Skip to main content

WordPress Plugins and Security Hardening

This document outlines key security implementations and fixes applied to the WordPress ecosystem on this site, specifically to address plugin misbehaviors and permission issues.

Slider Revolution (RevSlider) "Phone Home" Block​

Slider Revolution and its addons attempt to make external HTTP requests to ThemePunch servers (to "phone home" for telemetry, template loading, or validation).

To securely isolate the plugin and prevent these outbound connections without breaking its local functionality, a robust firewall has been implemented:

1. MU-Plugin Firewall (block-revslider-outbound.php)​

A Must-Use plugin (wp-content/mu-plugins/block-revslider-outbound.php) is active on the site, hooking into the WordPress pre_http_request filter.

  • Domain Blocking: It explicitly blocks outbound requests to themepunch.com, themepunch.tools, revslider.com, sliderrevolution.com, and google-analytics.com.
  • Backtrace Analysis: Evaluates the debug_backtrace() of every HTTP request. If the script path contains /revslider/ or /revslider- (its addons), the request is aborted and a WP_Error is returned.
  • Loopback Whitelist: Ensures requests to localhost, 127.0.0.1, and the server's own $_SERVER['HTTP_HOST'] are permitted. RevSlider relies on local WP-Admin AJAX requests to function and render sliders, so loopback must remain untouched.

2. PHP Environment Restriction (.user.ini)​

While the MU-plugin intercepts WordPress HTTP API calls (wp_remote_get, etc.), some functionality within RevSlider uses native PHP functions like file_get_contents.

  • To prevent bypassing the WordPress HTTP API, the allow_url_fopen PHP flag has been disabled specifically for the web root using an override in .user.ini: 
    php_admin_flag allow_url_fopen off

There is no local functional degradation for sliders already built and configured on the site.

General Plugin Ownership & Permission Standard​

A recurrent issue with WordPress Core and plugin updates failing ("inconsistent file permissions") is tied to files erroneously adopting root ownership.

  • Proper Ownership: The entire /var/www/html/ directory (specifically wp-admin, wp-includes, wp-content/plugins/, and wp-content/upgrade/) must be owned by the web server user: www-data:www-data.
  • Fix: When permissions desync, execute the following over SSH: 
    chown -R www-data:www-data /var/www/html/wp-admin /var/www/html/wp-includes /var/www/html/wp-content/plugins /var/www/html/*.php

Boxcoin Plugin Integration Safety​

The boxcoin crypto payment gateway plugin previously caused a critical site-wide fatal error when other plugins (like RevSlider) were deactivated, which forces a WordPress plugin re-evaluation hook cycle.

  • Root Cause: boxcoin attempted to extend WC_Payment_Gateway without verifying that WooCommerce was fully loaded.
  • Fix: The plugin's initialization logic (wp-content/plugins/boxcoin/index.php) has been padded with a safety requirement: 
    if ( ! class_exists( 'WC_Payment_Gateway' ) ) {
        return;
    }