☆ Not an expert. Probably wrong.
A little sensationalist written blog post by Barak Tawily claims that WordPress is vulnerable to a DoS attack because of the load-scripts.php file which concatenates JavaScript files on the fly.
Continue reading “How to mitigate CVE-2018-6389 – the load-scripts.php DoS “attack” in WordPress”
OMFG, BREAKING NEWS: Thousands of WordPress sites affected by some vulnerability.
The resources you have available to spend on WordPress security for your website usually vary vastly whether you’re an international corporation or just a hobbyist blogger. But since most attacks are automated by bots looking for vulnerabilities, a lot of the threats are the same. Here are some WordPress security measures that bloggers and small business with limited resources easily can take.
Email is fundamentally insecure. There are such a plethora of issues with it, it is crazy to think about the kind of information sent with it. It is probably even crazier when you realize we’ve had a solution for sending secure email since 1991.
Continue reading “Secure email: Encrypt and sign your emails with PGP/GnuPG”
WordPress doesn’t use a nonce for the login form, which opens up for you to perform a WordPress session donation attack.
Continue reading “How to perform and mitigate a WordPress session donation attack”
Tavis Ormandy from Google’s Project Zero contacted Cloudflare to report a security problem with their service. It turned out that in some unusual circumstances, they would bleed memory that contained private information.
Inspired by how Facebook assists their users when they log in, I decided to implement something like the same for WordPress.
Continue reading “Giving users a helping hand when authorizing them in WordPress”
For 20 years or so, there has been the debate over whether you should use www or not in your web site’s canonical hostname. So should you use www or not?
Continue reading “To www or not to www – Should you use www or not in your domain?”
If you have someone’s public SSH key, you can use OpenSSL to safely encrypt a file and send it to them over an insecure connection (i.e. the internet). They can then use their private key to decrypt the file you sent. Continue reading “Encrypt and decrypt a file using SSH keys”
Enabling uploads of SVG files in WordPress is quite easy, and there is a tonne of posts on the Interwebs explaining how you do it. Usually along the lines of:
function add_svg_to_upload_mimes( $upload_mimes ) {$upload_mimes['svg'] = 'image/svg+xml';$upload_mimes['svgz'] = 'image/svg+xml';return $upload_mimes;}add_filter( 'upload_mimes', 'add_svg_to_upload_mimes', 10, 1 );
And that’s pretty much it.
Except it is not.
Continue reading “SVG uploads in WordPress (the Inconvenient Truth)”
