Deleting all inactive WordPress themes and plugins from your website is a recommended security practice. Even when deactivated, old, insecure plugins and themes might still pose a threat to the security of your WordPress website. Here are oneliners to remove inactive themes and plugins from your WordPress website using WP-CLI. List all inactive WordPress themes: Delete … Read full article →
You can download older versions of any plugin hosted on WordPress.org directly from the website or from WP-CLI. To download older plugin versions from WordPress.org click on the Advanced view link scroll down to the end of the page and under Previous Versions select the version that you would like to download. that’s it! Another … Read full article →
I recently did a guide on 5 (Less known) WordPress Security Tips to keep your website safe from hackers where I suggested moving wp-config.php outside the web root directory as a simple change that adds an additional layer of security to your WordPress website. The wp-config.php file contains your MySQL database username & password, along with … Read full article →
Since WordPress 5.3, a prompt asking to confirm the administration email address appears every six months when a user with an administrator role tries to access the wp-admin dashboard. This feature was introduced to make sure that the email address configured in Settings → General is active. When this screen is shown you have several options: But … Read full article →
Kinsta has a list of Banned plugins that they don’t allow to be used on their hosting. The complete list of plugins can be viewed here: https://kinsta.com/knowledgebase/banned-plugins/ But even after you migrate your WordPress website from Kinsta to another hosting provider, you are left with this annoying Banned Why? message on some plugins. To get … Read full article →
The most regularly seen attack type is script injection (XSS attack), rogue scripts are injected into the webpage for malicious purposes. This includes redirects to third-party websites, collecting user data, downloading malware to visitors, etc. WordPress has a bunch of useful developer functions that are used to sanitize data (Validating Sanitizing and Escaping User Data) … Read full article →
Here are the most common types of WordPress malware attacks. Permanent malware eradication entails conducting a thorough investigation and determining the type of attack that occurred, how it occurred, and permanently closing that door. This is known as root cause analysis and vulnerability fix in the security world. 🔀 Cross-site scripting (XSS) The most regularly … Read full article →
When cleaning websites that have large databases, regular text editors can’t even open the database dumps (Notepad++ supports files up to 2GB in size). So to run a search and replace on large database dumps I suggest using regex-replace line-by-line in PHP, or setting up WPCLI and running regex search & replace. Here is a … Read full article →
According to publicwww about 5000 websites are known to be infected with this type of WordPress malware. It is similar to legendarytable.com malware and adds js code into every post and page so that visitors are redirected to third-party websites. Check if infected To check if your website is infected, open PHPMyAdmin, select your database, … Read full article →
The .htaccess file is a configuration file that is used by the Apache web server to control various aspects of how the server functions. In WordPress, the .htaccess file is used to control various settings related to the permalinks of your website, as well as to protect your website from various types of attacks. The … Read full article →