Tips & Tricks
WordPress Security Hacks
Hi guys this is my first post on wpcult the great site Austin built. Hope you guys find it usefull.
If you run a blog using the wordpress software then your blog is a target to hackers. Below I will list some hacks and just how they can help you keep your business/site safe.
The following is code to Block Bad Queries and protect your blog from malicious URL Requests.
Place the following code into a text file and name it what ever you like for example blockbadqueries.php upload it to your plugin folder and activate it in your wordpress admin just as you would any other Plugin
<?php
/*
Plugin Name: Block Bad Queries
Plugin URI: http://perishablepress.com/press/2009/12/22/protect-wordpress-against-malicious-url-requests/
Description: Protect WordPress Against Malicious URL Requests
Author URI: http://perishablepress.com/
Author: Perishable Press
Version: 1.0
*/
global $user_ID; if($user_ID) {
if(!current_user_can(‘level_10’)) {
if (strlen($_SERVER[‘REQUEST_URI’]) > 255 ||
strpos($_SERVER[‘REQUEST_URI’], “eval(“) ||
strpos($_SERVER[‘REQUEST_URI’], “CONCAT”) ||
strpos($_SERVER[‘REQUEST_URI’], “UNION+SELECT”) ||
strpos($_SERVER[‘REQUEST_URI’], “base64”)) {
@header(“HTTP/1.1 414 Request-URI Too Long”);
@header(“Status: 414 Request-URI Too Long”);
@header(“Connection: Close”);
@exit;
}
}
}
?>
This Great plugin was made by Jeff Starr of Digging into WordPress
Protecting your blog with .htaccess
.htaccess files have lots of possibilities. below is some code that will help protect your wordpress from modification of _REQUEST and/or GLOBALS and scripts injection.
This is real simple just paste the following code into your .htaccess file. Always make a backup of your .htaccess before editing, better to be safe.
Options +FollowSymLinks
RewriteEngine On
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
RewriteRule ^(.*)$ index.php [F,L]
Thanks to Oussama for this great hack
Tips & Tricks
How to: Create a fbshare.me shortcode
Social networks are everywhere. I am sure you’re on facebook. Well why not at a facebook share script to your site?
Don’t know PHP that well?
Well here is a simple way to add a share script like fbshare.me to your site, via shortcodes.
Paste the following code in your functions.php file in order to create your shortcode:
function fbshare_script() {
return '<div class="fbshare"><script src="http://widgets.fbshare.me/files/fbshare.js"></script></div>';
}
add_shortcode( 'fbshare', 'fbshare_script' );
Once done, you can display the facebook share button anywhere on your posts. In WordPress editor, make sure you are in HTML mode and insert the following: [fbshare].
When your post will be published, the shortcode will be replaced by the fbshare.me button.
Last week I wrote how to “Use WordPress to print a RSS feed for Eventbrite attendees“. It was pretty popular, but then I found myself in a place that was more annoying. Trying to incorporate that into a blog post or page.
Without having to download a plugin that will allow PHP to be executed inside a post, I would have to create a template file and use that. Which is what I did, and it works just fine. But for some reason I forgot all about shortcodes! With a shortcode, I could generate all the PHP in the functions file and then just call the shortcode when/where I want.
Okay, so lets show the completed PHP code:
function attendee_feed_print_2009() {
global $wpdb;
include_once( ABSPATH . WPINC . '/rss.php' );
$rss = fetch_rss( 'http://www.eventbrite.com/rss/event_list_attendees/384870157' );
$items = array_slice( $rss->items, 0 );
if ( empty( $items ) ) echo '<ul style="list-style-type: none; list-style-image: none; list-style-position: outside;"><li>No items</li></ul>';
else
foreach ( $items as $item ) : ?>
<ul style="list-style-type:none; list-style-image:none; list-style-position:outside; margin-bottom: 0px">
<li><!--<strong><?php echo $item[ 'title' ]; //User name ?></strong><br />-->
<?php echo $item[ 'content' ][ 'encoded' ]; ?>
<hr style="border: 1px solid #ddd; margin-bottom: 8px" />
</li>
</ul>
<?php endforeach;
}
Now, this code has to be changed for it to work as a shortcode. We’ll have to return the function and not print/echo it.
I also wanted to be able to use multiple instances of the code with different feeds. To do so I had to create a argument to extract from the completed short code. I found a demo at: Alex Mansfield’s post.
Remember this:
function attendee_feed_print_2009() {
global $wpdb;
include_once( ABSPATH . WPINC . '/rss.php' );
$rss = fetch_rss( 'http://www.eventbrite.com/rss/event_list_attendees/384870157' );
We are going to update it to read as follows ( changes in bold ) :
function attendee_feed_print_2009( $rss_nbr ) {
global $wpdb;
extract( shortcode_atts( array( 'rss' => ''), $rss_nbr ) );
include_once( ABSPATH . WPINC . '/rss.php' );
$rss = fetch_rss( $rss );
And the final code with the fields updated to return the arguments ( put into your functions.php file ( in between <?php ?> ) ) :
function attendee_feed_print_2009( $rss_nbr ) {
global $wpdb;
extract( shortcode_atts( array( 'rss' => ''), $rss_nbr ) );
include_once( ABSPATH . WPINC . '/rss.php' );
$rss = fetch_rss( $rss );
$items = array_slice( $rss->items, 0 );
$rss_html = '<div id="eventbrite-attendee-list" style="clear:both;">';
if ( empty( $items ) ) $rss_html .= '<ul style="list-style:none;"><li>No attendees, yet.</li></ul>';
else
foreach ( $items as $item ) :
$rss_html .= '<ul style="background:none; list-style:none; margin:0px">';
$rss_html .= '<li style="background:none; list-style:none;">';
$rss_html .= $item[ 'content' ][ 'encoded' ];
$rss_html .= '<hr style="border: 1px solid #ddd; margin-bottom: 10px" />';
$rss_html .= '</li>';
$rss_html .= '</ul>';
endforeach;
$rss_html .= '</div>';
return $rss_html;
}
And lets not forget to add the shortcode function!
add_shortcode( 'eventbrite-attendees', 'attendee_feed_print_2009' );
Final outcome with look like this `[eventbrite-attendees rss="http://your-rss-feed.com/"]`
I’ve created this into a plugin!
Download the plugin: http://wordpress.org/extend/plugins/eventbrite-attendees-shortcode/
Today I was working on the WordCamp.LA site. I was trying to show the “attendee list” on the attendees page with out having to update the page every day.
Since I am using EventBrite to promote and sell ticket to the event I can collect info from there list. Evey one who purchases a ticket gets put into the ticketed database which you can view with either RSS or OPML.
I chose to use RSS and the WordPress core file rss.php.
In the functions.php file I’ve added this function:
function attendee_feed_print_2009() {
global $wpdb;
include_once( ABSPATH . WPINC . '/rss.php' );
$rss = fetch_rss( 'http://www.eventbrite.com/rss/event_list_attendees/384870157' );
$items = array_slice( $rss->items, 0 );
Where I’ve named my function, and included the core RSS file from WordPress. I also told it to fetch the feed from the address (alternatively you can use any feed link you like).
if ( empty( $items ) ) echo '<ul style="list-style-type: none; list-style-image: none; list-style-position: outside;"><li>No items</li></ul>'; else foreach ( $items as $item ) : ?> <ul style="list-style-type:none; list-style-image:none; list-style-position:outside; margin-bottom: 0px"> <li><!--<strong><?php echo $item[ 'title' ]; //User name ?></strong><br />--> <?php echo $item[ 'content' ][ 'encoded' ]; ?> <hr style="border: 1px solid #ddd; margin-bottom: 8px" /> </li> </ul> <?php endforeach;
I then added the core style to fit this current feed.
And the final out come looks like this:
function attendee_feed_print_2009() {
global $wpdb;
include_once( ABSPATH . WPINC . '/rss.php' );
$rss = fetch_rss( 'http://www.eventbrite.com/rss/event_list_attendees/384870157' );
$items = array_slice( $rss->items, 0 );
if ( empty( $items ) ) echo '<ul style="list-style-type: none; list-style-image: none; list-style-position: outside;"><li>No items</li></ul>';
else
foreach ( $items as $item ) : ?>
<ul style="list-style-type:none; list-style-image:none; list-style-position:outside; margin-bottom: 0px">
<li><!--<strong><?php echo $item[ 'title' ]; //User name ?></strong><br />-->
<?php echo $item[ 'content' ][ 'encoded' ]; ?>
<hr style="border: 1px solid #ddd; margin-bottom: 8px" />
</li>
</ul>
<?php endforeach;
}
Don’t forget to wrap the code in <?php ?>
I want to thank John Kolbert for helping me with printing the content:encoded portion. http://pastebin.com/m1588fb30
See it in action: http://wordcamp.la/attendees/
Lost? Since You Can’t Trust Apple Maps, Check Out These 3 Apps Instead
Maybe you have the new software on your Apple device that has made headlines as not being reliable, or perhaps...
An Overview Of Business Models
Knowing Where To Start There are a number of conceptual business models that are used throughout the professional world in...
Google’s New Tool For Bad Links
Google recently announced it has launched its Disavow Tool which allows webmasters to alert Google of any backlinks they think...
5 Reasons Why You Should Or Should Not Use WordPress Plugins
Depending on your needs, WordPress plugins are the best and worst aspects of WordPress. The whole purpose of plugins should...
Cynthia Frelund Net Worth: How Rich is Cynthia Frelund Actually?
Cynthia Frelund is Data Analyst Expert for the NFL Media Network where she focuses on breaking down all the numbers on the show Numbers Game. Moreover, from the perspective of the fans, she is a key influencer in their fantasy football predictions. As of 2019, Cynthia Frelund net worth is estimated to be $1 million. […]
Ron Rivera Net Worth: How Rich is the former Panthers Coach?
Ron Rivera is a retired football player and a former coach who managed Carolina Panthers in the National Football League. As of 2019, Ron Rivera net worth is estimated to be $5 million. Rivera was born on January 7, 1962, in Fort Ord, California. His father Eugenio Rivera was a military man. Due to his […]
Bianca Del Rio Net Worth: How Rich is the Drag Queen Actually?
Roy Haylock professionally known by the stage name Bianca Del Rio, is an American drag queen, comedian, actor, and costume designer. She is best known for winning the 6th season of RuPaul’s Drag Race. As of 2019, Bianca Del Rio net worth is estimated to be $2 million. Haylock was born on June 27, 1975, in Gretna, Louisiana. He […]
Tucker Roberts Net Worth: How Rich is Olivia Munn’s Boyfriend?
Tucker Roberts is an American businessman who recently came in the spotlight after his relationship with Hollywood actress Olivia Munn. As of 2019, Tucker Roberts net worth is estimated to be $10 million. Tucker was born in Philadelphia, Pennsylvania to parents Brian Roberts and Aileen Kennedy Roberts. His father is the CEO of Comcast, an […]
-
Pages3 months agoWrite For Us – Guest Post
-
Showcase3 months ago
StylizedWeb.com
-
News3 months ago
How to: Show/Hide any div box with jQuery in WordPress
-
Tips & Tricks2 months ago
Remove the title attribute using jQuery
-
Tips & Tricks5 months ago
How to: show/hide a widget in WordPress with jQuery
-
Plugins4 months agoTop Membership plugins
-
Tips & Tricks3 months ago
Limit the characters that display on the_title
-
Tips & Tricks1 month ago
Remove spaces when echoing the_title
Tina @ Female Hair Transplant
September 2, 2010 at 3:02 am
For a first time post the article is lucid and very useful.
Oliver Mack
September 5, 2010 at 4:49 pm
Thanks for sharing this tip with us, it is very helpful, running online businesses we have to consider taking precautions procedures in order to work safer.
landscape prints
September 12, 2010 at 4:51 am
It’s not a very secure place, the internet, is it?! I can’t believe how much trouble I have to go to as a blogger to ensure everything is a) working and b) secure!
Ah well!
Henri Labelle
September 13, 2010 at 8:05 am
Thanks for the information! I’ll secure my blog right now!
Great blog by the way 🙂
Taylor
September 17, 2010 at 4:44 pm
Great job on your first post!
budi wadud
September 17, 2010 at 10:52 pm
nice blogg , I Learn and I’ve read, this is a good news, the boss ……… may be an invaluable experience and additional knowledge for me, as well as an introduction from me and thank you
SBI Websites
September 18, 2010 at 9:09 pm
GREAT POST! Seriously.. I recently had a few sites down due to very similar issues. I think it was automated SQL Injections from the looks of things.. Anyhow – strong first post and good information to boot.
Magento ecommerce
September 21, 2010 at 11:30 pm
Thanks for that very useful information. I was looking for some security method for my blog ever since I started my blog. I think my search has come to an end now. I will surely try this.
Translation Agency
September 23, 2010 at 3:11 am
Congrats on becoming a new site owner! And thanks for the great first post 🙂
Werbeagentur Bodensee
September 23, 2010 at 6:15 am
Thanks for sharing these tips. We are setting up a blog right now and I was concerned about security issues. Really helpful!
Regards
Fabian
Debra
September 23, 2010 at 6:26 am
Thanks for that! I always appreciate not having to upload another plugin
Powerfull by UspLabs
September 23, 2010 at 11:48 am
That seems like that code will work and doesn’t look to complicated to install. Thank you!
jocuri
September 24, 2010 at 3:36 am
I have some problems with my wordpress .. I hope this plugin is ok
Chris Wheeler
September 25, 2010 at 5:07 am
Nice first blog post. Internet security in general is often overlooked as unneccesary. This is a fatal mistake, and WordPress users can fall foul of prey!
fantasy books
September 25, 2010 at 10:54 pm
More people need to know how to configure their .htaccess files. As a matter of fact, I just compared your recommended settings to my own – I need to make a few tweaks. Thanks for the informative article.
Opal
September 30, 2010 at 9:24 pm
Wow.. useful to know, I had no idea that there was this kind of issue with WP. I once had a script injection attack on a regular html web site I was running, and my web host gave me a javascript to put in the site which would protect it from those kinds of events in the future. I don’t quite understand all the terms you use – what’s a ‘malicious URL request’? Is that an automated request sent by a bot?
Kizie
October 11, 2010 at 7:59 am
Thanks for advice I used your practine on my page.
peter
October 13, 2010 at 6:36 am
Its really so alarming for those like me having their blogs in the wordpress, I wonder why everyone is saying thanks to you in their comments, are these all hackers?
joe brown
October 14, 2010 at 2:01 am
You have written very well in your post. Good job.
Vin Diesel
October 21, 2010 at 1:12 am
This is something dangerous and can be very harmful for the wordpress users. I think wordpress should be careful about it otherwise it can have serious security problem.
TheAffairLady
October 27, 2010 at 8:16 am
I’m constantly worried about securing my wordpress. I use the bad behavior plugin which I think is similar to the plugin in your post. I see hack attempts in my log files all the time but so far I think so good.
cricket broadband
October 28, 2010 at 2:35 am
Your post is very useful to me. Many thanks to you!
Management Consulting Firm
October 29, 2010 at 11:18 am
Hi nice information for the word press and thanks for sharing WordPress Security Hacks system.
WhatLiveToday
November 6, 2010 at 1:30 am
Good post .. I like this article, very useful for me .. if you have a little time, you can visit my website.. thanks for sharing .. 🙂
Vetement Grossesse
November 9, 2010 at 1:37 am
WordPress needs no introduction because it is currently creating lots of waves on the internet at the moment. Some people had gotten their fingers burnt by activities of some online criminals that specialize in stealing information that are in other peoples’ sites and blogs.
creare site
November 9, 2010 at 3:53 am
You must have the latest version of WordPress if you want to be protected. This plugin seems to be very easy to use. However I prefer the protection made from the .htaccess file, exactly like in this tutorial.
u10
November 19, 2010 at 4:10 am
well thats looks good u10 article to read, but anyway i like it as much as u10 games
Britt Phillips
November 20, 2010 at 8:47 am
Great useful WordPress blog information. WordPress security is something every blog owner should be aware of and NOT take lightly.
Jim
November 28, 2010 at 2:09 am
Good information on how to make a blog more secure. Thanks.
Anite @ learn cloud living
November 28, 2010 at 3:00 pm
I will add this protection for my blogs. It’s been awhile since you wrote your first blog… hope you will come back and write some more useful information!
Why My Country Sucks
December 6, 2010 at 11:03 pm
wow, I shall give wordpress a second look before I continue building my site!!
Bold Reports
December 7, 2010 at 4:54 am
I will follow the instruction written here. They are awesome and much needed for newbie’s like me
jocuri cu bile
December 9, 2010 at 3:22 am
GREAT POST! Seriously.. I recently had a few sites down due to very similar issues.
Apple
December 9, 2010 at 4:29 am
Hey thanks for this post. It’s been helpful and enjoyable to read. Great work. Keep posting.
web development
December 13, 2010 at 9:47 pm
i was looking for such type of informative news and i get it through your blog so i am very much thankful to you for sharing.
web development
December 13, 2010 at 10:05 pm
really very nice information sharing and i am looking for such type of informative news and i get through this blog so i am very much thankful to you.
Shailender from India Darshan
December 15, 2010 at 12:31 am
Many wordpress user would be benefited from this post. Good information is shared in the first blog…Keep it up.
Optometrist Reno NV
December 21, 2010 at 4:44 pm
Yikes! Good to know…
Worlds Headlines
December 27, 2010 at 5:20 am
Thanks I have a wordpress blog and I do not want it to be hacked. Really nice and thanks for your kind help.
SamiParker
December 29, 2010 at 6:24 am
Its really a pleasure to be here at this site. I feel like visiting it again and again. samiparker09@gmail.com
Alert 1
January 6, 2011 at 8:31 am
You state that this code is to “block bad queries”. What exactly does that mean? How do you define a “bad query”?
Sami Parker
January 6, 2011 at 10:01 am
Well its really a wonderful and sort of unique one, I like the way it has shown the things, its really nice. Thanks a lot for sharing it. I would love to recommend it to others.
Finally Fast
January 7, 2011 at 1:39 pm
Thank you for the useful information. I will use this method to secure my blog!
Pferdehaftpflicht
January 11, 2011 at 9:02 am
nice blogg (Pferdehaftpflicht) , I Learn and I’ve read, this is a good news, the boss ……… may be an invaluable experience and additional knowledge for me, as well as an introduction from me and thank you
Jetski
January 12, 2011 at 7:35 am
Congrats on becoming a new site owner! And thanks for the great first post 🙂
Uzair
January 12, 2011 at 9:43 am
Nic post thanks for sharing
Web Design Preston
January 12, 2011 at 11:23 am
I know this thread is getting old now but WordPress hacking is still a real issue. We have a large number of sites built on WordPress and many of them have been hacked as recent as the last 2 weeks. Real bad hacks as well with the database wiped and everything. It’s a pain because WordPress is such a great platform to use and very popular with our clients – they love the easy CMS. Wish we could fix WordPress hacking once and for all…!
Daniel @ PHP Programmer Philippines
January 13, 2011 at 8:09 am
Thanks for sharing this, i just used the .htaccess method to protect my wordpress blog, I was searching for a way to protect my blog from hackers and i got into this page. 🙂
Regards,
Daniel
E Learning Online
January 27, 2011 at 4:32 am
Miguel
Thanks, I will look at the second option
I am using these plugins on my blogs:
Firewall
Block Bad Queries (!) using it already
Chap Secure Login
highly recommended
thanks
Jack
Vienna Souvenirs
January 27, 2011 at 11:21 pm
I recently came across your blog and have been reading along. I thought I would leave
my first comment. I don’t know what to say except that I have enjoyed reading. Nice
blog, I will keep visiting this blog very often. Take a piece of Vienna back to your home