WordPress 防火墙深度解析：从原理到实战的全方位防护指南

// Cloudflare WAF自定义规则  
[  
  {  
    "description": "Block WordPress Exploits",  
    "expression": "(http.request.uri.path contains "/wp-login.php" and http.request.method eq "POST") or (http.user_agent contains "sqlmap")",  
    "action": "block"  
  },  
  {  
    "description": "Challenge XML-RPC",  
    "expression": "http.request.uri.path contains "/xmlrpc.php"",  
    "action": "challenge"  
  }  
]  

// Cloudflare Worker脚本示例  
addEventListener('fetch', event => {  
  const url = new URL(event.request.url);  
  // 拦截可疑扫描行为  
  if (url.pathname.includes('wp-admin') && !validReferrer(event.request)) {  
    return event.respondWith(new Response('Access Denied', {status: 403}));  
  }  
});  

function validReferrer(request) {  
  const referrer = request.headers.get('Referer') || '';  
  return referrer.startsWith('https://yourdomain.com');  
}  

// wp-config.php 优化设置  
define('WORDFENCE_MAX_MEMORY', 256);  
define('WORDFENCE_SCAN_MAX_INI_EXECUTION_TIME', 180);  
define('WORDFENCE_CRAWLER_VERIFY_CACHE', true);  

# 拦截恶意扫描规则示例  
Rule 1: Block if POST request contains "../../"  
Match: Request Body  
Condition: Contains  
Value: ../..  
Action: Block  

Rule 2: Block fake Googlebot  
Match: User Agent  
Condition: Contains  
Value: Googlebot  
Test: Reverse DNS lookup mismatch  
Action: Block  

# /etc/nginx/modsec/main.conf  
Include /usr/share/modsecurity-crs/crs-setup.conf  
Include /usr/share/modsecurity-crs/rules/*.conf  

SecRuleEngine On  
SecAuditEngine RelevantOnly  
SecAuditLog /var/log/modsec_audit.log  
SecRule REQUEST_HEADERS:User-Agent "nikto" "log,deny,id:1001"  

# Nginx 调优参数  
modsecurity_transaction_id $request_id;  
modsecurity_rules_file /etc/nginx/modsec/main.conf;  

location / {  
    modsecurity on;  
    modsecurity_rules '  
        SecRuleRemoveById 949110  # 禁用特定ID规则  
        SecRule REQUEST_URI "@contains /wp-admin" "phase:1,log,auditlog,msg:'Admin access',id:5001"  
    ';  
}  

                [用户请求]  
                    │  
                    ▼  
        [Cloudflare WAF] ← 威胁情报同步  
                    │  
                    ▼  
[Nginx ModSecurity] ← 自定义规则集  
                    │  
                    ▼  
        [Wordfence 防火墙] ← 实时行为分析  
                    │  
                    ▼  
        [WordPress 核心]  

# 使用ELK收集日志  
filebeat.inputs:  
- type: log  
  paths:  
    - /var/log/nginx/access.log  
    - /var/log/modsec_audit.log  
    - /path/to/wordfence_logs  

output.elasticsearch:  
  hosts: ["localhost:9200"]  

# 使用WPScan测试防护效果  
wpscan --url https://yourdomain.com --enumerate vp --random-user-agent  

# 预期结果：  
[!] Requests to xmlrpc.php are blocked (403 Forbidden)  
[+] Firewall detected: Cloudflare (Version: 2023.11)  

GET /wp-admin/admin-ajax.php?action=test_sql_injection'%20OR%201=1--  
Host: yourdomain.com  
User-Agent: sqlmap/1.7.12  

# 预期响应：  
HTTP/1.1 403 Forbidden  
X-Firewall: Wordfence 7.11.1  

是否拥有服务器权限？  
├─ 是 → 选择服务器级防火墙（ModSecurity）  
├─ 否 → 使用云WAF（Cloudflare/Sucuri）  
是否需要深度WordPress集成？  
├─ 是 → 安装插件防火墙（Wordfence）  
├─ 否 → 选择通用WAF  
网站流量规模：  
├─ <10万PV/日 → 免费方案  
├─ >10万PV/日 → 企业级方案（AWS WAF+Cloudflare）  

✅ 启用至少两层防火墙防护  
✅ 定期更新WAF规则库（至少每周）  
✅ 监控误报率并调整规则  
✅ 关键API接口单独配置防护  
✅ 记录并分析拦截日志  
✅ 进行季度渗透测试  
✅ 配置自动IP封禁（失败登录>5次）  
✅ 启用实时威胁情报订阅