badegg

<p><strong>Hard Boiled Security</strong> stands in contrast to the many heavily marketed security plugins available for WordPress. Rather than providing a barrage of configuration options and intrusive prompts and upsells, we silently close the most common security vulnerabilities.</p>
<p>This plugin was inspired by many painful situations we helped people out of over the years and developed to help people who do not code secure websites their with minimal effort.</p>
<h3>Plugin Features</h3>
<ul>
<li>Zero configuration, hardens security just by activating</li>
<li>Disables all file editing within WordPress Admin.</li>
<li>Pingbacks and Trackbacks are disabled on all existing and future posts.</li>
<li>Prevents username exposure by ensuring their nice name, which is used in their profile URL and Rest API endpoint, is not their username. Those with the <code>list_users</code> capability can change this if needed.</li>
<li>Tested and working with <a href="https://roots.io/bedrock" rel="nofollow ugc">Roots.io’s Bedrock</a> directory structure as a mu-plugin.</li>
</ul>
<h3>Planned features</h3>
<p>There is more we can do to harden your WordPress website’s security. The features we will implement in the future will also be opinionated and require little to no configuration.<br />
– Block brute force attacks by limiting failed login attempts within a reasonable timeframe<br />
– Prevent email server spam and abuse by limiting password reset requests<br />
– Logging when brute force and spam prevention measures are triggered with optional opt-in email notifications</p>
<h3>Keep it secret, keep it safe</h3>
<p>This plugin is not a magic fix-all security solution. We don’t believe any plugin can do that.</p>
<p>Website security, regardless of platform, requires careful consideration around common security principles around access and permissions. Things like always using strong passwords, never reusing them across multiple websites, and limiting administrator accounts to those who actually need it. So many WordPress websites are compromised because administrator access is given out where the editor role is perfectly sufficient. Even if you are the website owner, using an editor account for your daily activities is a good idea.</p>
<h3>What to do to stay secure beyond using this plugin</h3>
<ul>
<li>Strong, unique, randomised passwords.</li>
<li>Fewer administrator accounts given only to those that need access to how the website works.</li>
<li>Use editor accounts or lower for regular content updates where possible.</li>
<li>Ensure the plugins and themes you use have been updated within the last few months.</li>
<li>Abandoned themes or plugins will not be updated if security vulnerabilities are found so replace them.</li>
</ul>
<h3>Why this plugin may not be for you</h3>
<p>This is an opinionated plugin built around our assumptions. These assumptions are based on our experiences over 15 years of building WordPress websites and may go against your workflow or philosophy.</p>
<p>One of the main reasons we wrote this plugin is to create an easy way for people to disable the built-in file editor in the WordPress admin. A compromised administrator account can easily add malicious code to any theme or plugin and it can be very difficult to detect and locate it. This is the main reason we disable this feature outright. Secondly, if you’re writing code, we consider it to be bad practice to edit files directly in a production environment (ie, a live website).</p>


Hard Boiled Security

A simple plugin that hardens some common Wordpress vulnerabilities

10up

Jeffrey Paul

Daryll Doyle

<p>Safe SVG is the best way to Allow SVG Uploads in WordPress!</p>
<p>It gives you the ability to allow SVG uploads whilst making sure that they’re sanitized to stop SVG/XML vulnerabilities affecting your site.  It also gives you the ability to preview your uploaded SVGs in the media library in all views.</p>
<h4>Current Features</h4>
<ul>
<li><strong>Sanitised SVGs</strong> – Don’t open up security holes in your WordPress site by allowing uploads of unsanitised files.</li>
<li><strong>SVGO Optimisation</strong> – Runs your SVGs through the SVGO tool on upload to save you space. This feature is disabled by default but can be enabled by adding the following code: <code>add_filter( 'safe_svg_optimizer_enabled', '__return_true' );</code></li>
<li><strong>View SVGs in the Media Library</strong> – Gone are the days of guessing which SVG is the correct one, we’ll enable SVG previews in the WordPress media library.</li>
<li><strong>Choose Who Can Upload</strong> – Restrict SVG uploads to certain users on your WordPress site or allow anyone to upload.</li>
</ul>
<p>Initially a proof of concept for <a href="https://core.trac.wordpress.org/ticket/24251" rel="nofollow ugc">#24251</a>.</p>
<p>SVG Sanitization is done through the following library: <a href="https://github.com/darylldoyle/svg-sanitizer" rel="nofollow ugc">https://github.com/darylldoyle/svg-sanitizer</a>.</p>
<p>SVG Optimization is done through the following library: <a href="https://github.com/svg/svgo" rel="nofollow ugc">https://github.com/svg/svgo</a>.</p>


Safe SVG

Our agency has a talented illustrator who is adept at creating SVGs, particularly with self-contained CSS animations. We would be loading them all manually from the theme folder with no path to easily add new or replace existing SVGs without developer involvement if it weren't for this plugin. We install Safe SVG on pretty much all sites we custom build for our clients.

I'm really hoping for some additional features to come to this plugin to better support the Gutenberg editor, since the core image block doesn't handle SVGs well. But that doesn't affect my 5-star review as the most reliable SVG upload plugin.

Agency go-to for SVG uploads

Why Automattic hates SVG has always been a source of confusion to me. Why shouldn't uploading SVG be as easy and straightforward as any other kind of (supported) image? Then again, it's true that you can write malicious code inside a SVG rather easily. The solution? Safe SVG. It cleans up a malformed or malicious SVG during the upload, so that when it arrives in your Media Library, it will already have been sanitised.

The plugin is as simple to operate as it is useful. All parts of WP that require opening the Media Library browser will now accept SVGs as well. As others have remarked, there are some outstanding issues when previewing SVGs inside Gutenberg. No surprises there — this plugin has predated Gutenberg, and (at the time of writing) has been abandoned for about two years, during which Automattic has been eagerly upgrading WordPress.

The author has not gone away, though. He is still actively developing the sanitising part of the plugin, using a library he has developed and posted on GitHub, and which has accepted several contributions and gone through many code reviews. It's possibly the reference library for SVG sanitation written in PHP.

And fortunately he's now back and has released a brand new version as of late February 2022 :)

Incredibly useful!

Great plugin, does what it says. Should be core functionality.

Why is this not a part of core?


Great plugin! very usefull, but please can you add the possibility to add an inline SVG on the block pasting svg code?



Thanks!


Wonderful + fetaure request

Enable SVG uploads and sanitize them to stop XML/SVG vulnerabilities in your WordPress website.

Hard Boiled Security vs Safe SVG