getastra / wp-security-hardening Goto Github PK
View Code? Open in Web Editor NEWWP Hardening – Fix Your WordPress Security
WP Hardening – Fix Your WordPress Security
Add security fixers to disable comments on different content types such as: posts, pages, media types individually or on all these types.
Spammers crawl sites and routinely submit spam links in the comments box. These can go upto 100-1000 comments a week. Many informational sites do not want anyone to be able to comment on pages/posts. Unless the theme has a way to do this via GUI, it is cumbersome to disable the comments section for each page/post.
Wrong recommendation is suggested for PHP version 7.4:
Check for active PHP version. Your current PHP version is outdated and can invite hackers.
Steps to reproduce the behavior:
Check for active PHP version must be shown under Passed Test rather than under Recommendations
Currently WP Hardening is not detecting the new Website Protection plugin
With the plugin installed and activated, when you use wp-cli this plugin throws the following error:
Undefined array key "QUERY_STRING" in wp-security-hardening/modules/hooks.php line 201
This is the offending line:
https://github.com/getastra/wp-security-hardening/blob/master/modules/hooks.php#L201
Steps to reproduce the behavior:
$ wp option get home
It should show the home url you have set for the site.
It errors with:
Undefined array key "QUERY_STRING" in wp-security-hardening/modules/hooks.php line 201
Add a check to make sure this variable exists in $_SERVER
before accessing it.
This also causes an issue when serving WordPress with php -S 127.0.0.1:8080
as that also doesn't set the QUERY_STRING
variable on $_SERVER
.
[Push to master](https://github.com/getastra/wp-security-hardening/actions/runs/3291454537/jobs/5425624468#step:1:35)
Unable to resolve action `10up/action-wordpress-plugin-asset-update@master`, unable to find version `master`
Steps to reproduce the behavior:
After changing the login URL using the WP hardening plugin URL change feature, the URL change works but strangely the wp-admin URL is redirecting the new URL instead of showing a 404 error.
Steps to reproduce the behavior:
WP-admin must show a 404 page instead of showing the new URL login page.
After updating to WordPress 6.4.1 with WP Hardening plugin enabled, I couldn't edit a page in WP, when I click on edit it shows a blank page. While troubleshooting I disabled many plugins and I found out that WP Hardening is the one causing this issue.
Steps to reproduce the behavior:
When clicking on edit it should shows page settings and theme edit options.
N/A
N/A
Undefined method 'prepare_array'
Function 'prepare_array' is called(in issuesScanClass::check_php_version function) but never defined in the class issuesScanClass.
PHP Class: issuesScanClass
File: modules/functions.php
Hey, quick question. I use a custom wordpress folder. The modules/hooks.php starts the plugin with:
<?php
require_once(dirname(__FILE__, 3) . "/../../wp-includes/pluggable.php");
require_once(dirname(__FILE__, 3) . "/../../wp-load.php");
if (!defined('ABSPATH')) exit ('Peekaboo!');
This creates an error if wordpress isn't in the default folder. Is that on purpose? This code fixes it:
if (!defined('ABSPATH')) exit ('Peekaboo!');
require_once(ABSPATH."/wp-includes/pluggable.php");
require_once(ABSPATH."/wp-load.php");`
If needed i can create a pull request 😄
There is inconsistency in php version detection.
After performing the hardening audit, in recommendations, it is saying to update the PHP version to 7.4 even the PHP version is on 8.
Steps to reproduce the behavior:
If the PHP version is on 7.4 or above it shouldn't report that it's outdated.
Plugin settings do not work due to dependency on jQuery UI
Enabling the plugin adds a load of additional scripts and styles to the frontend website.
wp-security-hardening/modules/scripts.php
Lines 71 to 97 in 304fdf8
These include enqueueing jQuery and a number of other assets that are not required or contain no content.
This adds page bloat, reducing page performance and also presents a new vulnerability vector adding frameworks that are not otherwise needed by the website.
Could you either not enqueue these assets or provide a way to filter what is enqueued so we have the option to opt out?
Steps to reproduce the behavior:
No additional frontend assets enqueued on the frontend
Following PHP error is encountered when the score is 100%.
count() : Parameter musy be an array or an object that implements Countable in modules/functions.php on lines 638, 648
Steps to reproduce the behavior:
WP Touch mobile plugin is no longer working properly when the hardening plugin is enabled. The menu function on the mobile version is getting disabled.
Steps to reproduce the behavior:
open birthingwithoutfear.com and discover that the menu is not clickable.
The menu must be openable even after enabling the hardening plugin.
The 3 lines on the top left are not opening the menu as they should, this is a screenshot of the preview of the mobile version.
https://www.dropbox.com/s/2xs3gwa2b61ql79/Bildschirmfoto%202021-03-09%20um%2021.43.24.png?dl=0
Currently the bootstrap assets (/wp-content/plugins/wp-security-hardening/modules/inc/assets/css/tw-bs4.css
) are loaded on front-end pages too where it is not required.
Load the resources only for the WP Hardening pages in the WordPress admin area.
New option:
Add a settings link in the plugins list under WP Hardening.
The plugin calls wp_enqueue_media()
to load the resources required for the media JS APIs - which is adding additional JS code to websites. Since we're not utilizing the media JS APIs, currently, this can be removed.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.