Tag
Keeping a WordPress site from getting hacked.
Troubleshooting
Error 60 means the remote server presented a certificate and WordPress refused to trust it. WordPress checks against its own bundled list of authorities, not the server's, which is why the browser can be happy while the site is not.
WordPress Tutorials
A file upload field turns a contact form into a way for strangers to put files on your server. Here is how to set types and size limits, where the files end up, and how to keep them private.
Plugins
Core WordPress can already let people sign up. A registration plugin adds custom fields, approval and front-end pages — and every option it adds is a way to hand out the wrong role.
Troubleshooting
Current WordPress prints "Sorry, you are not allowed to upload this file type"; the older wording still fills tutorials and old installs. Both come from the same check, and the fix depends on whether the type is disallowed or the file is not what its extension says.
WordPress Tutorials
The filter receives a context, and the context is the whole point: widening the post context affects every call to wp_kses_post across the site, including places that trusted it to strip exactly what you just allowed.
WordPress Tutorials
The filter receives the user on success and a WP_Error on failure, and every role-based snippet that forgets the second case throws a fatal error on a wrong password. It also only covers the standard login form, which is not the form most plugins use.
WordPress Tutorials
The constant governs core and only core. Setting it to false stops security releases arriving on their own, which is a decision worth making deliberately rather than inheriting from a snippet.
WordPress Tutorials
One line removes the built-in code editor from the dashboard. It does not stop an administrator installing a plugin that edits the same files, which is why it is a hardening step rather than a lock.
WordPress Tutorials
Adding a type to this array is half the job. WordPress checks the real contents of the file separately, and a file whose innards do not match its extension is rejected even after the type is allowed.
WordPress Tutorials
WordPress does this without a plugin, in about fifteen seconds. What matters is knowing exactly what that protection covers, because it does not cover the images on the page.
WordPress Tutorials
Two separate jobs get conflated here: putting a certificate on the server, and telling WordPress to use it. The second one is where sites break, and a plugin only papers over it.
Troubleshooting
Removing malware is the easy half. The half people skip is proving it is gone, and every scanner type is blind to something the others catch.