Disclosure of Additional Security Fix in WordPress 4.7.2

Re:Disclosure of Additional Security Fix in WordPress 4.7.2 by DamnInteresting on Thursday February 02, 2017 @11:54AM (#13552004)

I operate a semi-well-known website that has been running Wordpress for over 11 years, and it's been hacked and attacked relentlessly since the early days. On multiple occasions the attackers have managed to get their "dashboards" onto the server to insert spam links and use my server in a botnet.

I keep my Wordpress and plugins up-to-date, but they still kept finding ways in. What finally worked for me was to write a simple front-loader to replace the Wordpress front-loader. It has a whitelist of allowed $_POST fields, a blacklist for $_POST content, and it deletes anything in $_FILES unless the user is on a whitelisted IP. This has kept the site safe for several years now so far.

Mine is an extreme case, but maybe this approach will be helpful to other extreme cases.

[ Parent | on HN ]

Re:Disclosure of Additional Security Fix in WordPress 4.7.2 by dotancohen on Friday February 10, 2017 @03:55PM (#13618805)

I would love to discuss your loader. I've added a few lines of if(){exit();} to index.php and if you have any ideas to share I would much appreciate the advice. My Gmail username is the same as my HN username. Thanks!

[ Parent | on HN ]