bisco/azionelab-v2
1
0
Fork 0
generated from bisco/codex-bootstrap
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: harden WordPress against WPScan findings

Browse Source
This commit is contained in:
bisco
2026-07-23 19:10:11 +02:00
parent 0762b98fc6
commit 472b8616b4
10 changed files with 74 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/security.md
+5 -3
View File
@@ -12,9 +12,11 @@
- File editing is always disabled. Production also disables web-based core, theme, and
plugin changes; patched images are rebuilt and redeployed instead.
- XML-RPC and comments are disabled. NGINX blocks PHP execution below uploads, dotfiles,
and direct `wp-config.php` requests, and rate-limits login/public requests. Apache
also denies uploaded PHP files and direct access to sensitive WordPress internals as
defense in depth. Public REST user enumeration and author archives are disabled.
direct `wp-config.php` requests, the WordPress readme/license files, direct
installation entry points, public mu-plugin directory probing, and external
`wp-cron.php` requests. It also rate-limits login/public requests. Apache also denies
uploaded PHP files and direct access to sensitive WordPress internals as defense in
depth. Public REST user enumeration and author archives are disabled.
- Security headers include CSP, same-origin framing, content-type protection, a strict
referrer policy, and a restrictive Permissions Policy. WordPress compatibility still
requires inline style/script CSP allowances; do not treat this CSP as an XSS sanitizer.