PHP has a built-in function get_defined_constants that returns an array with the names of all the constants and their values. Because WordPress is built in PHP, We can use this function to get all WordPress constants. ⚠️ Use this snippet with caution, as the code will display sensitive information including your database username and password … Read full article →
1. log in to the MySQL: mysql -u root -p; 2. Select the database: use database_name; 3. List all users: select * from wp_users\G 4. Change the password for the user you require: UPDATE wp_users SET user_pass=MD5(‘new_password_here’) where ID=user_id_here;
Deleting all inactive WordPress themes and plugins from your website is a recommended security practice. Even when deactivated, old, insecure plugins and themes might still pose a threat to the security of your WordPress website. Here are oneliners to remove inactive themes and plugins from your WordPress website using WP-CLI. List all inactive WordPress themes: Delete … Read full article →
You can download older versions of any plugin hosted on WordPress.org directly from the website or from WP-CLI. To download older plugin versions from WordPress.org click on the Advanced view link scroll down to the end of the page and under Previous Versions select the version that you would like to download. that’s it! Another … Read full article →
I recently did a guide on 5 (Less known) WordPress Security Tips to keep your website safe from hackers where I suggested moving wp-config.php outside the web root directory as a simple change that adds an additional layer of security to your WordPress website. The wp-config.php file contains your MySQL database username & password, along with … Read full article →
Since WordPress 5.3, a prompt asking to confirm the administration email address appears every six months when a user with an administrator role tries to access the wp-admin dashboard. This feature was introduced to make sure that the email address configured in Settings → General is active. When this screen is shown you have several options: But … Read full article →
Kinsta has a list of Banned plugins that they don’t allow to be used on their hosting. The complete list of plugins can be viewed here: https://kinsta.com/knowledgebase/banned-plugins/ But even after you migrate your WordPress website from Kinsta to another hosting provider, you are left with this annoying Banned Why? message on some plugins. To get … Read full article →
The most regularly seen attack type is script injection (XSS attack), rogue scripts are injected into the webpage for malicious purposes. This includes redirects to third-party websites, collecting user data, downloading malware to visitors, etc. WordPress has a bunch of useful developer functions that are used to sanitize data (Validating Sanitizing and Escaping User Data) … Read full article →
Here are the most common types of WordPress malware attacks. Permanent malware eradication entails conducting a thorough investigation and determining the type of attack that occurred, how it occurred, and permanently closing that door. This is known as root cause analysis and vulnerability fix in the security world. 🔀 Cross-site scripting (XSS) The most regularly … Read full article →
When cleaning websites that have large databases, regular text editors can’t even open the database dumps (Notepad++ supports files up to 2GB in size). So to run a search and replace on large database dumps I suggest using regex-replace line-by-line in PHP, or setting up WPCLI and running regex search & replace. Here is a … Read full article →