Diverse Hacks und Vorlagen für ein besseres und sichereres WordPress

functions.php Vorlage für ein Child Theme (für Divi)

<?php
#region Clean Up WP Admin Bar
function remove_admin_bar_links() {
	global $wp_admin_bar;
	$wp_admin_bar->remove_menu('wp-logo');          // Remove the Wordpress logo + sub links
	// $wp_admin_bar->remove_menu('site-name');        // Remove the site name menu
	// $wp_admin_bar->remove_menu('view-site');        // Remove the view site link
	// $wp_admin_bar->remove_menu('updates');          // Remove the updates link
	// $wp_admin_bar->remove_menu('comments');         // Remove the comments link
	$wp_admin_bar->remove_menu('new-content');      // Remove the content link
	// $wp_admin_bar->remove_menu('my-account');       // Remove the user details tab
}
add_action( 'wp_before_admin_bar_render', 'remove_admin_bar_links' );
#endregion

#region Enqueue Scripts
add_action( 'wp_enqueue_scripts', 'theme_enqueue_styles' );
function theme_enqueue_styles() {
	wp_enqueue_style( 'parent-style', get_template_directory_uri() . '/style.css' );
}
#endregion

#region Replace URL for Logo on Login Screen
function nextab_url_login_logo(){
	return get_bloginfo( 'wpurl' );
}
add_filter('login_headerurl', 'nextab_url_login_logo');
#endregion

#region Change title tag for Login Link
function nextab_login_logo_url_title() {
	return 'Zurück zu XXX ';
}
add_filter( 'login_headertext', 'nextab_login_logo_url_title' );
#endregion

#region Add Widget with Developer Info in WP Dashboard
function nextab_add_dashboard_widgets() {
	wp_add_dashboard_widget('wp_dashboard_widget', 'Designer & Developer Info', 'nextab_theme_info');
}
add_action('wp_dashboard_setup', 'nextab_add_dashboard_widgets' );

function nextab_theme_info() {
	echo '<ul>
	<li><strong>Entwickelt von:</strong> <a href="http://www.nextab.de">nexTab.de</a></li>
	<li><strong>E-Mail:</strong> <a href="mailto:[email protected]">[email protected]</a></li>
	<li><strong>Mobil:</strong> <a href="tel:+491608436001">0160 / 843 6001</a></li>
	</ul>';
}
#endregion

#region Replace Logo on WP Login Screen
/*
add_action('login_head', 'nextab_custom_login_logo');
function nextab_custom_login_logo() {
	$upload_dir = wp_upload_dir();
	echo '<style type="text/css">
	h1 a { background-image:url("'. $upload_dir['baseurl'] . '/20xx/xx/logo.png") !important; background-size: 320px 60px !important; width: 320px !important; height: 60px !important; margin-bottom: 40px !important; padding-bottom: 0 !important; }
	.login form { margin-top: 10px !important; }
	</style>';
} */
#endregion

#region Load Child Theme Language Files
function nxt_translations() {
	// load custom translation file for the parent theme
	load_child_theme_textdomain( 'Divi', get_stylesheet_directory() . '/lang' );
	load_child_theme_textdomain( 'et_builder', get_stylesheet_directory() . '/lang/builder' );
}
add_action( 'after_setup_theme', 'nxt_translations');
#endregion

#region Prevent Thumbnail Generation
function hgl_disable_image_sizes($sizes) {
	// Remove thumbnail and medium sizes
	unset($sizes['thumbnail']);    // 150x150
	unset($sizes['medium']);       // 300x300
	
	// Keep other sizes
	return $sizes;
}
add_filter('intermediate_image_sizes_advanced', 'hgl_disable_image_sizes');
#endregion Prevent Thumbnail Generation

#region Allow SVG File Upload
function nxt_allow_svg($mimes) {
	$mimes['svg'] = 'image/svg+xml';
	return $mimes;
}
add_filter('upload_mimes', 'nxt_allow_svg');

function nxt_really_allow_svg($checked, $file, $filename, $mimes){
	if(!$checked['type']){
		$wp_filetype = wp_check_filetype( $filename, $mimes );
		$ext = $wp_filetype['ext'];
		$type = $wp_filetype['type'];
		$proper_filename = $filename;
		if($type && 0 === strpos($type, 'image/') && $ext !== 'svg'){
			$ext = $type = false;
		}	
		$checked = compact('ext','type','proper_filename');
	}
	return $checked;
}
add_filter('wp_check_filetype_and_ext', 'nxt_really_allow_svg', 10, 4);
#endregion

#region Disable Gutenberg Widget Editing
add_filter( 'gutenberg_use_widgets_block_editor', '__return_false', 100 );
// Disables the block editor from managing widgets.
add_filter( 'use_widgets_block_editor', '__return_false' );
#endregion

#region Sanitize names of uploaded files
function sanitize_upload_name($filename) {
	$sanitized_filename = remove_accents($filename); // Convert to ASCII

	// Standard replacements
	$invalid = array(
	' ' => '-',
	'%20' => '-',
	'_' => '-',
	);
	$sanitized_filename = str_replace(array_keys($invalid), array_values($invalid), $sanitized_filename);

	// Remove all non-alphanumeric except .
	$sanitized_filename = preg_replace('/[^A-Za-z0-9-\. ]/', '', $sanitized_filename);
	// Remove all but last .
	$sanitized_filename = preg_replace('/\.(?=.*\.)/', '-', $sanitized_filename);
	// Replace any more than one - in a row
	$sanitized_filename = preg_replace('/-+/', '-', $sanitized_filename);
	// Remove last - if at the end
	$sanitized_filename = str_replace('-.', '.', $sanitized_filename);
	// Lowercase
	$sanitized_filename = strtolower($sanitized_filename);
	return $sanitized_filename;
}	
add_filter("sanitize_file_name", "sanitize_upload_name", 10, 1);
#endregion Sanitize names of uploaded files

#region Enable Zoom for Divi Theme
function nxt_enable_zoom() {
	echo '<meta name="viewport" content="width=device-width, user-scalable=yes, initial-scale=1.0, minimum-scale=0.1, maximum-scale=10.0">';
}
add_action('wp_head', 'nxt_enable_zoom');
#endregion Enable Zoom for Divi Theme

add_filter('site_status_should_suggest_persistent_object_cache', '__return_false');

#region Harden WordPress Security
// Customize login error messages
function nxt_login_error_message() {
	return 'Die eingegebenen Anmeldedaten sind nicht korrekt.';
}
add_filter('login_errors', 'nxt_login_error_message');

// Remove detailed password reset messages
function nxt_remove_reset_messages($errors) {
	$errors->remove('invalid_email');
	$errors->remove('empty_username');
	$errors->add('invalid_combination', 'Wenn ein Konto mit den angegebenen Daten existiert, erhalten Sie eine E-Mail mit weiteren Anweisungen.');
	return $errors;
}
add_filter('lostpassword_errors', 'nxt_remove_reset_messages');

// Disable user enumeration
function nxt_disable_user_enumeration() {
	// Block author query var
	if (isset($_REQUEST['author']) && !is_admin()) {
		wp_redirect(home_url(), 301);
		exit;
	}
	// Block author URLs
	if (preg_match('/author=([0-9]*)/i', $_SERVER['QUERY_STRING'])) {
		wp_redirect(home_url(), 301);
		exit;
	}
	
	// Block author feeds
	if (preg_match('/wp-json\/wp\/v2\/users/i', $_SERVER['REQUEST_URI'])) {
		wp_redirect(home_url(), 301);
		exit;
	}
	
	// Block ALL author archives, regardless of whether they exist
	if (preg_match('/\/author\/.*/', $_SERVER['REQUEST_URI'])) {
		wp_redirect(home_url(), 301);
		exit;
	}
}
add_action('template_redirect', 'nxt_disable_user_enumeration');

// Generic registration error messages
function nxt_registration_privacy($errors) {
	// Clear any existing messages about email or username existence
	$errors->remove('email_exists');
	$errors->remove('username_exists');
	
	// Add a generic message that's shown for ALL registration attempts
	$errors->add('registration_notice', 'Wenn Sie sich registrieren möchten, erhalten Sie eine E-Mail mit weiteren Anweisungen. Wenn Sie bereits ein Konto haben, nutzen Sie bitte die Anmeldeseite.');
	
	return $errors;
}
add_filter('registration_errors', 'nxt_registration_privacy');

// Protect AJAX registration checks
function nxt_check_email_privacy() {
	wp_send_json_success(array(
		'msg' => 'Bitte fahren Sie mit der Registrierung fort.'
	));
	exit;
}
add_action('wp_ajax_check_email', 'nxt_check_email_privacy');
add_action('wp_ajax_nopriv_check_email', 'nxt_check_email_privacy');
#endregion Harden WordPress Security