Hallo,
du verwendest einen sehr alten Apache - mit aktuellen Versionen funktionieren deine .htaccess leider nicht.
[quote='madmaxy','RE: Empfehlung Sicherheits Plugins']
/.htaccess
# BEGINN CACHIFY
<IfModule mod_rewrite.c>
# ENGINE ON
RewriteEngine On
# GZIP FILE
<IfModule mod_mime.c>
RewriteCond %{REQUEST_URI} /$
RewriteCond %{REQUEST_URI} !^/wp-admin/.*
RewriteCond %{REQUEST_METHOD} !=POST
RewriteCond %{QUERY_STRING} =""
RewriteCond %{HTTP_COOKIE} !(wp-postpass|wordpress_logged_in|comment_author)_
RewriteCond %{HTTP:Accept-Encoding} gzip
RewriteCond %{DOCUMENT_ROOT}/wp-content/cache/cachify/%{HTTP_HOST}%{REQUEST_URI}index.html.gz -f
RewriteRule ^(.*) /wp-content/cache/cachify/%{HTTP_HOST}%{REQUEST_URI}index.html.gz [L]
AddType text/html .gz
AddEncoding gzip .gz
</IfModule>
# HTML FILE
RewriteCond %{REQUEST_URI} /$
RewriteCond %{REQUEST_URI} !^/wp-admin/.*
RewriteCond %{REQUEST_METHOD} !=POST
RewriteCond %{QUERY_STRING} =""
RewriteCond %{HTTP_COOKIE} !(wp-postpass|wordpress_logged_in|comment_author)_
RewriteCond %{DOCUMENT_ROOT}/wp-content/cache/cachify/%{HTTP_HOST}%{REQUEST_URI}index.html -f
RewriteRule ^(.*) /wp-content/cache/cachify/%{HTTP_HOST}%{REQUEST_URI}index.html [L]
</IfModule>
# END CACHIFY
Alles anzeigen
bei CACHIFY solltes du die Rechte der Dateien in /wp-content/cache/cachify/%{HTTP_HOST}%
prüfen. Bei mir waren diese mal alle für alle beschreibbar chmod 666 rw- rw- rw-
# Keine URL based exploits zulassen
RedirectMatch 403 \[
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
# Double slashes in allen URLs verbieten
RewriteCond %{THE_REQUEST} ^[A-Z]+\ /(([^/\ ]+/)*)/+([^\ ]*)
RewriteRule ^ /%1%3 [L,R=301]
</IfModule>
ich bevorzuge von Better WP Security-Plugin die Erweiterung
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule ^wp-admin/includes/ - [F,L]
RewriteRule !^wp-includes/ - [S=3]
RewriteCond %{SCRIPT_FILENAME} !^(.*)wp-includes/ms-files.php
RewriteRule ^wp-includes/[^/]+\.php$ - [F,L]
RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F,L]
RewriteRule ^wp-includes/theme-compat/ - [F,L]
RewriteCond %{REQUEST_METHOD} ^(TRACE|DELETE|TRACK) [NC]
RewriteRule ^(.*)$ - [F,L]
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{REQUEST_URI} ^(.*)wp-comments-post\.php*
RewriteCond %{HTTP_REFERER} !^(.*)us.com.*
RewriteCond %{HTTP_REFERER} !^http://jetpack\.wordpress\.com/jetpack-comment/ [OR]
RewriteCond %{HTTP_USER_AGENT} ^$
RewriteRule ^(.*)$ - [F,L]
RewriteCond %{QUERY_STRING} \.\.\/ [NC,OR]
RewriteCond %{QUERY_STRING} ^.*\.(bash|git|hg|log|svn|swp|cvs) [NC,OR]
RewriteCond %{QUERY_STRING} etc/passwd [NC,OR]
RewriteCond %{QUERY_STRING} boot\.ini [NC,OR]
RewriteCond %{QUERY_STRING} ftp\: [NC,OR]
RewriteCond %{QUERY_STRING} http\: [NC,OR]
RewriteCond %{QUERY_STRING} https\: [NC,OR]
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
RewriteCond %{QUERY_STRING} mosConfig_[a-zA-Z_]{1,21}(=|%3D) [NC,OR]
RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(\[|\]|\(|\)|<|>|ê|"|;|\?|\*|=$).* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*("|'|<|>|\|{||).* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(%24&x).* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(127\.0).* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(%0|%A|%B|%C|%D|%E|%F).* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(globals|encode|localhost|loopback).* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(request|select|concat|insert|union|declare).* [NC]
RewriteCond %{QUERY_STRING} !^loggedout=true
RewriteCond %{QUERY_STRING} !^action=rp
RewriteCond %{HTTP_COOKIE} !^.*wordpress_logged_in_.*$
RewriteCond %{HTTP_REFERER} !^http://maps\.googleapis\.com(.*)$
RewriteRule ^(.*)$ - [F,L]
</IfModule>
# END Better WP Security
Alles anzeigen
[code]
wp-conten/uploads/.htaccess
<Files *.php>
deny from all
</Files>
X-XSS-Protection fehlt mir persönlich.
http://blogs.msdn.com/b/ie/archive/2…xss-filter.aspx
http://blogs.msdn.com/b/ieinternals/…ttp-header.aspx
https://www.owasp.org/index.php/Cros…pting_%28XSS%29
https://hackademix.net/2009/11/21/ies…vulnerabilities
Reducing MIME type security risks fehlt mir persönlich
http://www.slideshare.net/hasegawayosuke/owasp-hasegawa
http://blogs.msdn.com/b/ie/archive/2…protection.aspx
https://msdn.microsoft.com/en-us/library/ie/gg622941.aspx
https://mimesniff.spec.whatwg.org/
da ich in der Regel Shops betreibe... fehlt mir
http://www.html5rocks.com/en/tutorials/s…layer-security/
https://tools.ietf.org/html/draft-iet…-14#section-6.1
http://blogs.msdn.com/b/ieinternals/…ment-https.aspx
Content Security Policy fehlt mir persönlich
http://content-security-policy.com/
http://www.html5rocks.com/en/tutorials/s…ecurity-policy/
http://www.w3.org/TR/CSP11/).
Content Security Policy (CSP) ist ein Sicherheitskonzept, um Cross-Site-Scripting und andere Angriffe durch Einschleusen von Daten in Webseiten zu verhindern. Es handelt sich um einen W3C-Draft Arbeitsgruppe zur Sicherheit von Webanwendungen.
CSP wurde ursprünglich von der Mozilla Foundation entworfen und in Firefox 4.0 erstmals experimentell unterstützt.
Clickjacking fehlt mir persönlich
https://cure53.de/xfo-clickjacking.pdf.
https://tools.ietf.org/html/rfc7034
http://blogs.msdn.com/b/ieinternals/…me-options.aspx
https://www.owasp.org/index.php/Clickjacking
und .well-known würde ich vermutlich filtern
https://tools.ietf.org/html/rfc5785
und kannst du sicher selber!
