WordPress 全方位安全防护指南：构建铜墙铁壁级防御体系

# 关键目录权限设置  
find /var/www/html/ -type d -exec chmod 755 {} ;  
find /var/www/html/ -type f -exec chmod 644 {} ;  
chmod 600 wp-config.php  
chown www-data:www-data -R /var/www/html/  

# 敏感文件保护  
echo "Deny from all" > .htaccess  
mv wp-config.php /etc/wordpress/  
ln -s /etc/wordpress/wp-config.php .  

# 基础防火墙规则  
sudo ufw allow 22/tcp  
sudo ufw allow 80/tcp  
sudo ufw allow 443/tcp  
sudo ufw enable  

# Fail2Ban WordPress防护  
sudo nano /etc/fail2ban/jail.d/wordpress.conf  

[wordpress]  
enabled = true  
filter = wordpress  
logpath = /var/log/nginx/access.log  
maxretry = 3  
bantime = 86400  

// 限制登录尝试  
define('WP_MAX_LOGIN_ATTEMPTS', 3);  
define('WP_LOCKOUT_DURATION', 3600);  

// 强制使用SSL  
define('FORCE_SSL_ADMIN', true);  
define('FORCE_SSL_LOGIN', true);  

// 安全密钥（自动生成）  
define('AUTH_KEY',         'put your unique phrase here');  
define('SECURE_AUTH_KEY',  'put your unique phrase here');  
define('LOGGED_IN_KEY',    'put your unique phrase here');  

# Nginx 配置隐藏  
server {  
    server_tokens off;  
    add_header X-Content-Type-Options "nosniff";  
    add_header X-Frame-Options "SAMEORIGIN";  
    add_header X-XSS-Protection "1; mode=block";  

    location ~ /wp-admin/ {  
        satisfy any;  
        allow 192.168.1.0/24;  
        deny all;  
        auth_basic "Admin Area";  
        auth_basic_user_file /etc/nginx/.htpasswd;  
    }  
}  

-- 创建专用数据库用户  
CREATE USER 'wp_user'@'localhost' IDENTIFIED BY 'StrongPassword123!';  
GRANT SELECT, INSERT, UPDATE, DELETE ON wordpress.* TO 'wp_user'@'localhost';  
FLUSH PRIVILEGES;  

-- 修改表前缀  
RENAME TABLE wp_posts TO xyz_posts;  
UPDATE xyz_options SET option_name = 'xyz_user_roles' WHERE option_name = 'wp_user_roles';  

// 使用预处理语句示例  
$stmt = $wpdb->prepare("SELECT * FROM $wpdb->users WHERE user_login = %s", $username);  
$user = $wpdb->get_row($stmt);  

http {  
    # 常见攻击特征拦截  
    map $request_uri $blocked_uri {  
        default 0;  
        ~*"(eval()|(base64_decode)|(UNION.*SELECT)" 1;  
        ~*"(<script>|alert(|document.cookie)" 1;  
    }  

    server {  
        if ($blocked_uri) {  
            return 403;  
        }  
    }  
}  

[  
    {  
        "description": "Block WordPress Exploits",  
        "action": "block",  
        "expression": "(http.request.uri.path contains "/wp-login.php" and http.request.method eq "POST") or (http.user_agent contains "sqlmap")"  
    },  
    {  
        "description": "Prevent XML-RPC Attacks",  
        "action": "challenge",  
        "expression": "http.request.uri.path contains "/xmlrpc.php""  
    }  
]  

// 禁用文件编辑  
define('DISALLOW_FILE_EDIT', true);  

// 限制REST API访问  
add_filter('rest_authentication_errors', function($result) {  
    if (!is_user_logged_in()) {  
        return new WP_Error('rest_cannot_access', 'REST API access disabled', array('status' => 403));  
    }  
    return $result;  
});  

# 快速检测后门文件  
find /var/www/html/ -name "*.php" -mtime -2  
grep -r "base64_decode" /var/www/html/  
clamscan -r /var/www/html/  

# 数据库异常检测  
mysqlcheck -u root -p --all-databases  

# 使用WPScan进行漏洞扫描  
wpscan --url https://yourdomain.com --enumerate vp,vt,tt,cb,dbe  

# 输出示例：  
[+] WordPress version 6.4.2 identified  
[!] 0 vulnerabilities identified  
[+] No vulnerable plugins/themes found  

☑️ 启用Web应用防火墙（WAF）  
☑️ 强制使用HTTPS连接  
☑️ 定期更新核心/插件/主题  
☑️ 禁用XML-RPC接口  
☑️ 限制PHP执行目录  
☑️ 启用双因素认证（2FA）  
☑️ 设置文件完整性监控  
☑️ 配置实时入侵检测系统