The Hole In Your WordPress Site

Posted on June 17th, 2014 by Jean

If you have a self-hosted wordpress website, chances are that you have a hole in your site. A hole that allows others unrestricted access to your jpg, pdf and movie files.

To find out, type in your wordpress site followed by /wp-content/uploads

Do you see what I see?

wordpress files exposed

Those are your uploads divided by year. Inside of each year, your uploads are divided by month. And I, or anyone, have access.

I stumbled upon this by accident, accessing the motherload of a file of which I cannot divulge. When I looked at my browser bar, I saw the website’s address followed by /wp-content/uploads

When the realization hit me that MY wordpress files were ALSO vulnerable, I dove into action, finding a way to block access yet still allowing my site to function. What we are striving to do here is have a 403 page pop up telling the web server that access is forbidden.

I found the solution to be very simple. We need to type options -indexes to the bottom of our .htaccess file. Your .htaccess file is in the root directory of your website. You will need to access your ftp files through your website host.

Step 1: Log into your cpanel at your hosting site. It can be https: followed by your site name and then /cpanel

cpanel log in

STEPS 1, 2 AND 3

Step 2: Choose “File Manager”

Step 3: Choose “Home Directory” and check “Show Hidden Files”

Step 4: From your Home Directory, type .htaccess in your search toolbar

edit your htacess file

STEPS 4, 5 AND 6

Step 5: When .htaccess file appears in search results, double click to choose it.

Step 6: Select .htaccess from the list that appears. (For some reason I can never see the .htaccess file prior to searching for it.)

Edit your htaccess file in cpanel

FINAL STEPS – 7, 8 AND 9

 

STEP 7: With your .htaccess file selected, choose “Code Editor” from your toolbar menu.

STEP 8: Leave the default settings on the pane which opens, and select “Edit”.

STEP 9: Add Options -Indexes to the last line, and SAVE FILE.

You are done. Go ahead, try to access your site/wp-content/uploads. Do you see a big red 403 message? I do!

403 Forbidden

If you have ANY trouble with this, let me know. I’d be more than happy to help.

Wedding Highlights

Posted on May 17th, 2014 by Jean

Last weekend we attended our friends’ wedding, and had a wonderful time. Our gift to the newlyweds was a 22″ x 28″ framed poster we created with photos taken for the cover of our magazine. We think the collage turned out great, and we hope they love it. Aren’t they a gorgeous couple?

Wedding Poster

I “Rented the Runway” again with a vibrant Rachel Roy dress to compliment my daughters’ outfits. Tom wore an equally vibrant blue dress shirt with pale khakis.

wedding guest collage

The wedding was held at a local Golf Club, a scenic venue (albeit a “tad” windy).  The bride was escorted down the rose petal-strewn, grassy aisle by her father. The ceremony was brief (“I do.” “Me too.”), and soon we were following the wedding party to the clubhouse.

bride and groom

Mr. and Mrs. wasted no time getting to the dance floor for their first dance.  We all cut the rug before the night was over, and I have to say our 11 year old daughter was a star working her Wii Fit 2 (her admission) dance moves.

I lightened the video since it was so dark in there. Here she dances with our friend, Mike. They are both superstars!

A buffet was presented with fruit, cheese, salad, chicken, potatoes, asparagus and bread rolls. When we returned to our table, the girls had plates of mac & cheese and fried chicken tenders waiting for them. So thoughtful! Everything was delicious.

The wedding couple cut their cake, and fed it tenderly to each other. No cake/face smashing. The white cake had a cherry filling and chewy fondant frosting.

Wedding Cake

The bride tossed her bouquet to a sparse crowd of 5 single ladies, while the groom flung his wife’s garter to a sea of single men and two small children. Not sure how to interpret that. The garter was caught by a classmate of our 11 year old which made the whole room erupt in laughter.

Champagne and sparkling cider were served in flutes, and we all enjoyed the tradition of toasts.

The girls were looking forward to attending this wedding as much as they had looked forward to Knott’s Berry Farm. All the pomp & circumstance were a secret they had yet to experience. I think it was everything they hoped it would be and then some!

Making Memories

What’s your favorite part of a wedding?

Family Fun at Knott’s Berry Farm

Posted on May 3rd, 2014 by Jean

knotts Snoopy and Charlie Brown
We made it to Knott’s and had a wonderful day! The park was practically empty on Monday, which was both good and bad. Good – we could get on any ride. Bad – we couldn’t tell where the lines started!

The Jaguar

Our first ride was The Jaguar, a relatively tame roller coaster. The entrance to this coaster was somewhere inside of this dark Mayan temple. We gave up the first time, taking one of the many exit doors. The kids were frightened just walking through there. After talking with a park employee, we were told to venture to the center of the pyramid to find the coaster. We did and we did! We got on the coaster, and had a wonderful time! So much so that we went on it again.

Mexican Hat Dance

The Mexican Hat Dance was similar to Disney’s Tea Cups, lots of spinning. So much spinning that I refused to ride a 2nd time.

Supreme Scream

Tom needed a little excitement, and went on the Supreme Scream, dropping 252 feet at 50mph. Wow!
 
Dragon Swing
 
We had a lot of fun on the Dragon Swing! There was a group of boys opposite us on the far side of the swing who would yell, “Whoooaaaaa!” in deep, manly voices when their boat end was in the air. When it would swing our way, our little girls would yell, “Aahhhhhhh!” in their high-pitched girly voices. It was hilarious, everyone was laughing. At the end of the ride, the boys yelled, “Again! Again!”, and the operator started it up again with out any of us having to debark. Fabulous!
 
Coast Rider
 
Time for another kiddie-coaster, the Coast Rider. There are similar rides at Legoland (LEGO® TECHNIC™ Coaster) and California Adventure (Goofy’s Sky School). Good fun! We nicknamed this one “the berry crusher” as it had an unfortunate side-effort on Tom.
 
Knotts Glider and Scrambler
 
While Tom tracked down bottled water (and possible an ice pack for his groin), the girls and I went on Surfside Gliders and Pacific Scrambler.
 
Boomerang
 
Time to get Tom’s heart racing again with the Boomerang coaster. “This scream machine turns you head-over-heels six times in less than 1 minute! And just when you think it’s safe to breathe, it starts all over again — BACKWARDS!” Okay, sure, there’s that! I do like how there is a nice assortment of kids/family rides and thrill rides.
 
Johnny Rockets
 
Is anybody else hungry? It was noon, so we sat down to eat at Johnny Rocket’s. First time for us, and what delicious burgers they have! ::: slurp! ::: It was nice to relax after two hours of non-stop action.
 
Knotts Sky CabinAfter that big lunch, we needed a low-key ride such as Sky Cabin. We enjoyed the nice leisurely climb into the sky, took a few pics, got a lay of the land, and settled softly back down to earth.
 
Timber Mountain Log RideFeeling that heatwave? Time to cool off at the Timber Mountain Log Ride. It’s a little dark in there, completely pitch black in parts, a bear growls at you, and you plummet 38′ at the end…. but well worth the cooling splashes on this hot day!
 
Knotts Shops
 
Did somebody say, “Shopping”?! Might have been me. LOL. First we posed by these vintage characters on benches (even my Mom has posed with them!) before venturing into the Ghost Town Candy Shop. With a name like Ghost Town, I should have been afraid… of the prices! The candy was about $3.25 per quarter lb, and the two lil’ bags my girls filled cost $26.00. Holy cow! What could I say? “There’s no way I’m paying $26.00 for two tiny bags of candy!” Yes, I could have said that, but I didn’t. The girls, with their own money, bought some stuffed animals and Tom bought them personalized plaques for their room.
 
knotts parking
 
As we left the ghost town, we ended up at the front gate! We had been all the way around, but there were still a few hours before closing time. I suggested we return to our truck to get rid of the bags and packages were were carrying before coming back in to ride a thrill coaster.
 
Ghost_Rider
 
Ghost Rider. Look at that picture. Need I say more? I was scared senseless. I think we all were! Mega drops on that bumpity wooden coaster! May I add, the next day it was closed for refurbishment. That gives you a warm, fuzzy feeling.
 
Knotts Sidewinder
 
Think the Ghost Rider was nuts? Check out the Sidwinder, spinning 360 degrees while on a coaster track! I cannot make this up. My head didn’t know which way was up, and I didn’t opt to ride a 2nd time (although Tom and the girls did).
 
Crazy Coasters
 
Two more crazy coasters for Tom to ride: Xcelerator which, yes, it does roll to the outside to complete that loop! And Silver Bullet, a typical “feet dangling” ride. Tom bought the photo of him on the Silver Bullet ride, but we lost it.
 
The girls rode The Jaguar, The Scrambler and The Glider one more time before we exited the park at 9 minutes ’til closing. What a day!
 
Mrs Knotts chicken
 
We stopped at Mrs. Knott’s Chicken Dinner Restaurant and got dinner to go. We dined in our hotel room, and promptly passed out. I vaguely recall hearing the girls say something about wanting to go swimming. Can you imagine? Swimming after 8 hours at an amusement park. I’m getting too old for this.
 
• Amusement Parks – yeah or nay?

Menu

© 2014 JEAN HAS BEEN SHOPPING. ALL RIGHTS RESERVED.