Today, I am going to share with you a tip that how we can make our WordPress plugins are themes more secure. I have seen in my plugins and themes where WordPress developers are not using WordPress nonces even though it is VERY important. If you are working as a WordPress freelancer developer and g custom plugins or themes, I am sure this article is going to be very helpful for you.
Continue reading
WordPress Database Security is the most important thing. Every single piece of information stored in it, which makes hackers and bots to target for stealing information by applying SQL Injection.
WordPress Database uses a default table prefix value “wp_” for all of its database tables. Typically, every website that is running WordPress will have its database tables with this prefix and this can surely be used by the hackers or malicious bots to guess your database table names. That’s why the smartest thing to do while creating a WordPress website is to change the prefix of the database, which can be done easily.
Now a days, WordPress is not just a blogging platform. From past few years, WordPress has become a robust content management system. By default, WordPress has two main post types:
but you can create your own custom content types you want, these custom content types are referred as custom post types. So when the WordPress is giving you the option to go beyond blogging platform and line up your content management system so there is no reason not to create custom post type WordPress. So today we will show you how you can easily create your own custom post types.
To interact with APIs is a very common thing in Web Development, WordPress gives us the utility functions to interact with APIs. As you know to interact with an API requires good knowledge of cURL and many other things, WordPress takes this responsibility and wrap the inner stories into utility functions for you.
“wp_remote_get“ is the function that gets the data for you from an API. All you have to do is just put the endpoint as an argument and voila! It’s magic.
Continue reading
One of the most important features which you should have to ensure that your WordPress website is secure and safe for those users who want to exchange their important information on your website while shopping or doing other stuff. Setting up your WordPress website to force use the most secure transaction system is not that difficult to implement, but it needs a lot of decision making when to enforce a secure transaction process for the user.
You would have seen on some websites, their URLs starting with “HTTPS” like Facebook, Google, and many others. An “HTTPS” enabled websites to add a security layer to the data communication between your computer and the server. The data communication is encrypted with an SSL (Secure Sockets Layer) certificate.
The next question in your mind will surely be “Why do you need it?”.
Any sensitive information like your credit card details, your passwords, or anything which could be called sensitive, needs to be safe whenever it is sent towards the server so that nobody between you and the server you are interacting with can get it. That’s why most of the shopping sites don’t use “HTTP”. The next important question is how you can enable SSL on your WordPress site. It is very easy.
First, you have to purchase an SSL certificate for your site and install it on your domain. Then go to the WordPress admin and open the settings page. There you will see these two text fields.
Just change your URLs by putting adding “s” after “HTTP” and save it. The next step is to open your “.htaccess” file which is residing in the root of your WordPress and put this code into that file.
RewriteCond %{HTTPS} !=on
RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L]
Let me explain the above code.
First-line will check whether the URL which has been entered by the user is having “HTTPS” or not and will be true if it is not having “HTTPS”.
In this part “https://%{SERVER_NAME}/$”
{SERVER_NAME} = “domain name”
^/?(.*) = “the slash is representing that slash, which is coming after the domain name and? (.*) means nothing or everything”
$ = “this variable will be having everything user entered after the domain name”
In “[R, L]”, “R” means redirect, and “L” means this was the last rule so stop further processing.
Save your “.htaccess” file and you are all done. Stay safe.