code-diesel » wordpress

WordPress plugins to check for security threats

sameer — Sat, 10 Dec 2011 05:47:53 +0000

With WordPress installations on the rise, security threats are a common concern for users. Below is a small collection of WordPress plugins that I found adequate for use on most WordPress installations to keep security in check. As always security is not 100% achievable, but the following plugins will help you find any loopholes in your site and help you monitor for any security breaches.

BulletProof Security
BulletProof Security protects your website from XSS, RFI, CSRF, Base64, Code Injection and SQL Injection hacking attempts. The plugin also Protects wp-config.php, bb-config.php, php.ini, php5.ini, install.php and readme.html with .htaccess security protection. BPS has built-in Backup and Restore, a File Editor, a File Uploader and a File Downloader to make managing the BPS master .htaccess files and your website security fast and simple.

WordPress File Monitor
WFM monitors your WordPress installation for any added, deleted or changed files. When a change is detected an email is sent to a specified address. Currently does not support multi-site installations.

Ultimate Security Checker
Ultimate Security Checker helps you identify security problems with your WordPress installation. It scans your WordPress blog for hundreds of known threats, then gives you a security “grade” based on how well you have protected yourself.

Benchmarking WordPress SQL using FirePHP

sameer — Fri, 12 Feb 2010 09:10:16 +0000

Building and running a WordPress site is a simple matter. WordPress is a considerably fast CMS system, until you start to add more and more plugins and one day you notice that Worpdress has started to slow down. It may be the case that SQL queries within some plugins are not optimized and are taking an increased amount of time executing them, this can considerably slow down your site. The first thing you can do to rectify the situation is to find out where exactly the bottleneck resides by analyzing the time each SQL query takes to executes. Some inquisitive people among you may also be interested in knowing in what sequence the WordPress SQL queries themselves are being run. Not that all bottlenecks occur due to unoptimized SQL, most are due to poor coding practices. Whatever the reason; the following post will show you how to look inside the SQL query execution of WordPress.

Logging WordPress SQL queries

By default WordPress doesn’t log any queries. But you can instruct WordPress to do so by adding the following configuration option to your WordPress ‘wpconfig.php’ file.

/* wp-config.php */
 
define('SAVEQUERIES', true);

Once that is done you can add the following lines at the end of your WordPress themes ‘footer.php’ file.

/* footer.php */
..
global $wpdb;
print_r($wpdb->queries);
.
.

This will display the SQL statements executed by your WordPress installation in a raw format as shown below. It displays a total of three items – the executed query, the execution time of the query and the function that called the query.

Array
(
    [0] => Array
        (
            [0] => SELECT option_name, option_value FROM wp_options WHERE autoload = 'yes'
            [1] => 0.004619836807251
            [2] => require, require_once, require_once, require_once, is_blog_installed, wp_load_alloptions
        )
 
    [1] => Array
        (
            [0] => SELECT option_value FROM wp_options WHERE option_name = 'sidebars_widgets' LIMIT 1
            [1] => 0.0015749931335449
            [2] => require, require_once, require_once, require_once, do_action, call_user_func_array, wp_widgets_init, register_widget, WP_Widget_Factory->register, WP_Widget_Recent_Comments->WP_Widget_Recent_Comments, is_active_widget, wp_get_sidebars_widgets, get_option
        )
.
.

As you can see the raw information is not interesting to look at and it also clutters the actual site. A better way is to use FireBug and FirePHP to log the SQL queries without interfering with the WordPress output.

Installing FirePHP

Before starting you need to have FirePHP and FireBug installed. FirePHP uses FireBugs console window to output the debug messages. Once you have installed FirePHP and FireBug, you need to install the FirePHP server libraries. Copy the FirePHP server libraries to your WordPress themes directory. For e.g ‘wordpress\wp-content\themes\default\FirePHPCore’.

If you are unfamiliar with FirePHP a nice tutorial can be found at Six Revisions.

Displaying formatted information with FirePHP

Once we are done with the above setup, you can add the following code at the end of your WordPress themes ‘footer.php’ file, replacing the code we previously added.


 
    /* footer.php */
 
    require_once("FirePHPCore/FirePHP.class.PHP");
 
    global $wpdb;
 
    $query_table[] = array("SQL", "Execution Time", "Calling Function");
    $expensive_query_time = 0;
    $expensive_query = "";
    $total_time = 0;
 
    foreach($wpdb->queries as $query)
    {
        $query_table[] = array($query[0], $query[1], $query[2]);
        /* Get the most expensive query */
        if($query[1] > $expensive_query_time)
        {
            $expensive_query_time = $query[1];
            $expensive_query = $query[0];
            $total_time += $query[1];
        }
    }
 
    $total_queries = count($wpdb->queries);
    $firephp = FirePHP::getInstance(true);
 
    /* Display the queries in a formatted table */
    $firephp->group('Query', array( 'Collapsed' => false,  
                                    'Color' => '#000'));
    $firephp->table($total_queries . " queries took " . 
                    $total_time . " seconds.", $query_table);
 
    /* Display the query summary */
    $firephp->group('Query Summary', array( 'Collapsed' => false,  
                                            'Color' => '#000'));
    $firephp->log($total_queries, 'Total Queries');
    $firephp->log($expensive_query, 'Expensive Query');
    $firephp->log($expensive_query_time, 'Expensive Query Time');
 
?>
body>
html>

Refresh your WordPress page and you should see the following output in the FireBug console. Click on the image below to view the complete debug screen. (Some queries have been removed for size.) As you can see FirePHP displays a nicely formatted output than the previous one.

Modifying the query data returned by WordPress

WordPress by default saves and returns the following three parameters for each SQL query:
1. SQL query
2. Query Execution time
3. The method chain that called the query.

The code section where this happens is located in the query() method of the ‘wp-db.php’ file in the WordPress ‘wp-includes’ directory. The following snippet shows that section of code:

/* wp-db.php */
.
.
// Log how the function was called
$this->func_call = "\$db->query(\"$query\")";
 
// Keep track of the last query for debug..
$this->last_query = $query;
 
// Perform the query via std mysql_query function..
if ( defined('SAVEQUERIES') && SAVEQUERIES )
    $this->timer_start();
 
$this->result = @mysql_query($query, $this->dbh);
++$this->num_queries;
 
if ( defined('SAVEQUERIES') && SAVEQUERIES )
    $this->queries[] = array( $query, $this->timer_stop(), 
                              $this->get_caller() );
 
.
.

You can modify the code to add some extra parameters as per your requirements, or modify the format in which it is returned. For example you could add code to save the data to a xml or csv file for latter retrieval and analysis.

Note: Turning on the define(‘SAVEQUERIES’, true) option can slow down your WordPress site, so make sure you disable it after your work is done.

Filter your wordpress content by location

sameer — Mon, 06 Jul 2009 06:33:48 +0000

Today I’ve released my first WordPress plugin, Country Filter. The Country Filter plugin allows you to control the visibility of WordPress elements depending on the users country of origin. You can hide or show certain elements of a page or some sections of a post from users browsing from a particular country. For example you could have a ‘donate’ button that displays only if the user is browsing from France, India or UK.

Plugin download and installation instructions can be found here.

Accessing WordPress plugins remotely

sameer — Mon, 22 Jun 2009 04:23:53 +0000

With a plethora of wordpress plugins available for every conceivable purpose, there is a huge amount of data that is stored on a typical wordpress installation. We could easily use that data across domains or display them using widgets on the desktop. Take for example the WP-UserOnline plugin that displays how many users are currently online on your blog. We could easily write a proxy to grab that information from the plugin and use it in a Yahoo Widget or in a AIR application on the desktop, so you can see the number of users online without having to visit your site. Or you could use the information on some other site.

Example proxy
A sample proxy code to access the WP-UserOnline plugin data is shown below. The code basically uses the WP-UserOnline plugins ‘get_users_browsing_site()‘ function to read the data and echo it as a JSON string. Now all you have to do is request the below file (useronline_proxy.php) from a remote server and you get a JSON string containing the useronline information.


 
/* 
  useronline_proxy.php
 
  On my server this file is located in the
  www.codediesel.com/remote/ directory, hence the
  location of the $wp_root variable. You will need
  to change it depending on where you save this file.
*/
$wp_root = '..';
 
if (file_exists($wp_root.'/wp-load.php')) {
	require_once($wp_root.'/wp-load.php');
} else {
	require_once($wp_root.'/wp-config.php');
}
 
/*  The following file contains all the functions 
    we require to get to the wp-useronline data. 
*/ 
require_once($wp_root.
             '/wp-content/plugins/wp-useronline/wp-useronline.php');
 
/* Get the number of users browsing the site right now */
$users = get_users_browsing_site(false);
 
$temp = array("member"  =>  $users[0],
              "guest"   =>  $users[1],
              "bot"     =>  $users[2],
              "total"   =>  array_sum($users));
 
 
/* Encodes the array as a JSON string and print it.
  (Only available since PHP 5.2)
*/
echo json_encode($temp);
 
?>

How the whole thing works is shown below:

Accessing the proxy remotely
Assuming allow-url-fopen is true, you can now access the useronline_proxy.php file from another server as below. Note that you will have to use cURL if remote url fopen is not allowed on your php installation.


 
$fp = fopen("http://www.domain.com/remote/useronline_proxy.php", "r");
 
$json_string = '';
 
while (!feof($fp ))
{
  $json_string .= fread($fp, 8192);
}
 
$json_data = json_decode($json_string);
 
fclose($fp);
 
?>

Using Javascript to access the proxy
You can also use javascript to access the remote proxy. But since cross domain access is restricted by the browser, we will need to resort to jQuery’s getJSON function to do the same. The javascript code is shown below.

DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN">
<html lang="en">
<head>
<title>title>
<script src="jquery-1.3.2.js">script>
head>
<body>
<script>
$(document).ready(function()
{
 
$proxy = "http://www.domain.com/remote/useronline_proxy.php?callback=?";
    $.getJSON($proxy, function(data)
    {
        $info = 'Members: ' + data.member + '\n' +
                'Guests: ' + data.guest + '\n' +
                'Bots: ' + data.bot + '\n' +
                'Total: ' + data.total;
 
        alert($info);
    });
});
script>
body>
html>

But to make the above javascript code work we will have to make a little change to the useronline_proxy.php file.

 
/* Replace the 'echo json_encode($temp);' line with the following */
 
echo $_GET['callback'] . '(' . json_encode($temp) . ');';

Security
To keep the proxy code simple, I’ve not added any authentication to the same. But you could pass a username/password as a GET parameter and check it in useronline_proxy.php.