post-page

Theme Authenticity Checker

22
responses
by
 
on
October 16th, 2009
in
WordPress Plugins
 
Tags: , , , ,



heading
heading
heading
22
Responses
Leave A Comment
Comments Feed

 

Comments

  1. hypyklrz (1 comments.) says:
    10/16/2009 at 3:02 pm

    Thanks for the head-up on this. We use Anti-virus and have had good results. We were amazed how many themes had questionable code inserted in them on the WP themes extend. (sorry, we didn’t take names)We’ll just stick with Justin Tadlock’s Hybrid Theme.

  2. Michael (2 comments.) says:
    10/16/2009 at 7:25 pm

    This is the exact plugin I needed.
    I run a number of blogs but I first like to install all the potential themes on one practice blog.
    TAC searches for links in all the themes installed on that blog in one go. Saved my heaps of time.

  3. Carrie (12 comments.) says:
    10/16/2009 at 7:28 pm

    I have ran into so many themes out there with funky coding in them that it is scary. Especially those footer ones can be pretty bad with links to porn sites and other sites people just wouldn’t usually link to on their own. It’s nice to know now that there is a checker for that and other hidden things that even with my ninja-like powers can’t find sometimes.

  4. Dana@Online Knowledge (3 comments.) says:
    10/16/2009 at 10:18 pm

    It is great to know there is tools for theme checking because there are many creepy theme out there.

  5. clickfire (2 comments.) says:
    10/17/2009 at 12:02 am

    If the WordPress.org theme repository editors would allow more developers’ themes to be accepted instead of shutting the doors on them for suspicion of evil sponsorship, there might not be such a market for themes outside these trusted sources.

  6. RavanH (11 comments.) says:
    10/17/2009 at 5:31 am

    I was shocked to find one theme on a small WPMU install with funky encrypted code in its functions.php: Newsby (I already had stripped some ad links from its footer but this one escaped me) :(

    TAC is one of the BEST new wordpress tools. Thanks for letting me know about it!

    • RavanH (11 comments.) says:
      10/17/2009 at 5:45 am

      Sorry, that should be “Newsbie” theme. It is not in the official WordPress theme directory.

  7. Tejaswini (1 comments.) says:
    10/17/2009 at 2:17 pm

    Wow, great tool. It is necessary to check the theme before putting on the server and activating. It can also cause some security threat. And it is true that many people who start blogging are not related to web languages so they cannot go on tracking what is there in the code of each template file of the theme, so just they see the feature and use that theme. It can be dangerous even due to the malicious scripts, so nice that you revealed such a good tool. Thanks for sharing.

  8. Len says:
    10/17/2009 at 2:39 pm

    We do not install and test every theme mentioned in these release posts

    I do my best to test as many of the themes posted in the WLTC forums as I can but alas due to time constraints I can’t get them all. As well, I don’t do this in any official capacity for WLTC. Consequently, I see this plugin as a welcome tool in the fight against these trashy (and potentially dangerous) themes.

  9. wdct (1 comments.) says:
    10/18/2009 at 8:18 am

    Does it work on woothemes wordpress themes ?

  10. Josef (1 comments.) says:
    10/18/2009 at 10:50 am

    Hi…
    Looks like a “WordPress Emergency Response Team” would be a good thing to have (not just because “WERT” is the German word for “value” :-).
    Through combining PHP-IDS (http://phpids.org/) with wordpress and watching logfiles, I see quite some strange things happening, even on near-zero-volume blogs. For example, there appear to be waves of systematic scanning for certain plug-ins, presumably to exploit vulnerabilities.
    But once I have the insight, where can I go? I’ll certainly not post it to the world, like here in a comment :-)
    Obviously, such a team would have to deal not just with core vulnerabilities but would also have to reach out to the plug-in and theme communities.
    Any feedback would be appreciated!
    Josef

  11. Will Langford (1 comments.) says:
    10/18/2009 at 11:42 pm

    I am one of the two developers of tac. I would like to thank everyone for the positive feedback, if anyone has any questions of feature requests please let us know.

    Thank you again!

  12. SleeplessinDC says:
    10/19/2009 at 9:03 pm

    I ran TAC on a blog with 56 themes. It found two that have encrypted code:

    SeaShore 1.0 by Sadish Bala (Line 33 in contact.php)

    Web Minimalist 200901 1.0 by Effi (Line 35 in contact.php)

    • gestroud says:
      10/20/2009 at 12:58 pm

      Icould be wrong, but it looks as if the code in those two files is there to encrypt email addresses.

  13. TheWebmasterBlogs (1 comments.) says:
    4/5/2012 at 3:02 am

    Before today, I didn’t know about TAC at all, and I have been using wordpress for years. I have done more than my fair share of downloading free themes from shady sites, and not once did I find any info like this on the wordpress site. WordPress should really promote TAC as this tool can help fix a lot of security loopholes in a lot of sites.
    That said, I have never faced any security issues with the blogs I had (most of which are now shut). So I guess the hidden code is mostly just to generate pagerank flowing links, but malicious scripts could easily be there.
    I will write about this on my webmaster blog as well.
    Thanks for the info :)



Trackbacks/Pingbacks

  1. Theme Authenticity Checker - WordPress Tavern Forum says:
    10/16/2009 at 2:57 pm

    […] cool overall just to use it as a way to find all the static or hardcode links within a theme. http://weblogtoolscollection.com/arc…icity-checker/ WPTavern Twitter Account | Personal Blog | WordPress Weekly […]

  2. Digitaler Heimwerker » Wordpress-Security: Theme Authenticity Checker says:
    10/18/2009 at 10:33 am

    […] zu prüfen. Die Weblog Tools Collection schreibt (Englisch) unter der Überschrift “Theme Authenticity Checker” über ein neues Plug-In, das diese Lücke teilweise schließt: Der “Theme Authenticity […]

  3. Stop Downloading WordPress Themes from Shady Sites | Theme Lab says:
    12/8/2009 at 1:28 pm

    […] it is pretty effective in detecting that kind of junk. For more information you can also check out Jeff Chandler’s post on the exact same plugin (who was also nice enough to mention Theme Lab as a good source for free […]

Obviously Powered by WordPress. © 2003-2013

page counter
css.php