{"issue":{"created_at":"2011-11-30T12:00:36Z","state":"open","updated_at":"2011-11-30T12:00:36Z","comments":0,"user":{"gravatar_id":"dbe5f5b1a7c33da542ad8e9dbbbe6bdc","id":1230234,"url":"https://api.github.com/users/a1dert","avatar_url":"https://secure.gravatar.com/avatar/dbe5f5b1a7c33da542ad8e9dbbbe6bdc?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png","login":"a1dert"},"body":"Imported from lighthouse. Original ticket at: http://redtape.lighthouseapp.com/projects/59696/tickets/241. Created by Matthew Stibbe - 2011-04-27T11:26:52Z\n\nI can see that you have added some tickets for WordPress security. Thanks for this. I found these recommendations on WordPress.org. They are too technical for me but I would like you to review them and tell me which ones need to be implemented and how long it would take. I will then confirm that you can go ahead and do them.\r\n\r\nhttp://codex.wordpress.org/Hardening_WordPress\r\n\r\n---\r\n\r\nThis directories should be with an empty index.php file.\r\nHackers should not know about our files. See on http://turbinehq.com/wp-includes/css/\r\n\r\n> wp-includes/\r\n\r\n> wp-includes/css/\r\n\r\n> wp-includes/images/\r\n\r\n> wp-includes/js/\r\n\r\n> wp-includes/js/crop/\r\n\r\n> wp-includes/js/imgareaselect/\r\n\r\n> wp-includes/js/jcrop/\r\n\r\n> wp-includes/js/jquery/\r\n\r\n> wp-includes/js/scriptaculous/\r\n\r\n> wp-includes/js/thickbox/\r\n\r\n> wp-includes/js/tinymce/\r\n\r\n> wp-includes/js/tinymce/langs/\r\n\r\n> wp-includes/js/tinymce/plugins/\r\n\r\n> wp-includes/js/tinymce/themes/\r\n\r\n> wp-includes/js/tinymce/themes/advanced/\r\n\r\n> wp-includes/js/tinymce/themes/advanced/img/\r\n\r\n> wp-includes/js/tinymce/themes/advanced/js/\r\n\r\n> wp-includes/js/tinymce/themes/advanced/skins/\r\n\r\n> wp-includes/js/tinymce/themes/advanced/skins/default/\r\n\r\n> wp-includes/js/tinymce/themes/advanced/skins/default/img/\r\n\r\n> wp-includes/js/tinymce/themes/advanced/skins/o2k7/\r\n\r\n> wp-includes/js/tinymce/themes/advanced/skins/o2k7/img/\r\n\r\n> wp-includes/js/tinymce/themes/advanced/skins/wp_theme/\r\n\r\n> wp-includes/js/tinymce/themes/advanced/skins/wp_theme/img/\r\n\r\n> wp-includes/js/tinymce/utils/\r\n\r\n> wp-includes/Text/\r\n\r\n> wp-includes/Text/Diff/\r\n\r\n> wp-includes/Text/Diff/Engine/\r\n\r\n> wp-includes/Text/Diff/Renderer/\r\n\r\n> wp-includes/pomo/\r\n\r\n> wp-includes/theme-compat/\r\n\r\n> wp-content/themes/redtapetheme/images/\r\n\r\n> wp-content/themes/redtapetheme/js/\r\n\r\n> wp-content/themes/redtapetheme/cache/\r\n\r\n> wp-content/themes/redtapetheme/media/\r\n\r\n> wp-content/themes/redtapetheme/fancybox/\r\n\r\n> wp-content/themes/redtapetheme/styles/\r\n\r\n> wp-content/upgrade/\r\n\r\n> wp-content/uploads/\r\n\r\n> wp-content/cache/\r\n\r\n> wp-content/cache/simple-thumbs/\r\n\r\n> wp-content/mingle-forum-skins/\r\n\r\n> wp-content/files_mf/\r\n\r\n> wp-admin/css/\r\n\r\n> wp-admin/js/\r\n\r\n> wp-admin/images/\r\n\r\n> wp-admin/includes/\r\n\r\n> wp-admin/maint/\r\n\r\n\r\n---\r\n\r\nRemove file readme.html from WP root directory. This file contains WP version. Nothing special, but there is potential security hole.\r\n\r\nAlso remove WP version from code:\r\nAdd to functions.php next line:\r\n> remove_action ('wp_head', 'wp_generator');\r\n\r\n---\r\n\r\nauth. keys are default.\r\nGenerate new authentication keys and salts, using URL - https://api.wordpress.org/secret-key/1.1/salt/ and update wp-config.php.","assignee":null,"id":2400569,"number":248,"pull_request":{"patch_url":null,"html_url":null,"diff_url":null},"labels":[{"name":"resolved","color":"ededed","url":"https://api.github.com/repos/a1dert/lh-tickets-test/labels/resolved"},{"name":"wordpress security","color":"ededed","url":"https://api.github.com/repos/a1dert/lh-tickets-test/labels/wordpress+security"}],"title":"WordPress security recommendations","html_url":"https://github.com/a1dert/lh-tickets-test/issues/248","closed_at":null,"url":"https://api.github.com/repos/a1dert/lh-tickets-test/issues/248","milestone":null},"action":"opened"}