Tips & Tricks
WordPress Security Hacks
Hi guys this is my first post on wpcult the great site Austin built. Hope you guys find it usefull.
If you run a blog using the wordpress software then your blog is a target to hackers. Below I will list some hacks and just how they can help you keep your business/site safe.
The following is code to Block Bad Queries and protect your blog from malicious URL Requests.
Place the following code into a text file and name it what ever you like for example blockbadqueries.php upload it to your plugin folder and activate it in your wordpress admin just as you would any other Plugin
<?php
/*
Plugin Name: Block Bad Queries
Plugin URI: http://perishablepress.com/press/2009/12/22/protect-wordpress-against-malicious-url-requests/
Description: Protect WordPress Against Malicious URL Requests
Author URI: http://perishablepress.com/
Author: Perishable Press
Version: 1.0
*/
global $user_ID; if($user_ID) {
if(!current_user_can(‘level_10’)) {
if (strlen($_SERVER[‘REQUEST_URI’]) > 255 ||
strpos($_SERVER[‘REQUEST_URI’], “eval(“) ||
strpos($_SERVER[‘REQUEST_URI’], “CONCAT”) ||
strpos($_SERVER[‘REQUEST_URI’], “UNION+SELECT”) ||
strpos($_SERVER[‘REQUEST_URI’], “base64”)) {
@header(“HTTP/1.1 414 Request-URI Too Long”);
@header(“Status: 414 Request-URI Too Long”);
@header(“Connection: Close”);
@exit;
}
}
}
?>
This Great plugin was made by Jeff Starr of Digging into WordPress
Protecting your blog with .htaccess
.htaccess files have lots of possibilities. below is some code that will help protect your wordpress from modification of _REQUEST and/or GLOBALS and scripts injection.
This is real simple just paste the following code into your .htaccess file. Always make a backup of your .htaccess before editing, better to be safe.
Options +FollowSymLinks
RewriteEngine On
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2})
RewriteRule ^(.*)$ index.php [F,L]
Thanks to Oussama for this great hack
Tips & Tricks
How to: Create a fbshare.me shortcode
Social networks are everywhere. I am sure you’re on facebook. Well why not at a facebook share script to your site?
Don’t know PHP that well?
Well here is a simple way to add a share script like fbshare.me to your site, via shortcodes.
Paste the following code in your functions.php file in order to create your shortcode:
function fbshare_script() {
return '<div class="fbshare"><script src="http://widgets.fbshare.me/files/fbshare.js"></script></div>';
}
add_shortcode( 'fbshare', 'fbshare_script' );
Once done, you can display the facebook share button anywhere on your posts. In WordPress editor, make sure you are in HTML mode and insert the following: [fbshare].
When your post will be published, the shortcode will be replaced by the fbshare.me button.
Last week I wrote how to “Use WordPress to print a RSS feed for Eventbrite attendees“. It was pretty popular, but then I found myself in a place that was more annoying. Trying to incorporate that into a blog post or page.
Without having to download a plugin that will allow PHP to be executed inside a post, I would have to create a template file and use that. Which is what I did, and it works just fine. But for some reason I forgot all about shortcodes! With a shortcode, I could generate all the PHP in the functions file and then just call the shortcode when/where I want.
Okay, so lets show the completed PHP code:
function attendee_feed_print_2009() {
global $wpdb;
include_once( ABSPATH . WPINC . '/rss.php' );
$rss = fetch_rss( 'http://www.eventbrite.com/rss/event_list_attendees/384870157' );
$items = array_slice( $rss->items, 0 );
if ( empty( $items ) ) echo '<ul style="list-style-type: none; list-style-image: none; list-style-position: outside;"><li>No items</li></ul>';
else
foreach ( $items as $item ) : ?>
<ul style="list-style-type:none; list-style-image:none; list-style-position:outside; margin-bottom: 0px">
<li><!--<strong><?php echo $item[ 'title' ]; //User name ?></strong><br />-->
<?php echo $item[ 'content' ][ 'encoded' ]; ?>
<hr style="border: 1px solid #ddd; margin-bottom: 8px" />
</li>
</ul>
<?php endforeach;
}
Now, this code has to be changed for it to work as a shortcode. We’ll have to return the function and not print/echo it.
I also wanted to be able to use multiple instances of the code with different feeds. To do so I had to create a argument to extract from the completed short code. I found a demo at: Alex Mansfield’s post.
Remember this:
function attendee_feed_print_2009() {
global $wpdb;
include_once( ABSPATH . WPINC . '/rss.php' );
$rss = fetch_rss( 'http://www.eventbrite.com/rss/event_list_attendees/384870157' );
We are going to update it to read as follows ( changes in bold ) :
function attendee_feed_print_2009( $rss_nbr ) {
global $wpdb;
extract( shortcode_atts( array( 'rss' => ''), $rss_nbr ) );
include_once( ABSPATH . WPINC . '/rss.php' );
$rss = fetch_rss( $rss );
And the final code with the fields updated to return the arguments ( put into your functions.php file ( in between <?php ?> ) ) :
function attendee_feed_print_2009( $rss_nbr ) {
global $wpdb;
extract( shortcode_atts( array( 'rss' => ''), $rss_nbr ) );
include_once( ABSPATH . WPINC . '/rss.php' );
$rss = fetch_rss( $rss );
$items = array_slice( $rss->items, 0 );
$rss_html = '<div id="eventbrite-attendee-list" style="clear:both;">';
if ( empty( $items ) ) $rss_html .= '<ul style="list-style:none;"><li>No attendees, yet.</li></ul>';
else
foreach ( $items as $item ) :
$rss_html .= '<ul style="background:none; list-style:none; margin:0px">';
$rss_html .= '<li style="background:none; list-style:none;">';
$rss_html .= $item[ 'content' ][ 'encoded' ];
$rss_html .= '<hr style="border: 1px solid #ddd; margin-bottom: 10px" />';
$rss_html .= '</li>';
$rss_html .= '</ul>';
endforeach;
$rss_html .= '</div>';
return $rss_html;
}
And lets not forget to add the shortcode function!
add_shortcode( 'eventbrite-attendees', 'attendee_feed_print_2009' );
Final outcome with look like this `[eventbrite-attendees rss="http://your-rss-feed.com/"]`
I’ve created this into a plugin!
Download the plugin: http://wordpress.org/extend/plugins/eventbrite-attendees-shortcode/
Today I was working on the WordCamp.LA site. I was trying to show the “attendee list” on the attendees page with out having to update the page every day.
Since I am using EventBrite to promote and sell ticket to the event I can collect info from there list. Evey one who purchases a ticket gets put into the ticketed database which you can view with either RSS or OPML.
I chose to use RSS and the WordPress core file rss.php.
In the functions.php file I’ve added this function:
function attendee_feed_print_2009() {
global $wpdb;
include_once( ABSPATH . WPINC . '/rss.php' );
$rss = fetch_rss( 'http://www.eventbrite.com/rss/event_list_attendees/384870157' );
$items = array_slice( $rss->items, 0 );
Where I’ve named my function, and included the core RSS file from WordPress. I also told it to fetch the feed from the address (alternatively you can use any feed link you like).
if ( empty( $items ) ) echo '<ul style="list-style-type: none; list-style-image: none; list-style-position: outside;"><li>No items</li></ul>'; else foreach ( $items as $item ) : ?> <ul style="list-style-type:none; list-style-image:none; list-style-position:outside; margin-bottom: 0px"> <li><!--<strong><?php echo $item[ 'title' ]; //User name ?></strong><br />--> <?php echo $item[ 'content' ][ 'encoded' ]; ?> <hr style="border: 1px solid #ddd; margin-bottom: 8px" /> </li> </ul> <?php endforeach;
I then added the core style to fit this current feed.
And the final out come looks like this:
function attendee_feed_print_2009() {
global $wpdb;
include_once( ABSPATH . WPINC . '/rss.php' );
$rss = fetch_rss( 'http://www.eventbrite.com/rss/event_list_attendees/384870157' );
$items = array_slice( $rss->items, 0 );
if ( empty( $items ) ) echo '<ul style="list-style-type: none; list-style-image: none; list-style-position: outside;"><li>No items</li></ul>';
else
foreach ( $items as $item ) : ?>
<ul style="list-style-type:none; list-style-image:none; list-style-position:outside; margin-bottom: 0px">
<li><!--<strong><?php echo $item[ 'title' ]; //User name ?></strong><br />-->
<?php echo $item[ 'content' ][ 'encoded' ]; ?>
<hr style="border: 1px solid #ddd; margin-bottom: 8px" />
</li>
</ul>
<?php endforeach;
}
Don’t forget to wrap the code in <?php ?>
I want to thank John Kolbert for helping me with printing the content:encoded portion. http://pastebin.com/m1588fb30
See it in action: http://wordcamp.la/attendees/
Lost? Since You Can’t Trust Apple Maps, Check Out These 3 Apps Instead
Maybe you have the new software on your Apple device that has made headlines as not being reliable, or perhaps...
An Overview Of Business Models
Knowing Where To Start There are a number of conceptual business models that are used throughout the professional world in...
Google’s New Tool For Bad Links
Google recently announced it has launched its Disavow Tool which allows webmasters to alert Google of any backlinks they think...
5 Reasons Why You Should Or Should Not Use WordPress Plugins
Depending on your needs, WordPress plugins are the best and worst aspects of WordPress. The whole purpose of plugins should...
Lil Huddy Net Worth: How Rich is the Tik Tok Superstar Actually?
Chase Hudson, who is better known as Lil Huddy, is an American social media personality who is very popular on the musical platform called TikTok where he has amassed a massive following of over 5.2 million followers along with more than 300 million hearts. As of 2019, Lil Huddy net worth is estimated to be […]
Cynthia Frelund Net Worth: How Rich is Cynthia Frelund Actually?
Cynthia Frelund is Data Analyst Expert for the NFL Media Network where she focuses on breaking down all the numbers on the show Numbers Game. Moreover, from the perspective of the fans, she is a key influencer in their fantasy football predictions. As of 2019, Cynthia Frelund net worth is estimated to be $1 million. […]
Ron Rivera Net Worth: How Rich is the former Panthers Coach?
Ron Rivera is a retired football player and a former coach who managed Carolina Panthers in the National Football League. As of 2019, Ron Rivera net worth is estimated to be $5 million. Rivera was born on January 7, 1962, in Fort Ord, California. His father Eugenio Rivera was a military man. Due to his […]
Bianca Del Rio Net Worth: How Rich is the Drag Queen Actually?
Roy Haylock professionally known by the stage name Bianca Del Rio, is an American drag queen, comedian, actor, and costume designer. She is best known for winning the 6th season of RuPaul’s Drag Race. As of 2019, Bianca Del Rio net worth is estimated to be $2 million. Haylock was born on June 27, 1975, in Gretna, Louisiana. He […]
-
Pages3 months agoWrite For Us – Guest Post
-
Showcase3 months ago
StylizedWeb.com
-
News3 months ago
How to: Show/Hide any div box with jQuery in WordPress
-
Tips & Tricks2 months ago
Remove the title attribute using jQuery
-
Tips & Tricks5 months ago
How to: show/hide a widget in WordPress with jQuery
-
Plugins4 months agoTop Membership plugins
-
Tips & Tricks3 months ago
Limit the characters that display on the_title
-
Tips & Tricks1 month ago
Remove spaces when echoing the_title
Wordpress Designer
June 21, 2011 at 5:52 pm
I was a victim few months back on one of my sites…. but later discovered that reasons were more about me and not WP… anyways nice info… Hail Open Source, long live WP….!
Bartending Jobs
June 24, 2011 at 4:48 pm
Congrats on your first post!
nik@technojourney
June 27, 2011 at 11:26 am
I love to read the articles on wpcult… but don’t like it when some others write it instead of admin…
bebek
July 4, 2011 at 12:49 am
wordpress is a safe script anyway. But your codes will be improve this. Thanks i will use .
passdrugtest
July 10, 2011 at 11:40 pm
Good post .keep continue your post .i like your writing style.thanks for sharing.
pubs in bolton
July 12, 2011 at 4:16 pm
Nice article great first post, Very informative and congrats on becoming the new site owner.
Jorge
July 14, 2011 at 3:27 pm
This article is of 2010 and all the information is valid in 2011, you got a really nice blog and I’ll bookmark it to read all the articles.
Toilet
July 25, 2011 at 4:00 am
That’s a very bad news that my wordpress blog is at risk of being hacked:/. You are doing a great job by informing us about such danger.
sheric
July 25, 2011 at 7:33 am
Thank you very interesting.
Ashley
August 2, 2011 at 4:35 pm
Thanks for the code. I have been looking for something to block bad queries and protect my blogs from malicious URL requests.
Dell Parts
August 2, 2011 at 9:22 pm
Good research Miguel
great work you have done
bhayden96@bestmassagechair
August 5, 2011 at 3:18 am
Greatttttt!what a blog,man.i found it really interesting and i am going to bookmark this..Don’t quit posting ,you are a writer…..:-)
موقع زواج
August 7, 2011 at 7:34 am
good words
thank you
Wordpress Plugins
August 8, 2011 at 4:16 am
This post provides best security for my WordPress Plugin to avoid the hacking.. I am just using this code right now..
Leonardo Casci
August 9, 2011 at 4:08 am
great article, you should write more often! keep it up
business cartoon
August 18, 2011 at 9:34 pm
I m fully satisfied with the post that how to remove the hacking or not to hacking the word press because it results in a negative effect.we will be careful about that.
Stock Market Blog
August 21, 2011 at 9:39 am
When I had my hosting company, one of my client’s blogs kept getting hacked. I fixed it a half a dozen times before told him that he has to fix his own issues – pointed him to posts like this around the internet.
Good stuff!
Raief
August 24, 2011 at 1:19 am
Always looking for security info. This is still up-to-date.
Much appreciated, bookmarked, rt’d, fb’d, and dugg.
Hello Kitty Shop
August 26, 2011 at 5:45 am
Yes, website Security is very important, and i have a wordpress blog too, thanks for the post.
Michael Dorf
September 2, 2011 at 10:53 pm
Nice first post! I’ve used Block Bad Queries in a couple of blogs and it worked exceptionally well. I like plugins that require minimal configuration! Thanks!
West Africa Gold Exploration
September 7, 2011 at 4:31 pm
Its been a while since i read such a nice article just like this.
Painting Antique Furniture
September 7, 2011 at 4:35 pm
Interesting Article. great job for the this site.
windows addict
September 10, 2011 at 1:30 am
This is very interesting, You’re a very skilled blogger. I have joined your rss feed and look forward to seeking more of your great post. Also, I have shared your site in my social networks!
max
September 21, 2011 at 4:38 am
Really good article, good to know about these security issues with my blog.
casey dennison
September 21, 2011 at 4:32 pm
Thanks this is very useful. I will use this for all of my blogs.
Joe
September 24, 2011 at 3:28 am
thanks for sharing!!! 😀
sporting goods
October 11, 2011 at 5:38 pm
Nice code. I will try it.
buy cheap backlinks
October 11, 2011 at 10:23 pm
Great article. It is always good to add in extra layers of safety, especially when it comes to protecting your business or name.
Singles Holidays
October 13, 2011 at 2:39 am
I am an electrical & electronics engineer, and i am thinking about joining APPIN institute of ethical hacking & IT security bcoz I am interested in this field, so will there be better career options for me in this field after having an international diploma certification in ethical hacking?
Stuart
October 17, 2011 at 5:30 am
Great post, and hope you keep writing for the site. We are moving our site to WordPress so will be implementing these tips to keep it secure.
David Josh
October 18, 2011 at 10:21 pm
Thank you for the code, I was looking for something like this for long, my website has been hacked once and I needed something urgently to safe guard, shall try this. Thanks !
Rob Benwell
October 19, 2011 at 3:33 am
Thank you for sharing this tool. Now I know that I’m in a safe hand. More Power!
Rob Benwell
Bryan McKenzie
October 23, 2011 at 12:00 pm
This has happened to me once before. Thanks for sharing this information, it’s always good to be cautious about these things and keep our websites protected. For a lot of people it’s their livelihood!
Kredit
October 24, 2011 at 5:19 am
Hey, thanks for the good tips. Am always in search of good safety information for WordPress. They are easy to implement even for beginners.
yonobae
October 25, 2011 at 8:34 am
Your postings are really very informative, that’s why I can’t help myself but come back and see what you posted again for me to gain knowledge. Thank you.
S3bY
October 26, 2011 at 5:30 am
I was hacked one and since than I started paying more attention to security!
So thank for this post..I will implement it right away!
soniya
October 26, 2011 at 11:29 pm
very informative thanks lotttt
Seo
October 28, 2011 at 2:13 am
This is great post,very useful! I think i will improve my website security…
albert @ fantasy stock market
October 30, 2011 at 3:03 pm
Thanks for the great info on protecting my blog!
Grid
October 30, 2011 at 8:59 pm
I think i have to improve my web security ASAP.
gender predictor
October 31, 2011 at 11:14 pm
thanks for sharing the article, this is very useful for us