Recently the WordFence security plugin for WordPress falsely detected a file within the UltimateMember plugin as malware. Removing this will will crash your website. Should you accidentally remove this file before reading that it is a false positive, simply restore it by downloading the plugin again and uploading the removed file.
Filename: class-um-mobile-detect.php
 We recently sent out a domain name renewal reminder to a client who replied that they had already renewed.
Suspecting a game was afoot, we requested a copy of the letter they received. Upon receipt it was apparent they had fallen for a common internet scam.
The letter they received was from a company called iDNS or Internet Domain Name Service. Sounds legitimate and the letter (as seen in this article) looks professional and legitimate. A closer look at the fine print you’ll notice that it is just a trick to get you to switch your domain registrar to them. On top of that, they are charging three times (3x) what we and most registrars charge for annual domain name registrations and renewals.
There are scripts within WordPress that are not intended to be accessed by most users. To prevent such access we can block these scripts by using “mod_rewrite” via our servers’ .htaccess file.
[su_note note_color=”#157BAE” text_color=”#ffffff” radius=”5″]Would you like prompt assistance? If you don’t have time or are not comfortable taking the risk of adding custom code to your website, let me help get this done for you now![/su_note]
Google’s Gmail service recently released a new feature called “Confidential Mode“. This allows you to set how long an email is available for viewing by your intended recipient(s).
As you can imagine, after the set expiration date, the email message is simply and automatically removed from the recipients inbox. Recipients will not have the option of forwarding this email, coping the email contents, or even printing it out.
However, it is still possible for a recipient to simply take a photograph or screenshot.
If an attacker is able to remotely upload a malicious file to your WordPress websites’ “wp-content/uploads/” directory, they would then have the ability to access and execute that file on your server.
How does an attacker remotely upload a malicious file? Through a known or unknown security flaw in any one of your installed plugins, themes or via the WordPress core itself. This is why our Naples WordPress Security company provides affordable WordPress care plans.
With all these potential opportunities for a security hole to open up and for a hacker to take advantage of it, we must remain vigilant. It is imperative to the reputation of your business that you do your best to secure and prevent your WordPress website from being hacked.
Within this article we will show you a technique which effectively prevents scripts and PHP code from execution from within your “uploads” directory and its “sub-directories“.
[su_note note_color=”#157BAE” text_color=”#ffffff” radius=”5″]Would you like prompt assistance? If you don’t have time or are not comfortable taking the risk of adding custom code to your website, let us get this done for you now![/su_note]
So you’ve made the wise investment of purchasing a secure socket layer (SSL) certificate for your WordPress powered website. Great! Now how do you enforce https on all of your website pages, images and other resources? This article will show you how to do just that.
Testing to see if the SSL certificate is correctly installed on your website is straightforward and simple. Just visit your website replacing the “http” with “https” which should reveal the green lock icon followed by the word “Secure” next to it within the address bar (if using Google Chrome as your website browser). If you don’t see the green lock followed by the word “Secure” you will need to contact your website hosting provider to get your SSL Certificate installed or properly configured on your website domain.
If you want to take advantage of your SSL certificate you’ll need to update the URLs on your WordPress website. All of your URLs! We’ll run through these simple steps within this article.
[su_note note_color=”#157BAE” text_color=”#ffffff” radius=”5″]Would you like prompt assistance? If you don’t have time or are not comfortable taking the risk of adding custom code to your website, let us get this done for you now![/su_note]
As you may be aware, Google has begun enforcing their ‘secure by default‘ initiative. This means that they have begun marking all non-HTTPS websites, meaning websites without a secure socket layer (SSL) certificate installed, as ‘Not Secure‘ as of July 2018.
This ‘Not Secure‘ warning, visible within the address bar of Google Chrome, may scare off less technology savvy visitors. More importantly, not having an SSL installed on your website may negatively impact your website’s search ranking. It is rumored that Google may now be using the existence of an SSL certificate as a search engine ranking metric.
With this knowledge, our Naples based website design, maintenance and hosting firm has decided to provide free secure socket layer (SSL) certificates to all of our existing and future clients who have a hosting and maintenance account with us.
Manny Rodrigues, CEO @ENDURTECH
If you need to exclude a page or pages from your WordPress search results we simply need to hook into the WP_Query class. WP_Query allows us to customize the way in which our content shown, in this case hidden, on our websites. For more information on this class read the WP_Query documentation.
In this article we will also cover how you can exclude all pages from the search results so that only your posts are searchable. By default, WordPress search will display all your published posts and published pages. Many times, visitors are simply searching for something within your blog rather than on one of your pages. Removing your pages from your WordPress search results may provide your visitors with more relevant results and thus, a better visitor experience.
[su_note note_color=”#157BAE” text_color=”#ffffff” radius=”5″]Would you like prompt assistance? If you don’t have time or are not comfortable taking the risk of adding custom code to your website, let us get this done for you now![/su_note]
PHP security researchers from RIPSTECHÂ recently disclosed details about an unpatched security flaw impacting WordPress websites up to and including version 4.9.6.
This vulnerability affects the WordPress core, and not any plugin or theme. More precisely, the flaw was found in a PHP function that deletes thumbnails for images uploaded on a WordPress website. This flaw allows for the insertion of malicious code which may traverse the servers’ directories allowing for the deletion of crucial files. Something which isn’t possible without FTP or server access.
The severity of this vulnerability is reduced by the fact that only users of a certain access level (Author or higher) can attempt an exploit. However, if an attacker manages to register even a low-level “Subscriber” account on a site and then elevates its privileges, they can exploit this vulnerability to hijack the site.
Thanks to the security researchers over at RIPSTECH, they not only disclosed this issue but they also created and provided a temporary hotfix.
[su_note note_color=”#157BAE” text_color=”#ffffff” radius=”5″]Would you like prompt assistance? If you don’t have time or are not comfortable taking the risk of adding custom code to your website, let us get this done for you now![/su_note]
It is a frequently suggested WordPress security tip to update your default WordPress database table prefixes. However, upon doing so you now appear to have lost access to your WordPress Dashboard backend.
Attempts to login to your WordPress website Dashboard backend simply results in a redirect to your homepage with a very limited WordPress Admin bar. Furthermore, any attempts to directly access your Dashboard backend via the “wp-admin” url presents you with the following error message:
Sorry, you are not allowed to access this page.
The issue is that your WordPress website database has the previous database table prefix stored within one or more of its table records. You will have to manually update these in order to restore your Dashboard admin access. Not a big deal, using your favorite database tool (we recommend phpMyAdmin) we will show you how to quickly fix this in this article.
[su_note note_color=”#157BAE” text_color=”#ffffff” radius=”5″]Would you like prompt assistance? If you don’t have time or are not comfortable taking the risk of adding custom code to your website, let us get this done for you now![/su_note]
