Tips & Tricks
WordPress Security Hacks
Hi guys this is my first post on wpcult the great site Austin built. Hope you guys find it usefull.
If you run a blog using the wordpress software then your blog is a target to hackers. Below I will list some hacks and just how they can help you keep your business/site safe.
The following is code to Block Bad Queries and protect your blog from malicious URL Requests.
Place the following code into a text file and name it what ever you like for example blockbadqueries.php upload it to your plugin folder and activate it in your wordpress admin just as you would any other Plugin
<?php
/*
Plugin Name: Block Bad Queries
Plugin URI: http://perishablepress.com/press/2009/12/22/protect-wordpress-against-malicious-url-requests/
Description: Protect WordPress Against Malicious URL Requests
Author URI: http://perishablepress.com/
Author: Perishable Press
Version: 1.0
*/
global $user_ID; if($user_ID) {
if(!current_user_can(‘level_10’)) {
if (strlen($_SERVER[‘REQUEST_URI’]) > 255 ||
strpos($_SERVER[‘REQUEST_URI’], “eval(“) ||
strpos($_SERVER[‘REQUEST_URI’], “CONCAT”) ||
strpos($_SERVER[‘REQUEST_URI’], “UNION+SELECT”) ||
strpos($_SERVER[‘REQUEST_URI’], “base64”)) {
@header(“HTTP/1.1 414 Request-URI Too Long”);
@header(“Status: 414 Request-URI Too Long”);
@header(“Connection: Close”);
@exit;
}
}
}
?>
This Great plugin was made by Jeff Starr of Digging into WordPress
Protecting your blog with .htaccess
.htaccess files have lots of possibilities. below is some code that will help protect your wordpress from modification of _REQUEST and/or GLOBALS and scripts injection.
This is real simple just paste the following code into your .htaccess file. Always make a backup of your .htaccess before editing, better to be safe.
Options +FollowSymLinks
RewriteEngine On
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
RewriteRule ^(.*)$ index.php [F,L]
Thanks to Oussama for this great hack
Tips & Tricks
How to: Create a fbshare.me shortcode
Social networks are everywhere. I am sure you’re on facebook. Well why not at a facebook share script to your site?
Don’t know PHP that well?
Well here is a simple way to add a share script like fbshare.me to your site, via shortcodes.
Paste the following code in your functions.php file in order to create your shortcode:
function fbshare_script() {
return '<div class="fbshare"><script src="http://widgets.fbshare.me/files/fbshare.js"></script></div>';
}
add_shortcode( 'fbshare', 'fbshare_script' );
Once done, you can display the facebook share button anywhere on your posts. In WordPress editor, make sure you are in HTML mode and insert the following: [fbshare].
When your post will be published, the shortcode will be replaced by the fbshare.me button.
Last week I wrote how to “Use WordPress to print a RSS feed for Eventbrite attendees“. It was pretty popular, but then I found myself in a place that was more annoying. Trying to incorporate that into a blog post or page.
Without having to download a plugin that will allow PHP to be executed inside a post, I would have to create a template file and use that. Which is what I did, and it works just fine. But for some reason I forgot all about shortcodes! With a shortcode, I could generate all the PHP in the functions file and then just call the shortcode when/where I want.
Okay, so lets show the completed PHP code:
function attendee_feed_print_2009() {
global $wpdb;
include_once( ABSPATH . WPINC . '/rss.php' );
$rss = fetch_rss( 'http://www.eventbrite.com/rss/event_list_attendees/384870157' );
$items = array_slice( $rss->items, 0 );
if ( empty( $items ) ) echo '<ul style="list-style-type: none; list-style-image: none; list-style-position: outside;"><li>No items</li></ul>';
else
foreach ( $items as $item ) : ?>
<ul style="list-style-type:none; list-style-image:none; list-style-position:outside; margin-bottom: 0px">
<li><!--<strong><?php echo $item[ 'title' ]; //User name ?></strong><br />-->
<?php echo $item[ 'content' ][ 'encoded' ]; ?>
<hr style="border: 1px solid #ddd; margin-bottom: 8px" />
</li>
</ul>
<?php endforeach;
}
Now, this code has to be changed for it to work as a shortcode. We’ll have to return the function and not print/echo it.
I also wanted to be able to use multiple instances of the code with different feeds. To do so I had to create a argument to extract from the completed short code. I found a demo at: Alex Mansfield’s post.
Remember this:
function attendee_feed_print_2009() {
global $wpdb;
include_once( ABSPATH . WPINC . '/rss.php' );
$rss = fetch_rss( 'http://www.eventbrite.com/rss/event_list_attendees/384870157' );
We are going to update it to read as follows ( changes in bold ) :
function attendee_feed_print_2009( $rss_nbr ) {
global $wpdb;
extract( shortcode_atts( array( 'rss' => ''), $rss_nbr ) );
include_once( ABSPATH . WPINC . '/rss.php' );
$rss = fetch_rss( $rss );
And the final code with the fields updated to return the arguments ( put into your functions.php file ( in between <?php ?> ) ) :
function attendee_feed_print_2009( $rss_nbr ) {
global $wpdb;
extract( shortcode_atts( array( 'rss' => ''), $rss_nbr ) );
include_once( ABSPATH . WPINC . '/rss.php' );
$rss = fetch_rss( $rss );
$items = array_slice( $rss->items, 0 );
$rss_html = '<div id="eventbrite-attendee-list" style="clear:both;">';
if ( empty( $items ) ) $rss_html .= '<ul style="list-style:none;"><li>No attendees, yet.</li></ul>';
else
foreach ( $items as $item ) :
$rss_html .= '<ul style="background:none; list-style:none; margin:0px">';
$rss_html .= '<li style="background:none; list-style:none;">';
$rss_html .= $item[ 'content' ][ 'encoded' ];
$rss_html .= '<hr style="border: 1px solid #ddd; margin-bottom: 10px" />';
$rss_html .= '</li>';
$rss_html .= '</ul>';
endforeach;
$rss_html .= '</div>';
return $rss_html;
}
And lets not forget to add the shortcode function!
add_shortcode( 'eventbrite-attendees', 'attendee_feed_print_2009' );
Final outcome with look like this `[eventbrite-attendees rss="http://your-rss-feed.com/"]`
I’ve created this into a plugin!
Download the plugin: http://wordpress.org/extend/plugins/eventbrite-attendees-shortcode/
Today I was working on the WordCamp.LA site. I was trying to show the “attendee list” on the attendees page with out having to update the page every day.
Since I am using EventBrite to promote and sell ticket to the event I can collect info from there list. Evey one who purchases a ticket gets put into the ticketed database which you can view with either RSS or OPML.
I chose to use RSS and the WordPress core file rss.php.
In the functions.php file I’ve added this function:
function attendee_feed_print_2009() {
global $wpdb;
include_once( ABSPATH . WPINC . '/rss.php' );
$rss = fetch_rss( 'http://www.eventbrite.com/rss/event_list_attendees/384870157' );
$items = array_slice( $rss->items, 0 );
Where I’ve named my function, and included the core RSS file from WordPress. I also told it to fetch the feed from the address (alternatively you can use any feed link you like).
if ( empty( $items ) ) echo '<ul style="list-style-type: none; list-style-image: none; list-style-position: outside;"><li>No items</li></ul>'; else foreach ( $items as $item ) : ?> <ul style="list-style-type:none; list-style-image:none; list-style-position:outside; margin-bottom: 0px"> <li><!--<strong><?php echo $item[ 'title' ]; //User name ?></strong><br />--> <?php echo $item[ 'content' ][ 'encoded' ]; ?> <hr style="border: 1px solid #ddd; margin-bottom: 8px" /> </li> </ul> <?php endforeach;
I then added the core style to fit this current feed.
And the final out come looks like this:
function attendee_feed_print_2009() {
global $wpdb;
include_once( ABSPATH . WPINC . '/rss.php' );
$rss = fetch_rss( 'http://www.eventbrite.com/rss/event_list_attendees/384870157' );
$items = array_slice( $rss->items, 0 );
if ( empty( $items ) ) echo '<ul style="list-style-type: none; list-style-image: none; list-style-position: outside;"><li>No items</li></ul>';
else
foreach ( $items as $item ) : ?>
<ul style="list-style-type:none; list-style-image:none; list-style-position:outside; margin-bottom: 0px">
<li><!--<strong><?php echo $item[ 'title' ]; //User name ?></strong><br />-->
<?php echo $item[ 'content' ][ 'encoded' ]; ?>
<hr style="border: 1px solid #ddd; margin-bottom: 8px" />
</li>
</ul>
<?php endforeach;
}
Don’t forget to wrap the code in <?php ?>
I want to thank John Kolbert for helping me with printing the content:encoded portion. http://pastebin.com/m1588fb30
See it in action: http://wordcamp.la/attendees/
Lost? Since You Can’t Trust Apple Maps, Check Out These 3 Apps Instead
Maybe you have the new software on your Apple device that has made headlines as not being reliable, or perhaps...
An Overview Of Business Models
Knowing Where To Start There are a number of conceptual business models that are used throughout the professional world in...
Google’s New Tool For Bad Links
Google recently announced it has launched its Disavow Tool which allows webmasters to alert Google of any backlinks they think...
5 Reasons Why You Should Or Should Not Use WordPress Plugins
Depending on your needs, WordPress plugins are the best and worst aspects of WordPress. The whole purpose of plugins should...
Cynthia Frelund Net Worth: How Rich is Cynthia Frelund Actually?
Cynthia Frelund is Data Analyst Expert for the NFL Media Network where she focuses on breaking down all the numbers on the show Numbers Game. Moreover, from the perspective of the fans, she is a key influencer in their fantasy football predictions. As of 2019, Cynthia Frelund net worth is estimated to be $1 million. […]
Ron Rivera Net Worth: How Rich is the former Panthers Coach?
Ron Rivera is a retired football player and a former coach who managed Carolina Panthers in the National Football League. As of 2019, Ron Rivera net worth is estimated to be $5 million. Rivera was born on January 7, 1962, in Fort Ord, California. His father Eugenio Rivera was a military man. Due to his […]
Bianca Del Rio Net Worth: How Rich is the Drag Queen Actually?
Roy Haylock professionally known by the stage name Bianca Del Rio, is an American drag queen, comedian, actor, and costume designer. She is best known for winning the 6th season of RuPaul’s Drag Race. As of 2019, Bianca Del Rio net worth is estimated to be $2 million. Haylock was born on June 27, 1975, in Gretna, Louisiana. He […]
Tucker Roberts Net Worth: How Rich is Olivia Munn’s Boyfriend?
Tucker Roberts is an American businessman who recently came in the spotlight after his relationship with Hollywood actress Olivia Munn. As of 2019, Tucker Roberts net worth is estimated to be $10 million. Tucker was born in Philadelphia, Pennsylvania to parents Brian Roberts and Aileen Kennedy Roberts. His father is the CEO of Comcast, an […]
-
Pages3 months agoWrite For Us – Guest Post
-
Showcase3 months ago
StylizedWeb.com
-
News3 months ago
How to: Show/Hide any div box with jQuery in WordPress
-
Tips & Tricks2 months ago
Remove the title attribute using jQuery
-
Tips & Tricks5 months ago
How to: show/hide a widget in WordPress with jQuery
-
Plugins4 months agoTop Membership plugins
-
Tips & Tricks3 months ago
Limit the characters that display on the_title
-
Tips & Tricks1 month ago
Remove spaces when echoing the_title
Mamas
May 25, 2010 at 6:49 am
that its great tip but does it work for WP that host in free hosting ( not in self hosting )
Social Media Optimization
May 25, 2010 at 11:48 pm
I read this article. I think You put a lot of effort to create this article.Thanks for this post.
Andrea
May 29, 2010 at 8:30 pm
Congratulations on your first post. Thanks for the info on the plug in!
Market Samurai
May 30, 2010 at 3:07 am
I recently had a few of my wordpress blogs hacked and went through a arduous process of trying to make them more secure. I might have to add this to the list.
tuning
May 31, 2010 at 5:46 pm
thanks for this tips!
William@Create Wealth
May 31, 2010 at 8:15 pm
hey! great stuff for a first post, keep up the good work 🙂 looking forward to more, now I gotta check my WP security!
Pingback: Blogging Tips 1
Hover Coupon
June 6, 2010 at 10:01 am
Thanks. I am going to be starting up a WordPress blog soon when 3.0 goes final so this should be useful.
discount air jordan shoes
June 14, 2010 at 1:06 pm
Many wordpress software users do not know about the hacking on wordpress Thanks for sharing such a useful information soom
Bluetooth Compatible Headsets
June 16, 2010 at 3:58 am
Hey being your first blog it is really attractive and all the best you have made a good start…
Instant Focus Memory Supplement
June 17, 2010 at 11:39 pm
Thank you for the really helpful tips.
klaasj
June 21, 2010 at 6:18 am
This help me to get remove some annoying spam control and injection for some of my blogs
diseño web
June 22, 2010 at 3:51 am
Nice post and your site is very cool, I like it very much.
Kevin Tan
June 23, 2010 at 9:17 pm
Thanks for this Miguel. I will certainly look into this considering I haven’t really tried to protect my blog very well from hackers.
barış özcan
June 24, 2010 at 4:56 am
wellcome personal web page…
mezar işleri
June 24, 2010 at 4:58 am
It is a good idea to plot the data so that you can explore its features.
An exploratory plot of your data enables you to identify discontinuities
and potential outliers, as well as the regions of interest.
Thanks…
Giochi Super Mario
July 4, 2010 at 6:03 am
Thanks been looking for some more protection for our blog
Does it work on wordpress 3.0?
Kids Rolling Suitcases
July 4, 2010 at 6:37 pm
Hi Miguel,
Thanks for the info. I just downloaded WordPress 3.0, and I have heard that the first releases of newer versions can be vulnerable to attacks, so I am trying to do anything possible to keep my site safe. Thanks again for the info.
Rowan
July 5, 2010 at 6:53 pm
Thanks for yet another good post! These tips help me to trudge through the waters of wordpress security, so I feel that this gives me a leg up!
Compare Web Hosts / Compare Web Hosting
July 7, 2010 at 3:34 am
Welcome to the world of blog, I think you’re off to a solid start.
Pixelbox Design
July 12, 2010 at 3:36 pm
Excellent Article, Added to favs, keep up the good work.
Charlotte Lawyers
July 15, 2010 at 1:40 am
Protecting is a must in our blog cause we spend our precious time in updating our blog. Computer hackers now a days, wordpress blogs is there favorite. Some blogger protect their blog by frequently changing their passwords and they also keep WordPress installation up to date .
L4NiK
July 16, 2010 at 4:22 pm
Tnx. Useful article!
Site5 Rebate
July 17, 2010 at 2:19 pm
I am planning on making a WordPress blog in a few months. Right now I am reading HTML/CSS books, Php and MySQL to learn how to do things right. This security script is very interesting and I hope that by the time I am done with my blog, hopefully by next year, I will have a very strong grasp on a variety of programming languages and will understand exactly that the above script means!
Candida Pugliesi
July 18, 2010 at 1:44 pm
WE had our site hacked a few months ago, and if I had seen this post beforehand, it probably would have been prevented. Thanks for sharing this with the community.
Steve Marino
July 20, 2010 at 3:33 am
Thanks for sharing. Although it would be more preferable if WordPress would take care of these issues themselves rather than relying on nice people like to you do their job for them.
Willy
July 22, 2010 at 1:13 am
All my wordpress sites have been hacked earlier despite the security plugins I earlier installed. I will implement your tip. Hope it will plug the hole.
Purple Heart
July 23, 2010 at 12:33 pm
Is there anything that can not be hacked. I just setup my first wordpress blog. Now I have to figure out how to stop the hackers… How do you update or edit the code for wordpress?
Ryan Wilson
July 23, 2010 at 7:21 pm
I’m using WordPress a lot and thank you for the helpful informations and tips.
Pixelbox Design
July 24, 2010 at 5:17 pm
Excellent Article, keep up the good work.
blogb4
July 27, 2010 at 12:30 am
Thank you, i’ll use this method for my blog, because i have several blogs with WP
flybar
July 27, 2010 at 10:33 am
This is great stuff! All WP newbies should check this out even if they’re just starting. You wouldn’t want to build your site for months and build traffic only to be hacked. Even if you do get it back, there are irreparable damages like lost reputation and lost income during the span that your site was hacked.
Hey Zappy
July 28, 2010 at 10:56 am
IS this still good or necessary with the WordPress 3.0 version ?
aem intakes
July 29, 2010 at 1:08 am
Thanks for this useful info mate! I am using wordpress and this surely would be helpful!
Hair loss
July 29, 2010 at 8:23 pm
Thanks for this wonderful plugin.. I will install this for sure..
SQL Training
July 29, 2010 at 11:35 pm
Thanks a lot for this great post on WordPress Security. I will be using this tip to make my blog more secured and robust.
Hotels Bowral
August 3, 2010 at 8:31 pm
I love blogs like these – choice code and easy to understand. Thanks matey!
Sydney House Cleaning
August 3, 2010 at 8:33 pm
Isn’t it great when you find EXACTLY what you’re after? That’s what I got when I came here. Many thanks 🙂
Computer Tips
August 6, 2010 at 1:53 pm
Your first post and this is also the first thing everyone should do before starting the wordpress blog.Thanks man,I have implemented your suggestions in my blog
Jane
August 10, 2010 at 11:18 am
Thanks for the article. Very helpful
Rick
August 10, 2010 at 7:13 pm
Hey, is your site still up? I hope so, just found it and its great. Keep it up!
Online Fashion
August 15, 2010 at 6:22 am
no wonder i couldnt install themes on wp! grrr…
marcolins
August 19, 2010 at 10:16 pm
i am using wordpress and it looks so useful for me to post my articles.but i never meet the thing as u said above,what is the hackers,can you help me?
cyrano
August 22, 2010 at 1:38 pm
thanks for this article. i ve a website and i m aware of hacking problem.
Claudia
August 22, 2010 at 11:57 pm
Thank you for great article. Where else could anyone get that kind of information in such a perfect way of writing. Good work
workwear clothing
Gartoo
August 24, 2010 at 8:41 am
Interesting article, with so many bloggers using premade tools to create their sites, it really opens up the opportunities for hackers. I wonder if you could elaborate what the code is actually preventing?
SQL Training
August 25, 2010 at 3:56 am
It is really very important to have our WordPress site secured to keep our business safe…..I think this code will certainly help me make my blog secure
ripzipfx2004@yahoo.com
August 27, 2010 at 2:38 am
welcome, excellent read. keep it coming hacker
The Eye
August 29, 2010 at 12:04 am
Nice post because very useful information and i am using WP
Thanks
Car wash franchise
August 31, 2010 at 7:13 pm
Thanks for the post but i think if it is easy to hack any WordPress it will affect many people badly so I found your post is very useful and could give warning to blog owners.