Wordpress安全配置-伪静态

2024/05/28 WordPress 1027

1 禁止所有对/xmlrpc.php文件的访问

wordpress站点伪静态配置如下：

location = /xmlrpc.php {
    deny all;
    access_log off;
    log_not_found off;
}


2 屏蔽对 /wp-includes/wlwmanifest.xml 文件的访问

wordpress站点伪静态配置如下：

location = /wp-includes/wlwmanifest.xml {
    deny all;
    access_log off;
    log_not_found off;
}


3 禁止Git目录的遍历攻击

wordpress站点伪静态配置如下：

location ~ /\.git {
    deny all;
    access_log off;
    log_not_found off;
}


4 禁止执行/shell.php

wordpress站点伪静态配置如下：

location = /shell.php {
    deny all;
    access_log off;
    log_not_found off;
}


5 禁止对敏感文件的访问

wordpress站点伪静态配置如下：

location ~* /wp-(config|admin|includes)/.*\.php$ {
    deny all;
}


6 限制对特定路径的访问

wordpress站点伪静态配置如下：

location ~* /(delchel|block-editor-plugin|zjxd)\.php$ {
    deny all;
}


7 禁止本地服务器请求：tpc-002.mach3builders.nl、www.wbtuintotaal.nl、www.offshorerotterdam.com、www.technischbedrijf.nl、www.stage-match.nl域名

server {
    ...
    location / {
        if ($host ~* (tpc-002.mach3builders.nl|www.wbtuintotaal.nl|www.offshorerotterdam.com|www.technischbedrijf.nl|www.stage-match.nl)) {
            return 403;
        }
        if ($host ~* (.*\.mach3builders\.nl)) {
            return 403;
        }
    }
    ...
}


7 设置只允许特定IP地址访问WordPress的wp-login.php页面

location = /wp-login.php {
    allow xxx.xxx.xxx.xxx;
    deny all;
}