WordPress by default doesn’t protect its wp-includes and wp-content folders. While WordPress doesn’t do stupid things in most of these files, they still don’t do a simple defined check to ensure we came from an a privileged file. SMF does this and it prevents direct loading of any of the Source files. To get around …
Month: May 2010
Simple secure login for wordpress
This is a simple way to setup a secure login for WordPress. Simply editing “wp-login.php” and looking for: /** Make sure that the WordPress bootstrap has run before continuing. */ require( dirname(__FILE__) . ‘/wp-load.php’ ); Add after that: force_ssl_admin(true); Now when accessing login and registration pages, the browser redirects to the secure version. Edit, After …