2017
Giving users a helping hand when authorizing them in WordPress
Inspired by how Facebook assists their users when they log in, I decided to implement something like the same for WordPress.
Category
wordpress
-
-
2017
Move your WordPress site from non-www to www domain
So, you’ve launched your WordPress site on a non-www domain, like example.com, but since then found out that running it on on www, like www.example.com, is better and want to move? You’re in luck, because it is really easy.
-
2016
Flexible Content Fields in Field Manager
[Field Manager](http://fieldmanager.org/) doesn’t have a flexible content field type as [Advanced Custom Fields Pro](https://www.advancedcustomfields.com/pro/) does, but it is possible to mimic the functionality by using a little logic.
-
2016
SVG uploads in WordPress (the Inconvenient Truth)
Enabling uploads of SVG files in WordPress is quite easy, and there is a tonne of posts on the Interwebs explaining how you do it. Usually along the lines of: ``` function add_svg_to_upload_mimes( $upload_mimes ) { $upload_mimes['svg'] = 'image/svg+xml'; $upload_mimes['svgz'] = 'image/svg+xml'; return $upload_mimes; } add_filter( 'upload_mimes', 'add_svg_to_upload_mimes', 10, 1 ); ``` And that’s pretty much it. Except it is not.
-
2016
Allow SVG uploads to WordPress when behind Sucuri CloudProxy
Uploading SVG files to WordPress when you’re behind the Sucuri CloudProxy Web Application Firewall isn’t that straightforward, but it is possible.
-
2015
Run all due cron events for WordPress with WP-CLI
Running a real cronjob is much more reliable than WordPress’ built-in “maybe-will-trigger” solution. But if you’re running a multisite network, you have to add a crontab entry for every site you set up – which is tedious. Thanks to WP-CLI, we can use a small bash script instead, which will run all due events for all sites for us. Oh, and it works for single sites as well.
-
2015
Block access to PHP files on your WordPress site with Nginx
In your WordPress site, there are directories that include PHP files that visitors should never be able to access directly. They are only there for WordPress to function as an application that runs on your server. But because of WordPress’ directory and file structure, they are kind of accessible to the public. All of them are meant to be part of a larger application – WordPress, that is – and should not cause any harm if called directly – that we know. Some of the files execute some code even when ran standalone. An attacker might know of a clever way to make that code run in an unexpected manner, causing harm. To be on the safe side, we should deny access to all these PHP files from the outside world. Since we block access to them in our Nginx configuration, PHP will still run them as usual and WordPress will work just fine.
-
2015
Restrict access to the WordPress dashboard by IP address in Nginx
If you have a static IP address, like from your office, or [your own private VPN](https://www.bjornjohansen.com/setting-up-your-own-pptp-vpn), you can increase your security tremendously by restricting all logins to that IP address. The effect is that even if an attacker knows your login credentials, they will not be able to log in or access any part of the WordPress Dashboard.
-
2015
Strict file ownership for your WordPress installation
WordPress requires write access to one directory, and that one directory only: the directory returned by `wp_upload_dir()`. By default, this is `/wp-content/upload`, but it can be configured to anything that is beneath your document root, like `/media`, if you want to.
-
2015
Two Factor Authentication for WordPress
If you’re using a strong password, brute-forcing is a very inefficient way of breaking into your WordPress account, and if it is really strong, dictionary attacks won’t help much either. However, there are are other, easier, ways for a mischievous person to get their hands on your login credentials e.g. with phishing, keyloggers or a MITM attack. By using a two-factor solution, you will increase your login security by an order of magnitude.