Bullet Proof, Wordfence und .htaccess

John Boy

Hi,
habe auf einigen WP Installationen ein Problem. Und zwar nutze ich zwei Sicherheits-Plugins (Bullet Proof Security und Wordfence). Zudem habe ich über Bullet Proof noch einige extra Einträge in der .htaccess gemacht, welche ich mir von verschiedenen Websites zusammen gefischt habe. Teilweise enhält die .htaccess somit eine Liste bekannter "böser" Bots, sowie einige Sicherheits-Einträge. Ein wichtiger Eintrag soll z.B. einen Passwort-Schutz für /wplogin.php und /wp-admin herbei führen. Soweit klappt das auch, aber ich habe nun ein Problem mit Wordfence, welches mich ab und zu aussperrt, obwohl noch kein Login-Versuch passiert ist. Ich vermute hier einen Konflikt mit einem der Einträge.
Außerdem habe ich ohnehin den Verdacht, daß vielleicht der eine oder andere selbst eingepflegte Eintrag in Konflikt mit denen von Bullet Proof steht.
Nun bin ich nicht gerade ein Experte in diesen Themen und bräuchte da mal jemanden der sich gut auskennt und mir sagen kann, ob da was grundlegend verkehrt ist, etc.

Danke für Eure Hilfe!
VG
John

Werbepost

Hallo!

Wenn du gerade an deiner Website arbeitest oder dein aktuelles Hosting überdenkst: Wir betreiben mit NetzLiving eine Hosting-Plattform, die speziell auf Performance, Sicherheit und einfache Verwaltung ausgelegt ist.

✔️ Schnelle Ladezeiten (optimiert für WordPress & Co.)
✔️ Deutsche Server & DSGVO-konform
✔️ Persönlicher Support (kein 0815-Ticket-System)

Mehr erfahren

John Boy

Hier die .htaccess:

Apache Configuration

ServerSignature Off
Options -Indexes
DirectoryIndex index.php index.html /index.php
ErrorDocument 400 /wp-content/plugins/bulletproof-security/400.php
ErrorDocument 401 default
ErrorDocument 403 /wp-content/plugins/bulletproof-security/403.php
ErrorDocument 404 /404.php
RedirectMatch 403 /\..*$
RewriteEngine On
RewriteBase /
RewriteRule ^wp-admin/includes/ - [F,L]
RewriteRule !^wp-includes/ - [S=3]
RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
RewriteRule ^wp-includes/theme-compat/ - [F,L]
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteRule ^wp-admin$ wp-admin/ [R=301,L]
RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^ - [L]
RewriteRule ^(wp-(content|admin|includes).*) $1 [L]
RewriteRule ^(.*\.php)$ $1 [L]
RewriteRule . index.php [L]
</IfModule>
RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^(HEAD|TRACE|DELETE|TRACK|DEBUG) [NC]
RewriteRule ^(.*)$ - [F,L]
RewriteCond %{REQUEST_URI} ^/wp-content/plugins/adminer/ [NC]
RewriteRule . - [S=12]
RewriteCond %{REQUEST_URI} ^/wp-content/mu-plugins/custom-anti-spam/ [NC]
RewriteRule . - [S=11]
RewriteCond %{REQUEST_URI} ^/wp-content/plugins/peters-custom-anti-spam-image/ [NC]
RewriteRule . - [S=10]
RewriteCond %{REQUEST_URI} ^/wp-content/plugins/fb-status-updater/ [NC]
RewriteRule . - [S=9]
RewriteCond %{REQUEST_URI} ^/wp-content/plugins/stream-video-player/ [NC]
RewriteRule . - [S=8]
RewriteCond %{REQUEST_URI} ^/wp-content/plugins/xcloner-backup-and-restore/ [NC]
RewriteRule . - [S=7]
RewriteCond %{QUERY_STRING} action=logout&redirect_to=http%3A%2F%2F(.*) [NC]
RewriteRule . - [S=6]
RewriteCond %{QUERY_STRING} redirect_to=(.*) [NC]
RewriteRule . - [S=5]
RewriteCond %{QUERY_STRING} action=resetpass&key=(.*) [NC]
RewriteRule . - [S=4]
RewriteCond %{QUERY_STRING} action=rp&key=(.*) [NC]
RewriteRule . - [S=3]
RewriteCond %{QUERY_STRING} ^.*(http|https|ftp)(%3A|:)(%2F|/)(%2F|/)(w){0,3}.?(blogger|picasa|blogspot|tsunami|petapolitik|photobucket|imgur|imageshack|wordpress\.com|img\.youtube|tinypic\.com|upload\.wikimedia|kkc|start-thegame).*$ [NC,OR]
RewriteCond %{THE_REQUEST} ^.*(http|https|ftp)(%3A|:)(%2F|/)(%2F|/)(w){0,3}.?(blogger|picasa|blogspot|tsunami|petapolitik|photobucket|imgur|imageshack|wordpress\.com|img\.youtube|tinypic\.com|upload\.wikimedia|kkc|start-thegame).*$ [NC]
RewriteRule .* index.php [F,L]
RewriteCond %{REQUEST_URI} (timthumb\.php|phpthumb\.php|thumb\.php|thumbs\.php) [NC]
RewriteCond %{HTTP_REFERER} ^.*potts.de.*
RewriteRule . - [S=1]
RewriteCond %{HTTP_USER_AGENT} (havij|libwww-perl|wget|python|nikto|curl|scan|java|winhttp|clshttp|loader) [NC,OR]
RewriteCond %{HTTP_USER_AGENT} (%0A|%0D|%27|%3C|%3E|%00) [NC,OR]
RewriteCond %{HTTP_USER_AGENT} (;|<|>|'|"|\)|\(|%0A|%0D|%22|%27|%28|%3C|%3E|%00).*(libwww-perl|wget|python|nikto|curl|scan|java|winhttp|HTTrack|clshttp|archiver|loader|email|harvest|extract|grab|miner) [NC,OR]
RewriteCond %{THE_REQUEST} \?\ HTTP/ [NC,OR]
RewriteCond %{THE_REQUEST} \/\*\ HTTP/ [NC,OR]
RewriteCond %{THE_REQUEST} etc/passwd [NC,OR]
RewriteCond %{THE_REQUEST} cgi-bin [NC,OR]
RewriteCond %{THE_REQUEST} (%0A|%0D|\\r|\\n) [NC,OR]
RewriteCond %{REQUEST_URI} owssvr\.dll [NC,OR]
RewriteCond %{HTTP_REFERER} (%0A|%0D|%27|%3C|%3E|%00) [NC,OR]
RewriteCond %{HTTP_REFERER} \.opendirviewer\. [NC,OR]
RewriteCond %{HTTP_REFERER} users\.skynet\.be.* [NC,OR]
RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=http:// [OR]
RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=(\.\.//?)+ [OR]
RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=/([a-z0-9_.]//?)+ [NC,OR]
RewriteCond %{QUERY_STRING} \=PHP[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12} [NC,OR]
RewriteCond %{QUERY_STRING} (\.\./|\.\.) [OR]
RewriteCond %{QUERY_STRING} ftp\: [NC,OR]
RewriteCond %{QUERY_STRING} http\: [NC,OR]
RewriteCond %{QUERY_STRING} https\: [NC,OR]
RewriteCond %{QUERY_STRING} \=\|w\| [NC,OR]
RewriteCond %{QUERY_STRING} ^(.*)/self/(.*)$ [NC,OR]
RewriteCond %{QUERY_STRING} ^(.*)cPath=http://(.*)$ [NC,OR]
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} (<|%3C)([^s]*s)+cript.*(>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} (\<|%3C).*embed.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} (<|%3C)([^e]*e)+mbed.*(>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} (\<|%3C).*object.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} (<|%3C)([^o]*o)+bject.*(>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} (\<|%3C).*iframe.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} (<|%3C)([^i]*i)+frame.*(>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [NC,OR]
RewriteCond %{QUERY_STRING} base64_(en|de)code[^(]*\([^)]*\) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} ^.*(\(|\)|<|>|%3c|%3e).* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(\x00|\x04|\x08|\x0d|\x1b|\x20|\x3c|\x3e|\x7f).* [NC,OR]
RewriteCond %{QUERY_STRING} (NULL|OUTFILE|LOAD_FILE) [OR]
RewriteCond %{QUERY_STRING} (\./|\../|\.../)+(motd|etc|bin) [NC,OR]
RewriteCond %{QUERY_STRING} (localhost|loopback|127\.0\.0\.1) [NC,OR]
RewriteCond %{QUERY_STRING} (<|>|'|%0A|%0D|%27|%3C|%3E|%00) [NC,OR]
RewriteCond %{QUERY_STRING} concat[^\(]*\( [NC,OR]
RewriteCond %{QUERY_STRING} union([^s]*s)+elect [NC,OR]
RewriteCond %{QUERY_STRING} union([^a]*a)+ll([^s]*s)+elect [NC,OR]
RewriteCond %{QUERY_STRING} \-[sdcr].*(allow_url_include|allow_url_fopen|safe_mode|disable_functions|auto_prepend_file) [NC,OR]
RewriteCond %{QUERY_STRING} (;|<|>|'|"|\)|%0A|%0D|%22|%27|%3C|%3E|%00).*(/\*|union|select|insert|drop|delete|update|cast|create|char|convert|alter|declare|order|script|set|md5|benchmark|encode) [NC,OR]
RewriteCond %{QUERY_STRING} (sp_executesql) [NC]
RewriteRule ^(.*)$ - [F,L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
<FilesMatch "^(wp-config\.php|php\.ini|php5\.ini|readme\.html|bb-config\.php)">
Order allow,deny
Deny from all
</FilesMatch>
Custom htaccess code will be created here with AutoMagic


# Eigene Blockaden V1.008
# in das letzte Feld von root-custom BPSecurity
SetEnvIfNoCase remote_addr "^209.85.107.37" bad_bot=1        # Dataopedia
SetEnvIfNoCase remote_addr "^212.100.254.105" bad_bot=1        # CopyScape
SetEnvIfNoCase remote_addr "^216.145.11.94" bad_bot=1        # Domaintools
SetEnvIfNoCase remote_addr "^216.145.14.*" bad_bot=1        # Domaintools
SetEnvIfNoCase remote_addr "^216.145.16.*" bad_bot=1        # Domaintools
SetEnvIfNoCase remote_addr "^216.145.17.190" bad_bot=1        # Domaintools
# ... hier ist die Liste noch länger, aber der Übersicht wegen gekürzt
SetEnvIfNoCase user-agent "[Ww]eb[Bb]andit" bad_bot=1
SetEnvIfNoCase user-agent "123People" bad_bot=1
SetEnvIfNoCase user-agent "1337" bad_bot=1
SetEnvIfNoCase user-agent "acont" bad_bot=1
SetEnvIfNoCase user-agent "Alexibot" bad_bot=1
SetEnvIfNoCase user-agent "Aqua_Products" bad_bot=1
# ... hier ist die Liste noch länger, aber der Übersicht wegen gekürzt
<FilesMatch "(.*)">
order allow,deny
allow from all
deny from env=bad_bot
</FilesMatch>




RewriteEngine on
RewriteCond %{REMOTE_ADDR} ^46\.4\.100\.231 [OR]                # Pixray
RewriteCond %{REMOTE_ADDR} ^46\.4\.19\.85 [OR]            # Pixray
RewriteCond %{REMOTE_ADDR} ^176\.9\.19\.103 [OR]        # Pixray
RewriteCond %{REMOTE_ADDR} ^46\.4\.19\.85 [OR]            # Pixray
RewriteCond %{REMOTE_ADDR} ^78\.46\.90\.27 [OR]            # Pixray
RewriteCond %{REMOTE_ADDR} ^176\.9\.0\.12 [OR]            # Pixray
RewriteCond %{REMOTE_ADDR} ^176\.9\.19\.103 [OR]        # Pixray
RewriteCond %{REMOTE_ADDR} ^176\.9\.26\.236 [OR]        # Pixray
RewriteCond %{REMOTE_ADDR} ^176\.9\.26\.238 [OR]        # Pixray
RewriteCond %{REMOTE_ADDR} ^176\.9\.31\.203 [OR]        # Pixray
RewriteCond %{REMOTE_ADDR} ^188\.40\.65\.130 [OR]        # Pixray
RewriteCond %{REMOTE_ADDR} ^188\.40\.66\.214 [OR]        # Pixray
RewriteCond %{REMOTE_ADDR} ^188\.40\.85\.200 [OR]        # Pixray
RewriteCond %{HTTP_USER_AGENT} ^.*Pixray-Seeker.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^BacklinkCrawler
RewriteCond %{REQUEST_FILENAME}  !^.*robots.txt$
RewriteRule ^.* http://www.google.de/ [R=301,L]


Order allow,deny
allow from all
Deny from 1.161.0.0/16            # Taiwan Taipei Chtd Chunghwa Telecom            # 1.161.0.0 - 1.161.255.255
Deny from 108.178.52.40/29        # United States Chicago Singlehop Inc            # 108.178.52.40 - 108.178.52.47
Deny from 108.62.49.0/24        # US, Ubiquity Server Solutions New York        # 108.62.49.0 - 108.62.49.255
Deny from 110.34.128.0/17        # Thailand Vpls Ap                    # 110.34.128.0 - 110.34.255.255
Deny from 110.45.0.0/18            # CJ-CABLENET, Seoul                    # 110.45.0.0 - 110.45.63.255
Deny from 216.145.16.0/24        # Domaintools.com                    # 216.145.16.0 - 216.145.16.255
# ... hier ist die Liste noch länger, aber der Übersicht wegen gekürzt


SetEnvIfNoCase user-agent .*google.* search_robot=1
SetEnvIfNoCase user-agent .*yahoo.* search_robot=1
SetEnvIfNoCase user-agent .*bot.* search_robot=1
SetEnvIfNoCase user-agent .*ask.* search_robot=1
Order Deny,Allow
Deny from All
Allow from env=search_robot


# Zugriff auf bestimmte Dateien verbieten
<FilesMatch "^(\.htaccess|\.htpasswd|\.htusers|wp-config\.php|php\.ini|php5\.ini|liesmich\.html|readme\.html|bb-config\.php)">
Order allow,deny
Deny from all
#Allow from xxx.xxx.xxx.xxx
</FilesMatch>


# Passwort-Schutz für wp-login.php
<Files wp-login.php>
AuthName "Service-Bereich"
AuthType Basic
AuthUserFile /pathtowordpress/wp-admin/.htpassword
AuthPGAuthoritative Off
require valid-user
</Files>
<FilesMatch "^(admin-ajax\.php|load-scripts\.php|script-loader\.php|async-upload\.php|install\.css)">
Order allow,deny
Allow from all
Satisfy any
</FilesMatch>

Alles anzeigen

John Boy

unter /wp-admin sieht die .htaccess dann so aus:

Apache Configuration

<FilesMatch "^(install\.php|example\.php|example2\.php|example3\.php)">
Order allow,deny
Deny from all
</FilesMatch>
<FilesMatch "^(\.htaccess|\.htpasswd|\.htusers|wp-config\.php|php\.ini|php5\.ini|liesmich\.html|readme\.html|bb-config\.php)">
Order allow,deny
Deny from all
</FilesMatch>
AuthName "Service-Bereich"
AuthType Basic
AuthUserFile /pathtowordpress/wp-admin/.htusers
AuthPGAuthoritative Off
require valid-user
<FilesMatch "^(admin-ajax\.php|load-scripts\.php|script-loader\.php|async-upload\.php|install\.css)">
Order allow,deny
Allow from all
Satisfy any
</FilesMatch>
RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^(HEAD|TRACE|DELETE|TRACK|DEBUG) [NC]
RewriteRule ^(.*)$ - [F,L]
RewriteCond %{REQUEST_URI} (press-this\.php) [NC]
RewriteRule . - [S=1]
RewriteCond %{HTTP_USER_AGENT} (%0A|%0D|%27|%3C|%3E|%00) [NC,OR]
RewriteCond %{HTTP_USER_AGENT} (libwww-perl|wget|python|nikto|curl|scan|java|winhttp|HTTrack|clshttp|archiver|loader|email|harvest|extract|grab|miner) [NC,OR]
RewriteCond %{THE_REQUEST} \?\ HTTP/ [NC,OR]
RewriteCond %{THE_REQUEST} \/\*\ HTTP/ [NC,OR]
RewriteCond %{THE_REQUEST} etc/passwd [NC,OR]
RewriteCond %{THE_REQUEST} cgi-bin [NC,OR]
RewriteCond %{THE_REQUEST} (%0A|%0D) [NC,OR]
RewriteCond %{REQUEST_URI} owssvr\.dll [NC,OR]
RewriteCond %{HTTP_REFERER} (%0A|%0D|%27|%3C|%3E|%00) [NC,OR]
RewriteCond %{HTTP_REFERER} \.opendirviewer\. [NC,OR]
RewriteCond %{HTTP_REFERER} users\.skynet\.be.* [NC,OR]
RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=http:// [OR]
RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=(\.\.//?)+ [OR]
RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=/([a-z0-9_.]//?)+ [NC,OR]
RewriteCond %{QUERY_STRING} \=PHP[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12} [NC,OR]
RewriteCond %{QUERY_STRING} (\.\./|\.\.) [OR]
RewriteCond %{QUERY_STRING} ftp\: [NC,OR]
RewriteCond %{QUERY_STRING} http\: [NC,OR]
RewriteCond %{QUERY_STRING} https\: [NC,OR]
RewriteCond %{QUERY_STRING} \=\|w\| [NC,OR]
RewriteCond %{QUERY_STRING} ^(.*)/self/(.*)$ [NC,OR]
RewriteCond %{QUERY_STRING} ^(.*)cPath=http://(.*)$ [NC,OR]
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} (<|%3C)([^s]*s)+cript.*(>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} (\<|%3C).*iframe.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} (<|%3C)([^i]*i)+frame.*(>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [NC,OR]
RewriteCond %{QUERY_STRING} base64_(en|de)code[^(]*\([^)]*\) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} ^.*(\(|\)|<|>).* [NC,OR]
RewriteCond %{QUERY_STRING} (NULL|OUTFILE|LOAD_FILE) [OR]
RewriteCond %{QUERY_STRING} (\./|\../|\.../)+(motd|etc|bin) [NC,OR]
RewriteCond %{QUERY_STRING} (localhost|loopback|127\.0\.0\.1) [NC,OR]
RewriteCond %{QUERY_STRING} (<|>|'|%0A|%0D|%27|%3C|%3E|%00) [NC,OR]
RewriteCond %{QUERY_STRING} concat[^\(]*\( [NC,OR]
RewriteCond %{QUERY_STRING} union([^s]*s)+elect [NC,OR]
RewriteCond %{QUERY_STRING} union([^a]*a)+ll([^s]*s)+elect [NC,OR]
RewriteCond %{QUERY_STRING} (;|<|>|'|"|\)|%0A|%0D|%22|%27|%3C|%3E|%00).*(/\*|union|select|insert|drop|delete|update|cast|create|char|convert|alter|declare|order|script|set|md5|benchmark|encode) [NC,OR]
RewriteCond %{QUERY_STRING} (sp_executesql) [NC]
RewriteRule ^(.*)$ - [F,L]

Alles anzeigen

Willkommen! Melden Sie sich an oder registrieren Sie sich.

Bullet Proof, Wordfence und .htaccess

Jetzt mitmachen!