apache_conf WordPress的安全性

Posted 2021-05-23

## Start Security ##

<Files wp-config.php>
  order allow,deny
  deny from all
</Files>

<Files wp-login.php>
  AuthType Basic
  AuthName "IP not in whitelist, please login"
  AuthUserFile "/home/heere/domains/heere.biz/.htpasswd/.htpasswd"
  Require valid-user
  ErrorDocument 401 "Authorisation Required"
  order deny,allow
  deny from all
  allow from 87.213.97.46 localhost 127.0.0.1
  Satisfy any
</Files>

# Block the include-only files.
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteBase /
  RewriteRule ^wp-admin/includes/ - [F,L]
  RewriteRule !^wp-includes/ - [S=3]
  RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
  RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
  RewriteRule ^wp-includes/theme-compat/ - [F,L]

  # Block enumerating users
  RewriteCond %{REQUEST_URI} !^/wp/wp-admin [NC]
  RewriteCond %{QUERY_STRING} ^author=\d+ [NC,OR]
  RewriteCond %{QUERY_STRING} ^author=\{num 
  RewriteRule ^ - [L,R=403]
</IfModule>

# protect xmlrpc
<Files xmlrpc.php>
  Order Deny,Allow
  Deny from all
</Files>

## End Security ##