
'showposts' => get_option('woo_other_entries'),
)); ?>
example three:
<?php
global $myOffset;
$myOffset = 1;
$wp_query = new WP_Query();
$wp_query->query(array(
'offset' => $myOffset,
'category__not_in' => array($GLOBALS['ex_asides'],7,84),
'paged' => $paged,
'showposts' => get_option('woo_other_entries'),
)); ?>
And after those tries, I just can’t get more pages beyond the option’s that I choose, and can only pull an archive via the browse more link.
Any suggestions or anything?
In the last post “Creating a custom widget” I showed you how to create a custom widget. Well in this post I will show you how I used my custom widget to display all post with a certain custom field from outside the WordPress loop.
In the last post I used this tag:
<?php include(TEMPLATEPATH . '/includes/showcase.php'); ?>
Now I will show you what the file showcase.php has:
<ul> <?php global $wpdb; $sql = "SELECT wposts.* FROM $wpdb->posts wposts, $wpdb->postmeta wpostmeta WHERE wposts.ID = wpostmeta.post_id AND wpostmeta.meta_key = 'gallery-url' AND wposts.post_status = 'publish' AND wposts.post_type = 'post' ORDER BY wposts.post_date DESC LIMIT 8"; $pageposts = $wpdb->get_results($sql, OBJECT); $output = $pre_HTML; foreach ($pageposts as $post) : setup_postdata($post); ?> <li><a href="<?php echo get_post_meta($post->ID, "gallery-url", $single = true); ?>" title="Link to <?php the_title(); ?>"> <img src="<?php echo get_post_meta($post->ID, "image", $single = true); ?>" alt="<?php the_title(); ?>" /></a></li> <?php endforeach; ?> </ul>
That’s it! The most important item you may want to change for your own custom field is the line : AND wpostmeta.meta_key = 'gallery-url'. Where you would change the text in bold to match your own custom field value.
Update:
Check out Austin from PressedWords comment below.
With his great advise I was able to figure out why all my attempts to use the query_post weren’t working. it came down to this line of code: <?php echo get_post_meta($post->ID, "gallery-url", $single = true); ?>, that was what I had in my code, and the $post->ID is the reason my code would not echo or print the custom field’s value. Solution? replace $post->ID with get_the_ID(). HA, so simple.
Today let’s learn a simple quick trick on how to create a custom widget. For my example I will show you how I created my Showcase widget located in the middle, to the right of the posts.
First under your functions.php file type in the following:
<?php // Custom Widget
function MyCustomWidget() { ?>
<li class="widget">
<h2 class="heading">Latest Showcase</h2>
<ul>
<?php include(TEMPLATEPATH . '/includes/showcase.php'); ?>
</ul>
</li>
<?php }
register_sidebar_widget('The Custom Widget for Showcase', 'MyCustomWidget'); ?>
- Always make sure your code is between the
<?phpand?>for it to work. - Once we call the function, the rest is assuming html code that you may or may not need.
- For instance, you may just put in a picture and call it a day. But my code starts with
<li<because my sidebar’s start and end with<ul<. - Any way, once your done, just set the final “
register_sidebar_widget('the widget title', 'the name of the function');“
That’s it! Now you have a custom widget with what ever you want!
10 Steps to Evaluating and Measuring Your Marketing Strategy
When you are trying to market a product, the product or service is only as good as the potential clientele...
StylizedWeb.com
Can′t add pagination on WooThemes Thick Theme
Everything I have tried has led to nothing. And I have tried six way’s from Sunday to get my main...
Pulling custom fields from outside the loop
In the last post “Creating a custom widget” I showed you how to create a custom widget. Well in this...
Walter Mercado Net Worth: How Rich was Walter Mercado Actually?
Walter Mercado also was known by his stage name as Shanti Ananda was a Puerto Rican actor, astrologer, dancer, and writer. He is best known for his shows as an astrologer where, his predictions show aired for decades in Latin American, Puerto Rico, and the United States. Walter Mercado’s net worth before his death is […]
BlameItOnKWay Net Worth: 4 Interesting Facts You Should Know
Kwaylon Rogers professionally known as BlameItOnKWay is an American social media personality and comedian. Here are some facts about BlameItOnKWay including his net worth, career, sexuality and many more. 1. BlameItOnKWay net worth is estimated to be $500,000. As of 2019, BlameItOnKWay net worth is estimated to be $500,000. He earned most of his money […]
City Girls Net Worth: 5 Interesting Facts About The Hip hop duo
City Girls is an American hip hop duo originally from Miami which consists of the rappers Caresha Romeka Brownlee (known as Yung Miami) and Jatavia Shakara Johnson (known as JT). Here are some facts about City Girls including their net worth, career and many more. 1. City Girls has an estimated net worth of $500,000 […]
W2S net worth
W2S net worth Introduction W2S is a British sports commentator on Livestream who primarily posts FIFA sports recordings and live streams for his 15 million subscribers. Online, he is known as W2S or WroeToShaw, and he is Sidemen’s youngest leader. He is also fond of Chelsea, Everton, West Ham, and Arsenal in Liverpool. Harry Lewis […]
-
Pages5 months agoWrite For Us – Guest Post
-
Showcase8 hours ago
StylizedWeb.com
-
News5 months ago
How to: Show/Hide any div box with jQuery in WordPress
-
Tips & Tricks4 months ago
Remove the title attribute using jQuery
-
Tips & Tricks1 month ago
How to: show/hide a widget in WordPress with jQuery
-
Plugins1 month agoTop Membership plugins
-
Tips & Tricks5 months ago
Limit the characters that display on the_title
-
Tips & Tricks3 months ago
Remove spaces when echoing the_title
Mamas
May 25, 2010 at 6:49 am
that its great tip but does it work for WP that host in free hosting ( not in self hosting )
Social Media Optimization
May 25, 2010 at 11:48 pm
I read this article. I think You put a lot of effort to create this article.Thanks for this post.
Andrea
May 29, 2010 at 8:30 pm
Congratulations on your first post. Thanks for the info on the plug in!
Market Samurai
May 30, 2010 at 3:07 am
I recently had a few of my wordpress blogs hacked and went through a arduous process of trying to make them more secure. I might have to add this to the list.
tuning
May 31, 2010 at 5:46 pm
thanks for this tips!
William@Create Wealth
May 31, 2010 at 8:15 pm
hey! great stuff for a first post, keep up the good work 🙂 looking forward to more, now I gotta check my WP security!
Pingback: Blogging Tips 1
Hover Coupon
June 6, 2010 at 10:01 am
Thanks. I am going to be starting up a WordPress blog soon when 3.0 goes final so this should be useful.
discount air jordan shoes
June 14, 2010 at 1:06 pm
Many wordpress software users do not know about the hacking on wordpress Thanks for sharing such a useful information soom
Bluetooth Compatible Headsets
June 16, 2010 at 3:58 am
Hey being your first blog it is really attractive and all the best you have made a good start…
Instant Focus Memory Supplement
June 17, 2010 at 11:39 pm
Thank you for the really helpful tips.
klaasj
June 21, 2010 at 6:18 am
This help me to get remove some annoying spam control and injection for some of my blogs
diseño web
June 22, 2010 at 3:51 am
Nice post and your site is very cool, I like it very much.
Kevin Tan
June 23, 2010 at 9:17 pm
Thanks for this Miguel. I will certainly look into this considering I haven’t really tried to protect my blog very well from hackers.
barış özcan
June 24, 2010 at 4:56 am
wellcome personal web page…
mezar işleri
June 24, 2010 at 4:58 am
It is a good idea to plot the data so that you can explore its features.
An exploratory plot of your data enables you to identify discontinuities
and potential outliers, as well as the regions of interest.
Thanks…
Giochi Super Mario
July 4, 2010 at 6:03 am
Thanks been looking for some more protection for our blog
Does it work on wordpress 3.0?
Kids Rolling Suitcases
July 4, 2010 at 6:37 pm
Hi Miguel,
Thanks for the info. I just downloaded WordPress 3.0, and I have heard that the first releases of newer versions can be vulnerable to attacks, so I am trying to do anything possible to keep my site safe. Thanks again for the info.
Rowan
July 5, 2010 at 6:53 pm
Thanks for yet another good post! These tips help me to trudge through the waters of wordpress security, so I feel that this gives me a leg up!
Compare Web Hosts / Compare Web Hosting
July 7, 2010 at 3:34 am
Welcome to the world of blog, I think you’re off to a solid start.
Pixelbox Design
July 12, 2010 at 3:36 pm
Excellent Article, Added to favs, keep up the good work.
Charlotte Lawyers
July 15, 2010 at 1:40 am
Protecting is a must in our blog cause we spend our precious time in updating our blog. Computer hackers now a days, wordpress blogs is there favorite. Some blogger protect their blog by frequently changing their passwords and they also keep WordPress installation up to date .
L4NiK
July 16, 2010 at 4:22 pm
Tnx. Useful article!
Site5 Rebate
July 17, 2010 at 2:19 pm
I am planning on making a WordPress blog in a few months. Right now I am reading HTML/CSS books, Php and MySQL to learn how to do things right. This security script is very interesting and I hope that by the time I am done with my blog, hopefully by next year, I will have a very strong grasp on a variety of programming languages and will understand exactly that the above script means!
Candida Pugliesi
July 18, 2010 at 1:44 pm
WE had our site hacked a few months ago, and if I had seen this post beforehand, it probably would have been prevented. Thanks for sharing this with the community.
Steve Marino
July 20, 2010 at 3:33 am
Thanks for sharing. Although it would be more preferable if WordPress would take care of these issues themselves rather than relying on nice people like to you do their job for them.
Willy
July 22, 2010 at 1:13 am
All my wordpress sites have been hacked earlier despite the security plugins I earlier installed. I will implement your tip. Hope it will plug the hole.
Purple Heart
July 23, 2010 at 12:33 pm
Is there anything that can not be hacked. I just setup my first wordpress blog. Now I have to figure out how to stop the hackers… How do you update or edit the code for wordpress?
Ryan Wilson
July 23, 2010 at 7:21 pm
I’m using WordPress a lot and thank you for the helpful informations and tips.
Pixelbox Design
July 24, 2010 at 5:17 pm
Excellent Article, keep up the good work.
blogb4
July 27, 2010 at 12:30 am
Thank you, i’ll use this method for my blog, because i have several blogs with WP
flybar
July 27, 2010 at 10:33 am
This is great stuff! All WP newbies should check this out even if they’re just starting. You wouldn’t want to build your site for months and build traffic only to be hacked. Even if you do get it back, there are irreparable damages like lost reputation and lost income during the span that your site was hacked.
Hey Zappy
July 28, 2010 at 10:56 am
IS this still good or necessary with the WordPress 3.0 version ?
aem intakes
July 29, 2010 at 1:08 am
Thanks for this useful info mate! I am using wordpress and this surely would be helpful!
Hair loss
July 29, 2010 at 8:23 pm
Thanks for this wonderful plugin.. I will install this for sure..
SQL Training
July 29, 2010 at 11:35 pm
Thanks a lot for this great post on WordPress Security. I will be using this tip to make my blog more secured and robust.
Hotels Bowral
August 3, 2010 at 8:31 pm
I love blogs like these – choice code and easy to understand. Thanks matey!
Sydney House Cleaning
August 3, 2010 at 8:33 pm
Isn’t it great when you find EXACTLY what you’re after? That’s what I got when I came here. Many thanks 🙂
Computer Tips
August 6, 2010 at 1:53 pm
Your first post and this is also the first thing everyone should do before starting the wordpress blog.Thanks man,I have implemented your suggestions in my blog
Jane
August 10, 2010 at 11:18 am
Thanks for the article. Very helpful
Rick
August 10, 2010 at 7:13 pm
Hey, is your site still up? I hope so, just found it and its great. Keep it up!
Online Fashion
August 15, 2010 at 6:22 am
no wonder i couldnt install themes on wp! grrr…
marcolins
August 19, 2010 at 10:16 pm
i am using wordpress and it looks so useful for me to post my articles.but i never meet the thing as u said above,what is the hackers,can you help me?
cyrano
August 22, 2010 at 1:38 pm
thanks for this article. i ve a website and i m aware of hacking problem.
Claudia
August 22, 2010 at 11:57 pm
Thank you for great article. Where else could anyone get that kind of information in such a perfect way of writing. Good work
workwear clothing
Gartoo
August 24, 2010 at 8:41 am
Interesting article, with so many bloggers using premade tools to create their sites, it really opens up the opportunities for hackers. I wonder if you could elaborate what the code is actually preventing?
SQL Training
August 25, 2010 at 3:56 am
It is really very important to have our WordPress site secured to keep our business safe…..I think this code will certainly help me make my blog secure
ripzipfx2004@yahoo.com
August 27, 2010 at 2:38 am
welcome, excellent read. keep it coming hacker
The Eye
August 29, 2010 at 12:04 am
Nice post because very useful information and i am using WP
Thanks
Car wash franchise
August 31, 2010 at 7:13 pm
Thanks for the post but i think if it is easy to hack any WordPress it will affect many people badly so I found your post is very useful and could give warning to blog owners.