There are a few drawbacks, however. The content management system’s (CMS) predictable file structure makes it easy to guess where a file is stored. For instance, a UK budget document leaked before its official release. How did this happen? A journalist was able to guess the file name based on last year’s version:

The BBC was able to access the PDF version of the OBR’s key report at 11:45 on Wednesday by replacing the word ‘March’ with ‘November’ in the web address of a previous edition.

Search engines can also index your site’s media files. This can be a benefit to your SEO strategy, but it’s not always desirable. Consider a membership website that requires registration to access specific files. A user may stumble upon a file via search, defeating the purpose of hiding files behind a login.

None of this means that there’s a security flaw. Rather, WordPress wasn’t built with private media storage in mind. Thankfully, there are easy ways to improve media file security.

Let’s review some tools and techniques for protecting your WordPress media files. They’ll keep your files away from prying eyes and might even save you some hosting bandwidth.

Available Methods of File Protection

The first thing to know about protecting your media files is that there are multiple types of protection. The method(s) you use will depend on your specific needs. We’ll break this section down by common scenarios.

Note that none of the following options will guarantee file security in high-stakes situations such as the UK government leak above. Rather, they are basic measures that will make it harder for someone (or something) to access your files.

With that in mind, here are a few ways to improve file security.

Block Direct File Access From Outside Sites (Hotlinking)

Let’s say you have a large PDF file on your website. By default, an external website could link directly to that file (a.k.a. hotlinking). It may seem harmless, but every time a user clicks that link, the file access counts against your hosting bandwidth. Even worse, the user never visits your website.

The solution is to block hotlink access at the server level. Add the following snippet to your website’s .htaccess file:

# Deny direct access to uploads unless navigated from your  site (change example.com to your domain name)
<IfModule mod_rewrite.c>
RewriteEngine On

# Only apply to files inside uploads directory
RewriteCond %{REQUEST_URI} ^/wp-content/uploads/ [NC]

# Allow requests from your own domain
RewriteCond %{HTTP_REFERER} !^https?://(www.)?example.com/  [NC]

# Block direct access to specified file types
RewriteRule .(mp3|mp4|pdf|zip)$ - [F,NC,L]

</IfModule>

If your website runs on an NGINX server, add this snippet to the nginx.conf file:

# Deny direct access to uploads unless navigated from your  site (change example.com to your domain name)
# File types protected: mp3, mp4, pdf, zip
  location ~* ^/wp-content/uploads/.*.(pdf|zip|mp4|mp3)$ {
  
	valid_referers  none blocked server_names *.example.com example.com;
    if  ($invalid_referer) {
  return 403;
  }
}

Be sure to change example.com to match your domain name and edit the included file extensions to match your needs.

Note: We don’t recommend protecting image files this way, as it may lead to undesirable results. For instance, you won’t be able to include images or file links from the server in your email newsletter without adding some exceptions to the code above.

Prevent Search Engines From Indexing Your Media Files

Uploaded WordPress media files can easily end up in search results. This can be undesirable for a few reasons:

• Direct links to large files can eat up bandwidth.
• Users aren’t visiting your website, just downloading files.
• Members-only files could be exposed to the public.

Part of any file protection strategy should include preventing (or discouraging) search engine indexing. As such, there are a few methods to implement.

First, we can add the following to our site’s robots.txt file to discourage crawling of the /wp-content/uploads/ folder:

User-agent: *
Disallow: /wp-content/uploads/

This won’t prevent indexing of your files, just crawling. The main benefit is reducing the load on your server.

To fully prevent indexing, we can use the X-Robots-Tag header.

For Apache servers, add this snippet to your site’s .htaccess file:

# Prevent indexing of media files in /wp-content/uploads/
<IfModule mod_headers.c>
<FilesMatch  ".(pdf|doc|docx|xls|xlsx|ppt|pptx|zip|rar|7z|mp3|m4a|wav|mp4|mov|avi|webm)$">
Header always set  X-Robots-Tag "noindex, nofollow, nosnippet, noarchive"
</FilesMatch>
</IfModule>

NGINX users can add this to their nginx.conf file:

# Prevent indexing of media files in /wp-content/uploads/
  location ~*  ^/wp-content/uploads/.*.(pdf|doc|docx|xls|xlsx|ppt|pptx|zip|rar|7z|mp3|m4a|wav|mp4|mov|avi|webm|jpg|jpeg|png|gif|webp|svg)$  {
  add_header  X-Robots-Tag "noindex, nofollow, nosnippet, noarchive" always;
  }

The above methods will reduce bot traffic and reduce the likelihood that your files will appear in search results.

Prevent Access to WordPress Attachment Pages

By default, WordPress creates a post for every media file you upload. It may come in handy for some niche use cases, but it is most often a forgotten feature. Without further action, these posts can be indexed by search engines.

Some SEO plugins, such as Yoast SEO, RankMath, and All in One SEO, offer settings to disable attachment pages. This is the simplest way to prevent search engines or users from accessing them.

Short of that, you can also use a code snippet in your theme’s functions.php file or a custom plugin. We’ll share a couple of them that cover common scenarios.

Return a 404 Error on Attachment Pages:

If you’d like to deny access to attachment pages, the following snippet will do just that. Visitors will see a 404 page, rather than the attachment.

<?php
  /**
  * Force attachment  pages to 404.
  */
  add_action( 'template_redirect', function () {
  if ( !  is_attachment() ) {
  return;
  }
  
  global  $wp_query;
  $wp_query->set_404();
  status_header(  404 );
  nocache_headers();
  
  // Load  your 404 template.
  include  get_query_template( '404' );
  exit;
  } );

Redirect Attachment Pages to Parent Post:

Here’s a slightly different approach that redirects users to the attachment’s parent post. This is handy for blogs and other online publications looking to ensure users see their content, rather than media files.

<?php
  /**
  * Redirect attachment  pages to their parent post when available.
  */
  add_action( 'template_redirect', function () {
  if ( !  is_attachment() ) {
  return;
  }

  $attachment_id  = get_queried_object_id();
  $parent_id     = wp_get_post_parent_id( $attachment_id );
  if (  $parent_id ) {
  wp_safe_redirect(  get_permalink( $parent_id ), 301 );
  exit;
  }

  // No  parent: redirect to file URL if it exists.
  $url =  wp_get_attachment_url( $attachment_id );
  if ( $url  ) {
  wp_safe_redirect(  $url, 301 );
  exit;
  }
  wp_safe_redirect(  home_url( '/' ), 302 );
  exit;
  } );

If you don’t need WordPress attachment pages, there’s no reason to keep them around. Thankfully, you have several options for giving them the heave-ho.

Use a Plugin for Media File Protection

You can also use a plugin to protect your WordPress media files. The right plugin can do some or all of the above functions to keep your files safer.

For example, Download Monitor offers multiple functions, including file protection. Among its features:

• Disable or enable specific folders for file downloads.
• Create randomly-generated URLs for files you want to protect.
• Attempting to access a file directly will result in a 404 error.
• Require users to log in before accessing a file.
• Keep track of how many times a file has been downloaded.

The free version of the plugin covers common use cases. A premium version goes the extra mile by integrating with popular form plugins and adding CAPTCHA protection.

Meanwhile, many membership plugins come with some form of file protection. Check out the plugin’s documentation to see what’s available.

Take Control of Your Files and Gain Peace of Mind

There are several reasons for locking down your WordPress media files, even if you aren’t posting sensitive information. For one, the rise of AI bot traffic means higher bandwidth usage. Restricting access to large files can prevent surprise charges on your hosting bill.

Plus, media files and attachment pages can be taken out of context. A simple redirect can help by pointing users toward your content. That could be the difference between a one-time visitor and a loyal reader. Say hello to lower bounce rates!

The above solutions are easy to implement into your existing website. What’s more, they bring a little peace of mind. You won’t have to worry about the wrong people accessing your files or causing a traffic nightmare on your server.

Consider your file protection needs and how they might impact your SEO strategy. From there, you can create a plan that works for you.

here. He recently started a writing service for WordPress products: WP Product Writeup. He also has an opinion on just about every subject. You can follow his rants on Bluesky @karks.com.

Read more articles by Eric Karkovack

The post How To Protect Media Files Uploaded to WordPress appeared first on The NOKIA Blog.

Spam bots are known to order products using fake or stolen payment credentials. You may also notice them using offline payment gateways, such as Cash on Delivery or Direct Bank Transfer (BACS).

These activities are, at the very least, annoying. Your inbox and dashboard will become cluttered with illegitimate orders. However, there’s also some danger involved. A spammer using a stolen credit card can result in fraudulent charges. That impacts both you and the victim.

That’s why it’s important to take action against spammers. We’ll show you how to protect your WooCommerce site without disrupting legitimate customers. It’s easier than you think!

Steps for a Spam-Free WooCommerce Shop

There are several anti-spam WordPress plugins on the market, and some are compatible with WooCommerce. Thus, it’s OK to choose the option that works best for you.

For our purposes, we’ll go with Simple CAPTCHA Alternative with Cloudflare Turnstile. Why? It’s easy to set up, and we’ve had good luck with Cloudflare’s Turnstile product.

Turnstile will “challenge” suspicious traffic by requiring them to check a box within a widget. Meanwhile, the widget won’t interrupt legitimate users. It’s an effective and hassle-free way to keep spammers at bay.

Note: There’s also a version of this plugin that uses Google’s reCAPTCHA if you’re so inclined.

Step 1: Create Cloudflare Keys

The first step is to create a free Cloudflare account and generate API keys for use on your website. The plugin’s author has a guide for obtaining your Cloudflare keys.

[embedded content]

Step 2: Install Simple CAPTCHA Alternative with Cloudflare Turnstile

Next, it’s time to install the plugin:

• Log in to your WordPress website and navigate to Plugins > Add Plugin.
• Search for “Simple CAPTCHA Alternative with Cloudflare Turnstile”.
• Install and activate the plugin.

Step 3: Configure the Plugin

Let’s configure Simple CAPTCHA Alternative with Cloudflare Turnstile by navigating to Settings > Cloudflare Turnstile.

Here’s what to do inside the plugin’s settings panel. There are several ways to customize the plugin’s behavior. However, we’ll focus on the bare minimum to protect your store:

• Enter your Cloudflare Turnstile API keys (you’ll need both the Site Key and Secret Key).
• Use the WooCommerce Forms section to enable Cloudflare Turnstile on the areas you want to protect. We recommend the WooCommerce Checkout option, as it stops spam orders in their tracks.

Once enabled, you should see the Turnstile widget displayed on your WooCommerce Checkout page.

Other Considerations

As we mentioned, Simple CAPTCHA Alternative with Cloudflare Turnstile has a robust settings panel. That means there are a few other items you might want to consider:

• What happens if there’s an outage? You can protect against a Cloudflare outage by enabling Failsafe Mode. The plugin will either allow all submissions or use reCAPTCHA instead (provided you have API keys). This avoids any disruptions to your site’s customers.
• Would you like to protect other areas of your website? You can enable the Turnstile widget virtually anywhere user input is required. The site’s login, registration, and comment forms are examples. There are also integrations with popular form plugins.
• Should logged-in users see the Cloudflare Turnstile widget? You can limit the widget’s display to “guest” checkouts only. However, we recommend enabling the widget on your site’s registration forms first.
• Do you want to disable the widget for specific payment gateways? This comes in handy if you only want to protect the aforementioned offline payment gateways.

We recommend experimenting with the plugin’s settings to determine what works best for your website. You can always add or remove protection methods as needed.

Rid Your E-Commerce Site of Spam Orders

There is no avenue spammers won’t explore. WooCommerce orders are just one in a long list of places they’ll attempt to wreak havoc. Thankfully, you don’t have to put up with it.

Install Simple CAPTCHA Alternative with Cloudflare Turnstile, and your website will be protected within minutes. You and your clients will gain peace of mind while stopping illegitimate orders from overwhelming your inbox.

Plugins like this one are becoming a necessity as malicious traffic continues to have a field day with WordPress. Be sure to protect yourself!

here. He recently started a writing service for WordPress products: WP Product Writeup. He also has an opinion on just about every subject. You can follow his rants on Bluesky @karks.com.

Read more articles by Eric Karkovack

The post How To Stop Spam Orders on Your WooCommerce Website appeared first on The NOKIA Blog.

Enhancing your site’s login security is crucial, and implementing two-factor authentication (2FA) should be a part of your plan. The technology requires a user to verify their identity via email, text message, or a third-party app. It’s the last line of defense against a hacker accessing a user’s account.

The good news is that you don’t have to be a security expert to implement 2FA on your website. Several WordPress plugins can add this layer of security in just a few clicks.

We’ve put together a list of the top 2FA plugins to help you get started. You’ll find options covering different authentication methods, along with the ability to protect administrator and lower-level accounts. You’re sure to find the perfect match for your site’s needs.

An official plugin from the WordPress team, Two-Factor adds 2FA settings to each user’s profile. It also supports several verification methods, including email, time-based one-time passwords (TOTP), FIDO Universal 2nd Factor (U2F), and backup codes. Note that 2FA can be enabled on a per-user basis or for all users via a code snippet.

Wordfence is known for its all-in-one security suite. However, they also offer a niche plugin that secures your site’s login. Wordfence Login Security supports TOTP-based apps such as Google Authenticator and Authy. What’s more, you can add reCAPTCHA protection to your login pages and guard against XML-RPC attacks. It’s a lightweight option that adds peace of mind.

WP 2FA makes it easy to protect user accounts. There are options for protecting all users, specific users, or users with a particular role. The plugin supports email and TOTP authentication methods. It also allows users to set up their 2FA preferences on the front end where appropriate. Developers can use the plugin’s API to add support for additional 2FA providers.

Add a layer of security to any user or user role on your WordPress website. Two Factor Authentication supports TOTP and HOTP methods. It’s also compatible with WooCommerce, Elementor Pro, Gravity Forms, and other popular plugins. The plugin can also remember trusted devices and will alert you if a user enters the correct password with an incorrect 2FA code.

Here’s a simple solution for adding 2FA to your website. Install Two Factor (2FA) Authentication via Email, and a toggle will be added to each user profile. Enable 2FA for individuals or use the provided code snippet to turn it on sitewide. Note that email is the only supported authentication method.

Solid Security includes a suite of tools to protect your website, including 2FA. The free version of the plugin offers email-based authentication, while the pro version supports TOTP and backup codes. You can also configure strong password requirements and ban users after repeated failed login attempts.

An Easy Way To Improve Your Website’s Security

Two-factor authentication is a must-have feature for every WordPress website. It’s also one of the easiest items to implement.

The plugins above streamline the process and provide multiple authentication options. So, whether you need to protect site administrators, e-commerce customers, or both, there’s a plugin for you.

We hope you found this plugin roundup useful. Check out our WordPress Security section for more helpful tips and tools.

–>

here. He recently started a writing service for WordPress products: WP Product Writeup. He also has an opinion on just about every subject. You can follow his rants on Bluesky @karks.com.

Read more articles by Eric Karkovack

The post 6 Best Plugins for Adding Two-Factor Authentication (TFA) to WordPress appeared first on The NOKIA Blog.

The problem impacts every corner of the web. Sure, it litters social networks and enterprise applications. But even the smallest websites are bombarded with phony comments, form submissions, user registrations, and e-commerce orders. This hurts the user experience and makes life miserable for site owners.

The popularity of WordPress makes it a juicy target for spammers. As with other malicious actors, spam bots sniff for the content management system (CMS) and start wreaking havoc. Without protective measures, your site could see hundreds or thousands of illegitimate entries.

Thankfully, WordPress plugin developers have created several options for blocking spam. As such, we’ve put together a list of the top spam-fighters on the market. Each takes a different approach and protects specific areas of your website.

Tired of dealing with spam? Odds are, we have just what you need!

WordPress.com Black Friday Deal

For Black Friday, if you sign up for a WordPress.com Business Plan, you will not only get a 10% discount, but also a free professionally designed website worth $499, which includes setup on the platform with a custom theme and five core pages.

Get the WordPress.com Hosting Deal

Cloudflare’s Turnstile is designed to detect and block unwanted bots. If the app is unsure, it will “challenge” the user to click a checkbox. Create a free API key, and this plugin will add Turnstile to multiple areas of your WordPress website.

It works with popular form plugins, the WordPress login screen, comment forms, and WooCommerce. You have full control over where and when Turnstile appears.

Spam bots can harvest any email address or phone number that is published on your website. Email Address Encoder deters this behavior by encoding them in decimal/hexadecimal formats. Wrap your email links or phone numbers in the plugin’s shortcode, and bots don’t stand a chance.

A premium version automatically protects all detected email addresses and phone numbers.

WordPress has a built-in comment system, but you don’t want to leave it unprotected. Antispam Bee is a free way to clean up your comments, with a suite of settings designed to detect and reject spammers. You can block comments from specific countries, languages, or based on the time of day.

There are also options to delete spam automatically and notify site administrators.

WP Armour protects the WordPress registration and comment systems via a honeypot. It’s a user-friendly solution, as there are no CAPTCHA challenges to get in the way.

The plugin also works with popular form plugins, including Contact Form 7, Gravity Forms, and Formidable Forms. The premium “Extended” version adds support for even more plugins, including WooCommerce.

SilentShield allows you to choose between multiple CAPTCHA formats (math, image, or invisible honeypot) to stop spammers in their tracks. It’s compatible with form plugins, WooCommerce, and the WordPress login/registration/comments systems.

It also respects user privacy and is GDPR compliant out of the box.

Here’s a plugin that uses multiple techniques to fight spam behind the scenes. Activate Maspik, and the plugin will employ a honeypot, IP verification (limited in the free version), and blacklist detection. You can also set custom limits and block specific words from being submitted.

An AI feature will attempt to recognize spam patterns, and you can connect to various APIs for advanced protection.

Akismet has been around for what seems like forever and is bundled with WordPress. It’s a truly set-and-forget tool for eliminating spam from your website. You’ll need an API key to use it (they’re free for personal use; other uses require a paid subscription).

From there, the plugin quietly detects suspicious content and keeps your comments and contact forms clean.

Ant-Spam Plugin Comparison Table

Lose the Spam, Gain Peace of Mind

Advances in technology haven’t eliminated spam from our planet. If anything, tools like AI are emboldening spammers. It’s easier than ever to build a small army of bots for spreading junk content.

That’s why every website needs some form of protection. The plugins above will keep these bad actors at bay while making your site easier to maintain. Even better, there are options to protect every relevant area of your site.

Imagine not having to clean out your blog comments or form entries – that’s how it should be! The right anti-spam plugin can make it a reality.

–>

here. He recently started a writing service for WordPress products: WP Product Writeup. He also has an opinion on just about every subject. You can follow his rants on Bluesky @karks.com.

Read more articles by Eric Karkovack

The post The 7 Best WordPress Plugins for Blocking Spam in 2025 appeared first on The NOKIA Blog.

WordPress aficionados have jumped on the bandwagon. We use AI to generate new custom plugins and refactor existing ones. It’s hard to beat the efficiency these tools have added to our workflow.

Once you have a plugin, it’s just a matter of adding this shiny new thing to your website. Activate it and see what happens…

Not so fast!

We don’t want to rain on your AI sparkle parade. However, your vibe plugin shouldn’t be considered a finished product. Rather, it’s a start.

The code may work, but that doesn’t mean it’s ready for a production environment. It’s worth taking the time to audit your plugin to ensure its safety and stability.

With that in mind, here are some tips for testing your AI-generated WordPress plugin.

Use a WordPress Testing Environment

There are always risks associated with installing a new plugin, regardless of how it was built. A buggy piece of code could cause errors or crash your website. Meanwhile, security flaws can be exploited by hackers. And you never know if a plugin will work as expected.

That’s all the more reason to use a testing or staging environment. It’s a separate space where you can test your plugin without fear of breaking anything. Your web host may offer this feature, but you can also build a local WordPress installation.

Either way, the environment should match your production site as closely as possible. For example, it should run the same operating system and PHP version. Any special security settings should also be applied. Finally, enable WordPress debugging to help you find any errors.

This configuration also allows you to troubleshoot issues in a lower stress setting. You won’t have to worry about the impact on visitors, not to mention the site’s data.

Test All the Things With Plugin Check

There’s an easy way to test your AI-generated plugin against WordPress best practices. Plugin Check is an official tool that analyzes plugin security, performance, and internationalization.

The WordPress Plugins team uses it to test plugins submitted to the official repository. It will scan your code and provide a laundry list of issues it finds. Each issue’s line and column numbers are displayed, along with a brief description.

Sometimes, the issues are minor technicalities, such as missing a text domain in a PHP function. However, it also identifies potentially serious security flaws. For example, Plugin Check will flag unsanitized code output. That would allow a hacker to input and execute malicious code.

We’ve found that some AI models sporadically escape output in a generated plugin. Their lack of consistency is concerning. Thus, we can’t assume that everything is secure from the get-go.

Install Plugin Check on your testing environment to ensure your plugin meets WordPress guidelines. We have a tutorial to get you started.

Try to Break Something

Your plugin may appear to work well enough. However, that doesn’t mean it will hold up against every potential scenario.

A plugin’s behavior can change based on different factors. For instance, it may work as expected when you’re logged in, but not when you’ve logged out. That’s only scraping the surface of what can happen.

A few minutes of testing will help you identify any issues before you install it on a production website. So, put the plugin through a few basic tests, including:

• Deactivate and reactivate the plugin in the WordPress admin;
• Change plugin settings (if applicable) and save them;
• Access your test environment when logged in and logged out;
• Verify the plugin’s front and back-end functions and output are correct;

Also, be sure to keep your web browser’s console tool open when testing. That will fill you in on any behind-the-scenes errors that are generated.

Make Your WordPress Plugin the Best It Can Be

AI is a powerful tool for building custom WordPress plugins. It increases our efficiency and capabilities. But AI doesn’t test the plugin’s functionality and security for us. That’s our job.

The good news is that testing is a relatively simple process. The steps above will help you identify issues and make improvements. In other words, treat an AI-generated plugin the same as one a human built.

The result is a better plugin, one that you’ll be confident to use on your website.

Read more articles by Eric Karkovack

The post How to Test Your AI-Generated WordPress Plugin appeared first on The NOKIA Blog.

WordPress security plugins are one part of that equation. Along with quality hosting and users practicing secure habits, a plugin can thwart common attacks. They act as the last line of defense against hackers.

Adding an extra layer of protection is important, as WordPress is a preferred target due to its popularity. Legions of bots are scanning sites, looking for flaws to exploit. A vulnerability in WordPress core, a theme, or a plugin puts you at risk. Custom code that isn’t sanitized is also a major concern.

Thankfully, there is a variety of security plugins available. They cover different niches and use cases. We’ll introduce you to the eight best free options that help lock down your website.

Wordfence aims to be a complete security solution for WordPress. The plugin scans for malicious files, detects suspicious user activity, and blocks brute-force login attempts.

It also improves login security with two-factor authentication (2FA) and reCAPTCHA integration. The premium version offers a security audit log, a real-time IP blocklist, and a more robust firewall.

Jetpack has long been a do-it-all plugin suite. Jetpack Protect is a separate plugin for those who only want its security features. It scans your site daily for WordPress, plugin, and theme vulnerabilities.

You’ll also receive brute-force attack protection from botnets and other malicious actors. Upgrade to premium and receive email alerts, one-click malware fixes, and priority support.

The plugin formerly known as “iThemes Security” has plenty to offer in its free version. It protects against brute-force attacks at the local and network levels. Multiple types of 2FA can be added to user accounts, while strong password requirements keep users safer.

The plugin will detect file changes and scan your site for known vulnerabilities. The pro version adds trusted device recognition (to prevent session hijacking), passwordless login, and automated vulnerability patching.

Really Simple Security helps to fill common gaps in WordPress security. First, it ensures your site takes advantage of SSL via 301 redirects from non-HTTPS URLs. It also prevents code execution in your site’s uploads folder, disables the often-hacked XML-RPC feature, and enables 2FA.

You’ll also be notified of any known vulnerabilities. The pro version adds content security policy (CSP) generation, a firewall, and more security customizations.

A single-purpose plugin, Two-Factor adds 2FA to your WordPress website. It supports various methods, including email, Time Based One-Time Passwords (TOTP), and FIDO Universal 2nd Factor (U2F).

TOTP support means you can use it with apps like Google Authenticator. Note that you’ll need to assign 2FA to users individually. This makes it more suited for sites with a small number of users.

Brute force attacks are a problem for virtually every WordPress website. Even small sites can be swarmed by bots attempting to compromise your site. You can use this plugin to mitigate malicious login attempts.

It blocks offending IP addresses and covers all WordPress logins, including WooCommerce and XML-RPC. It’s also compatible with other security plugins. The pro version adds cloud-based IP blocking to the mix.

A safe website starts with securing user accounts. MelaPress Login Security helps by letting you create a custom login security policy. Options include setting a minimum password length, disabling recycled passwords, and forcing a password reset on first login.

You’ll also find brute-force login protection and the ability to limit logins to specific IP addresses. Upgrade to the pro version and gain trusted device recognition, disabling inactive users, and custom user session timeouts.

An Easy Way to Improve WordPress Security

Website security is complicated. It requires several measures to protect against attackers, many controlled by your web host. So, it’s up to us to take extra steps when possible. A WordPress security plugin is an easy way to do so.

The plugins on this list all have different strengths. Some are all-purpose, while others focus on a single aspect of security. Choose the ones that are right for your situation. But beware of combining multiple security plugins – they don’t always play nicely together.

Also, note that a plugin is only part of an overall security strategy. They can help, but won’t make up for an insecure hosting environment.

Now that you know some of the best free security plugins available, take a moment and determine how they fit into your strategy. Stay safe out there!

Top

The post 8 Best Free Security WordPress Plugins appeared first on The NOKIA Blog.

The output of your code must be secure. Otherwise, a malicious actor could take advantage. For example, they could execute a rogue JavaScript or PHP snippet to spread malware. It puts users at risk and is a mess to clean up.

Thankfully, WordPress provides a way to prevent these sorts of attacks. Escaping data output strips unwanted and unsafe code. In other words, the feature ensures that only safe content will be output. It’s extra peace of mind when building custom themes and plugins.

If you have coding knowledge, escaping PHP data output is relatively simple. However, it’s also an easy step to miss. That’s why improper code sanitization is one of the leading security issues in the WordPress ecosystem.

Let’s change that narrative, one snippet at a time. Here’s a quick guide to escaping PHP data in WordPress. It could save you from a security nightmare or two.

• Name
• Email Address
• Postal Address
• Message

Each field has a specific purpose. We assume a user will add their first and last name to the “Name” field, and so on.

But what if they don’t? We can’t guarantee that everyone will behave as expected. Assuming they will is a mistake.

A malicious user or bot could try to add JavaScript to one or more of our fields. That code might be executed on our website. Any number of bad things could happen from there. The code could redirect you to a dangerous site or grab personal information such as passwords or payment details.

Escaping the data collected by our form can prevent such shenanigans. The feature limits what input the fields will accept. It also prevents any disallowed input from being rendered.

Like a coffee filter, data escaping cleans up our output while letting the good stuff flow through.

WordPress Data Escaping Functions

WordPress provides several functions for escaping data. Each is designed to handle different types of content.

For instance, the esc_html() function will remove any HTML from the input. One example would be a user who includes HTML in a page title. This function ensures the code isn’t rendered in the output.

Let’s say an adventurous user places the following in a page title field:

<strong>About Us</strong>

We haven’t escaped the PHP code in our theme:

<h1><?php echo ( $title ); ?></h1>

WordPress won’t remove the extra HTML in this scenario. That could be dangerous!

<h1><strong>About Us</strong></h1>

Now, let’s use esc_html() to strengthen our security:

<h1><?php echo esc_html( $title ); ?></h1>

The function will strip the HTML tags added by the user, leaving only the text:

<h1>About Us</h1>

Perhaps the code in our example is harmless. However, it opens the door to someone with more sinister intentions. Escaping data is a simple step that protects your website and everyone who visits it.

Common Escaping Functions

Let’s take a quick look at a few other escaping functions:

esc_js() – This function is used to sanitize inline JavaScript code. It escapes special characters and prevents XSS attacks.

<a target="_blank" href="#" onclick="alert('<?php echo esc_js( $message ); ?>')">Click me</a>

esc_url() – Sanitizes URLs before output by escaping unsafe characters and validates HTTP/HTTPS protocols. You can also use esc_url_raw() to store URLs in the site’s database.

<a target="_blank" href="<?php echo esc_url( $url ); ?>">Visit our site</a>

wp_kses() – Escapes all non-trusted code while preserving HTML. Alternately, wp_kses_post() preserves code permitted in a post or page.

<?php echo wp_kses($custom_field_content); ?>

The above functions are among the most commonly used by developers. Check out the WordPress documentation for a complete list with code examples.

Where Should You Use Escaping Functions?

Escaping functions should be used anywhere you’re handling user input via code. That might be a theme template or a custom plugin. If you’re using custom fields, their output should also be escaped.

Custom code is the primary focus here. If you’re unsure where to start, the Theme Check and Plugin Check plugins will help you find unescaped output in your code. From there, you can add an escaping function and test the changes.

Note that most native WordPress functions like the_content() or the_title() are escaped by default – you don’t need to do anything further.

What if you find some unescaped output in a third-party theme or plugin? Notify the developer! It could be an oversight on their part. Fixing it will help improve the product’s security.

Escape to a Safer Place

It’s easy to forget to escape output when writing code. Developers who aren’t well-versed in security may not even know about it. Code editor apps won’t alert you to the issue. And WordPress will execute your code regardless.

So, keep this security feature in mind. Add it to a checklist or set a reminder in your project notes. It only takes a few extra seconds to implement. And it might be the difference in whether your site is as secure as possible.

Top

The post A Quick Guide to Escaping PHP Data in WordPress appeared first on The NOKIA Blog.