droimbai

Thanks for this interesting discussion. I read that putting a PHP close tag incorrectly could pose security problems. Frankly, I’d never know about this until I stumbled upon this discussion and read a little more about it (I’m not a programmer, BTW).

Then, my question is, should we leave out the closing tab for all PHP files in WordPress themes and plugins, or do we do it selectively? If the latter, what are the criteria we should use?

Thank you!

Yup there is. But, I’m trying to bypass it (WordPress) if possible to reduce load on my server.

I’ve thrown together the following hack from various sources on the web. It seems to work, but I’d like to run across the experts here to see if there will be any potential problems:

RewriteEngine on
RewriteCond $1 ^(index\.php)?$ [OR]
RewriteCond $1 \.(jpg|png|gif|css|js|ico|mp3)$ [NC,OR]
RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} !-f [OR]
RewriteCond %{REQUEST_FILENAME} -d [OR]
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ - [S=1]
RewriteRule . /index.php [L]

What do you think? The whole aim here is to minimize running WordPress for standard errors.

Thanks for your time.

Edit: Alas, nope this doesn’t work. Break WordPress. ??

Thank you for your advice, Ipstenu.

Yes, I understand that security by obscurity is not enough. But I feel that it’s one of the things that add up to a site’s overall security.

A strong password is definitely important and I do use a strong one. I just want to make the life of a hacker harder by making the username more obscure. And I don’t feel safe exposing my username inadvertently.

As suggested, I’ve redirected my site’s author link elsewhere.

But I realized that domain.com/author/author-name is not the place that leaked my username because the page simply displays a list of blog posts attributed to me. So the hacker must have found it some other way.

Thank you michael.mariart.

I already have an About page. Is there a way to suppress the author profiles from showing up? Cheers.

I believe I’ve found the answer to my own question.

It turned out that when I created the new user in WordPress, I didn’t specify the nickname. So WordPress used the username as the nickname. But as to where this nickname is used in my blog so that hackers can locate them, I’ve no idea yet. I don’t use nickname in my theme as far as I know. Would appreciate any advice.

Thanks for your attention.