Beiträge von John Boy

John Boy

unter /wp-admin sieht die .htaccess dann so aus:

Apache Configuration

<FilesMatch "^(install\.php|example\.php|example2\.php|example3\.php)">
Order allow,deny
Deny from all
</FilesMatch>
<FilesMatch "^(\.htaccess|\.htpasswd|\.htusers|wp-config\.php|php\.ini|php5\.ini|liesmich\.html|readme\.html|bb-config\.php)">
Order allow,deny
Deny from all
</FilesMatch>
AuthName "Service-Bereich"
AuthType Basic
AuthUserFile /pathtowordpress/wp-admin/.htusers
AuthPGAuthoritative Off
require valid-user
<FilesMatch "^(admin-ajax\.php|load-scripts\.php|script-loader\.php|async-upload\.php|install\.css)">
Order allow,deny
Allow from all
Satisfy any
</FilesMatch>
RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^(HEAD|TRACE|DELETE|TRACK|DEBUG) [NC]
RewriteRule ^(.*)$ - [F,L]
RewriteCond %{REQUEST_URI} (press-this\.php) [NC]
RewriteRule . - [S=1]
RewriteCond %{HTTP_USER_AGENT} (%0A|%0D|%27|%3C|%3E|%00) [NC,OR]
RewriteCond %{HTTP_USER_AGENT} (libwww-perl|wget|python|nikto|curl|scan|java|winhttp|HTTrack|clshttp|archiver|loader|email|harvest|extract|grab|miner) [NC,OR]
RewriteCond %{THE_REQUEST} \?\ HTTP/ [NC,OR]
RewriteCond %{THE_REQUEST} \/\*\ HTTP/ [NC,OR]
RewriteCond %{THE_REQUEST} etc/passwd [NC,OR]
RewriteCond %{THE_REQUEST} cgi-bin [NC,OR]
RewriteCond %{THE_REQUEST} (%0A|%0D) [NC,OR]
RewriteCond %{REQUEST_URI} owssvr\.dll [NC,OR]
RewriteCond %{HTTP_REFERER} (%0A|%0D|%27|%3C|%3E|%00) [NC,OR]
RewriteCond %{HTTP_REFERER} \.opendirviewer\. [NC,OR]
RewriteCond %{HTTP_REFERER} users\.skynet\.be.* [NC,OR]
RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=http:// [OR]
RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=(\.\.//?)+ [OR]
RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=/([a-z0-9_.]//?)+ [NC,OR]
RewriteCond %{QUERY_STRING} \=PHP[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12} [NC,OR]
RewriteCond %{QUERY_STRING} (\.\./|\.\.) [OR]
RewriteCond %{QUERY_STRING} ftp\: [NC,OR]
RewriteCond %{QUERY_STRING} http\: [NC,OR]
RewriteCond %{QUERY_STRING} https\: [NC,OR]
RewriteCond %{QUERY_STRING} \=\|w\| [NC,OR]
RewriteCond %{QUERY_STRING} ^(.*)/self/(.*)$ [NC,OR]
RewriteCond %{QUERY_STRING} ^(.*)cPath=http://(.*)$ [NC,OR]
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} (<|%3C)([^s]*s)+cript.*(>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} (\<|%3C).*iframe.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} (<|%3C)([^i]*i)+frame.*(>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [NC,OR]
RewriteCond %{QUERY_STRING} base64_(en|de)code[^(]*\([^)]*\) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} ^.*(\(|\)|<|>).* [NC,OR]
RewriteCond %{QUERY_STRING} (NULL|OUTFILE|LOAD_FILE) [OR]
RewriteCond %{QUERY_STRING} (\./|\../|\.../)+(motd|etc|bin) [NC,OR]
RewriteCond %{QUERY_STRING} (localhost|loopback|127\.0\.0\.1) [NC,OR]
RewriteCond %{QUERY_STRING} (<|>|'|%0A|%0D|%27|%3C|%3E|%00) [NC,OR]
RewriteCond %{QUERY_STRING} concat[^\(]*\( [NC,OR]
RewriteCond %{QUERY_STRING} union([^s]*s)+elect [NC,OR]
RewriteCond %{QUERY_STRING} union([^a]*a)+ll([^s]*s)+elect [NC,OR]
RewriteCond %{QUERY_STRING} (;|<|>|'|"|\)|%0A|%0D|%22|%27|%3C|%3E|%00).*(/\*|union|select|insert|drop|delete|update|cast|create|char|convert|alter|declare|order|script|set|md5|benchmark|encode) [NC,OR]
RewriteCond %{QUERY_STRING} (sp_executesql) [NC]
RewriteRule ^(.*)$ - [F,L]

Alles anzeigen

John Boy

Hier die .htaccess:

Apache Configuration

ServerSignature Off
Options -Indexes
DirectoryIndex index.php index.html /index.php
ErrorDocument 400 /wp-content/plugins/bulletproof-security/400.php
ErrorDocument 401 default
ErrorDocument 403 /wp-content/plugins/bulletproof-security/403.php
ErrorDocument 404 /404.php
RedirectMatch 403 /\..*$
RewriteEngine On
RewriteBase /
RewriteRule ^wp-admin/includes/ - [F,L]
RewriteRule !^wp-includes/ - [S=3]
RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
RewriteRule ^wp-includes/theme-compat/ - [F,L]
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteRule ^wp-admin$ wp-admin/ [R=301,L]
RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^ - [L]
RewriteRule ^(wp-(content|admin|includes).*) $1 [L]
RewriteRule ^(.*\.php)$ $1 [L]
RewriteRule . index.php [L]
</IfModule>
RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^(HEAD|TRACE|DELETE|TRACK|DEBUG) [NC]
RewriteRule ^(.*)$ - [F,L]
RewriteCond %{REQUEST_URI} ^/wp-content/plugins/adminer/ [NC]
RewriteRule . - [S=12]
RewriteCond %{REQUEST_URI} ^/wp-content/mu-plugins/custom-anti-spam/ [NC]
RewriteRule . - [S=11]
RewriteCond %{REQUEST_URI} ^/wp-content/plugins/peters-custom-anti-spam-image/ [NC]
RewriteRule . - [S=10]
RewriteCond %{REQUEST_URI} ^/wp-content/plugins/fb-status-updater/ [NC]
RewriteRule . - [S=9]
RewriteCond %{REQUEST_URI} ^/wp-content/plugins/stream-video-player/ [NC]
RewriteRule . - [S=8]
RewriteCond %{REQUEST_URI} ^/wp-content/plugins/xcloner-backup-and-restore/ [NC]
RewriteRule . - [S=7]
RewriteCond %{QUERY_STRING} action=logout&redirect_to=http%3A%2F%2F(.*) [NC]
RewriteRule . - [S=6]
RewriteCond %{QUERY_STRING} redirect_to=(.*) [NC]
RewriteRule . - [S=5]
RewriteCond %{QUERY_STRING} action=resetpass&key=(.*) [NC]
RewriteRule . - [S=4]
RewriteCond %{QUERY_STRING} action=rp&key=(.*) [NC]
RewriteRule . - [S=3]
RewriteCond %{QUERY_STRING} ^.*(http|https|ftp)(%3A|:)(%2F|/)(%2F|/)(w){0,3}.?(blogger|picasa|blogspot|tsunami|petapolitik|photobucket|imgur|imageshack|wordpress\.com|img\.youtube|tinypic\.com|upload\.wikimedia|kkc|start-thegame).*$ [NC,OR]
RewriteCond %{THE_REQUEST} ^.*(http|https|ftp)(%3A|:)(%2F|/)(%2F|/)(w){0,3}.?(blogger|picasa|blogspot|tsunami|petapolitik|photobucket|imgur|imageshack|wordpress\.com|img\.youtube|tinypic\.com|upload\.wikimedia|kkc|start-thegame).*$ [NC]
RewriteRule .* index.php [F,L]
RewriteCond %{REQUEST_URI} (timthumb\.php|phpthumb\.php|thumb\.php|thumbs\.php) [NC]
RewriteCond %{HTTP_REFERER} ^.*potts.de.*
RewriteRule . - [S=1]
RewriteCond %{HTTP_USER_AGENT} (havij|libwww-perl|wget|python|nikto|curl|scan|java|winhttp|clshttp|loader) [NC,OR]
RewriteCond %{HTTP_USER_AGENT} (%0A|%0D|%27|%3C|%3E|%00) [NC,OR]
RewriteCond %{HTTP_USER_AGENT} (;|<|>|'|"|\)|\(|%0A|%0D|%22|%27|%28|%3C|%3E|%00).*(libwww-perl|wget|python|nikto|curl|scan|java|winhttp|HTTrack|clshttp|archiver|loader|email|harvest|extract|grab|miner) [NC,OR]
RewriteCond %{THE_REQUEST} \?\ HTTP/ [NC,OR]
RewriteCond %{THE_REQUEST} \/\*\ HTTP/ [NC,OR]
RewriteCond %{THE_REQUEST} etc/passwd [NC,OR]
RewriteCond %{THE_REQUEST} cgi-bin [NC,OR]
RewriteCond %{THE_REQUEST} (%0A|%0D|\\r|\\n) [NC,OR]
RewriteCond %{REQUEST_URI} owssvr\.dll [NC,OR]
RewriteCond %{HTTP_REFERER} (%0A|%0D|%27|%3C|%3E|%00) [NC,OR]
RewriteCond %{HTTP_REFERER} \.opendirviewer\. [NC,OR]
RewriteCond %{HTTP_REFERER} users\.skynet\.be.* [NC,OR]
RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=http:// [OR]
RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=(\.\.//?)+ [OR]
RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=/([a-z0-9_.]//?)+ [NC,OR]
RewriteCond %{QUERY_STRING} \=PHP[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12} [NC,OR]
RewriteCond %{QUERY_STRING} (\.\./|\.\.) [OR]
RewriteCond %{QUERY_STRING} ftp\: [NC,OR]
RewriteCond %{QUERY_STRING} http\: [NC,OR]
RewriteCond %{QUERY_STRING} https\: [NC,OR]
RewriteCond %{QUERY_STRING} \=\|w\| [NC,OR]
RewriteCond %{QUERY_STRING} ^(.*)/self/(.*)$ [NC,OR]
RewriteCond %{QUERY_STRING} ^(.*)cPath=http://(.*)$ [NC,OR]
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} (<|%3C)([^s]*s)+cript.*(>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} (\<|%3C).*embed.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} (<|%3C)([^e]*e)+mbed.*(>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} (\<|%3C).*object.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} (<|%3C)([^o]*o)+bject.*(>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} (\<|%3C).*iframe.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} (<|%3C)([^i]*i)+frame.*(>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [NC,OR]
RewriteCond %{QUERY_STRING} base64_(en|de)code[^(]*\([^)]*\) [NC,OR]
RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2}) [OR]
RewriteCond %{QUERY_STRING} ^.*(\(|\)|<|>|%3c|%3e).* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(\x00|\x04|\x08|\x0d|\x1b|\x20|\x3c|\x3e|\x7f).* [NC,OR]
RewriteCond %{QUERY_STRING} (NULL|OUTFILE|LOAD_FILE) [OR]
RewriteCond %{QUERY_STRING} (\./|\../|\.../)+(motd|etc|bin) [NC,OR]
RewriteCond %{QUERY_STRING} (localhost|loopback|127\.0\.0\.1) [NC,OR]
RewriteCond %{QUERY_STRING} (<|>|'|%0A|%0D|%27|%3C|%3E|%00) [NC,OR]
RewriteCond %{QUERY_STRING} concat[^\(]*\( [NC,OR]
RewriteCond %{QUERY_STRING} union([^s]*s)+elect [NC,OR]
RewriteCond %{QUERY_STRING} union([^a]*a)+ll([^s]*s)+elect [NC,OR]
RewriteCond %{QUERY_STRING} \-[sdcr].*(allow_url_include|allow_url_fopen|safe_mode|disable_functions|auto_prepend_file) [NC,OR]
RewriteCond %{QUERY_STRING} (;|<|>|'|"|\)|%0A|%0D|%22|%27|%3C|%3E|%00).*(/\*|union|select|insert|drop|delete|update|cast|create|char|convert|alter|declare|order|script|set|md5|benchmark|encode) [NC,OR]
RewriteCond %{QUERY_STRING} (sp_executesql) [NC]
RewriteRule ^(.*)$ - [F,L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
<FilesMatch "^(wp-config\.php|php\.ini|php5\.ini|readme\.html|bb-config\.php)">
Order allow,deny
Deny from all
</FilesMatch>
Custom htaccess code will be created here with AutoMagic


# Eigene Blockaden V1.008
# in das letzte Feld von root-custom BPSecurity
SetEnvIfNoCase remote_addr "^209.85.107.37" bad_bot=1        # Dataopedia
SetEnvIfNoCase remote_addr "^212.100.254.105" bad_bot=1        # CopyScape
SetEnvIfNoCase remote_addr "^216.145.11.94" bad_bot=1        # Domaintools
SetEnvIfNoCase remote_addr "^216.145.14.*" bad_bot=1        # Domaintools
SetEnvIfNoCase remote_addr "^216.145.16.*" bad_bot=1        # Domaintools
SetEnvIfNoCase remote_addr "^216.145.17.190" bad_bot=1        # Domaintools
# ... hier ist die Liste noch länger, aber der Übersicht wegen gekürzt
SetEnvIfNoCase user-agent "[Ww]eb[Bb]andit" bad_bot=1
SetEnvIfNoCase user-agent "123People" bad_bot=1
SetEnvIfNoCase user-agent "1337" bad_bot=1
SetEnvIfNoCase user-agent "acont" bad_bot=1
SetEnvIfNoCase user-agent "Alexibot" bad_bot=1
SetEnvIfNoCase user-agent "Aqua_Products" bad_bot=1
# ... hier ist die Liste noch länger, aber der Übersicht wegen gekürzt
<FilesMatch "(.*)">
order allow,deny
allow from all
deny from env=bad_bot
</FilesMatch>




RewriteEngine on
RewriteCond %{REMOTE_ADDR} ^46\.4\.100\.231 [OR]                # Pixray
RewriteCond %{REMOTE_ADDR} ^46\.4\.19\.85 [OR]            # Pixray
RewriteCond %{REMOTE_ADDR} ^176\.9\.19\.103 [OR]        # Pixray
RewriteCond %{REMOTE_ADDR} ^46\.4\.19\.85 [OR]            # Pixray
RewriteCond %{REMOTE_ADDR} ^78\.46\.90\.27 [OR]            # Pixray
RewriteCond %{REMOTE_ADDR} ^176\.9\.0\.12 [OR]            # Pixray
RewriteCond %{REMOTE_ADDR} ^176\.9\.19\.103 [OR]        # Pixray
RewriteCond %{REMOTE_ADDR} ^176\.9\.26\.236 [OR]        # Pixray
RewriteCond %{REMOTE_ADDR} ^176\.9\.26\.238 [OR]        # Pixray
RewriteCond %{REMOTE_ADDR} ^176\.9\.31\.203 [OR]        # Pixray
RewriteCond %{REMOTE_ADDR} ^188\.40\.65\.130 [OR]        # Pixray
RewriteCond %{REMOTE_ADDR} ^188\.40\.66\.214 [OR]        # Pixray
RewriteCond %{REMOTE_ADDR} ^188\.40\.85\.200 [OR]        # Pixray
RewriteCond %{HTTP_USER_AGENT} ^.*Pixray-Seeker.*$ [OR]
RewriteCond %{HTTP_USER_AGENT} ^BacklinkCrawler
RewriteCond %{REQUEST_FILENAME}  !^.*robots.txt$
RewriteRule ^.* http://www.google.de/ [R=301,L]


Order allow,deny
allow from all
Deny from 1.161.0.0/16            # Taiwan Taipei Chtd Chunghwa Telecom            # 1.161.0.0 - 1.161.255.255
Deny from 108.178.52.40/29        # United States Chicago Singlehop Inc            # 108.178.52.40 - 108.178.52.47
Deny from 108.62.49.0/24        # US, Ubiquity Server Solutions New York        # 108.62.49.0 - 108.62.49.255
Deny from 110.34.128.0/17        # Thailand Vpls Ap                    # 110.34.128.0 - 110.34.255.255
Deny from 110.45.0.0/18            # CJ-CABLENET, Seoul                    # 110.45.0.0 - 110.45.63.255
Deny from 216.145.16.0/24        # Domaintools.com                    # 216.145.16.0 - 216.145.16.255
# ... hier ist die Liste noch länger, aber der Übersicht wegen gekürzt


SetEnvIfNoCase user-agent .*google.* search_robot=1
SetEnvIfNoCase user-agent .*yahoo.* search_robot=1
SetEnvIfNoCase user-agent .*bot.* search_robot=1
SetEnvIfNoCase user-agent .*ask.* search_robot=1
Order Deny,Allow
Deny from All
Allow from env=search_robot


# Zugriff auf bestimmte Dateien verbieten
<FilesMatch "^(\.htaccess|\.htpasswd|\.htusers|wp-config\.php|php\.ini|php5\.ini|liesmich\.html|readme\.html|bb-config\.php)">
Order allow,deny
Deny from all
#Allow from xxx.xxx.xxx.xxx
</FilesMatch>


# Passwort-Schutz für wp-login.php
<Files wp-login.php>
AuthName "Service-Bereich"
AuthType Basic
AuthUserFile /pathtowordpress/wp-admin/.htpassword
AuthPGAuthoritative Off
require valid-user
</Files>
<FilesMatch "^(admin-ajax\.php|load-scripts\.php|script-loader\.php|async-upload\.php|install\.css)">
Order allow,deny
Allow from all
Satisfy any
</FilesMatch>

Alles anzeigen

John Boy

Hi,
habe auf einigen WP Installationen ein Problem. Und zwar nutze ich zwei Sicherheits-Plugins (Bullet Proof Security und Wordfence). Zudem habe ich über Bullet Proof noch einige extra Einträge in der .htaccess gemacht, welche ich mir von verschiedenen Websites zusammen gefischt habe. Teilweise enhält die .htaccess somit eine Liste bekannter "böser" Bots, sowie einige Sicherheits-Einträge. Ein wichtiger Eintrag soll z.B. einen Passwort-Schutz für /wplogin.php und /wp-admin herbei führen. Soweit klappt das auch, aber ich habe nun ein Problem mit Wordfence, welches mich ab und zu aussperrt, obwohl noch kein Login-Versuch passiert ist. Ich vermute hier einen Konflikt mit einem der Einträge.
Außerdem habe ich ohnehin den Verdacht, daß vielleicht der eine oder andere selbst eingepflegte Eintrag in Konflikt mit denen von Bullet Proof steht.
Nun bin ich nicht gerade ein Experte in diesen Themen und bräuchte da mal jemanden der sich gut auskennt und mir sagen kann, ob da was grundlegend verkehrt ist, etc.

Danke für Eure Hilfe!
VG
John

John Boy

Hi,
wenn ich wirklich das Maximum aus einer Wordpress-Installation heraus holen möchte, auf was sollte ich auf Provider-Seite achten, bzw. bestehen?
Ich meine damit sowohl Software, Hardware, als auch Einstellungen an Webserver, PHP, Betriebssystem, etc.

Danke für Eure Hinweise!

VG

Willkommen! Melden Sie sich an oder registrieren Sie sich.

Beiträge von John Boy

Bullet Proof, Wordfence und .htaccess

Bullet Proof, Wordfence und .htaccess

Bullet Proof, Wordfence und .htaccess

Features für optimales Wordpress Hosting?