fix: harden WordPress against WPScan findings

tests/functional/tests/portal.spec.ts

@@ -121,6 +121,11 @@ test("protects the edge and exposes the WordPress admin", async ({ page, request
   expect((await request.get("/xmlrpc.php")).status()).toBe(403);
   expect((await request.get("/.env")).status()).toBe(404);
   expect((await request.get("/wp-config.php")).status()).toBe(404);
+  expect((await request.get("/readme.html")).status()).toBe(404);
+  expect((await request.get("/license.txt")).status()).toBe(404);
+  expect((await request.get("/wp-admin/install.php")).status()).toBe(404);
+  expect((await request.get("/wp-content/mu-plugins/")).status()).toBe(404);
+  expect((await request.get("/wp-cron.php")).status()).toBe(403);
   expect((await request.get("/wp-content/uploads/probe.php")).status()).toBe(403);
   expect((await request.get("/wp-json/wp/v2/users")).status()).toBe(404);
   expect((await request.get("/?post_type=azl_show&name=le-cose-che-restano")).status()).toBe(404);

tests/security/check-compose.sh

@@ -22,12 +22,37 @@ grep -q 'azionelab-apache-hardening.conf' /workspace/wordpress/Dockerfile || {
     exit 1
 }
 
+grep -q '^FROM wordpress:7\.0\.2-php8\.3-apache$' /workspace/wordpress/Dockerfile || {
+    echo "The WordPress image must use the patched 7.0.2 PHP 8.3 Apache tag." >&2
+    exit 1
+}
+
 grep -q 'wp-content/(uploads|files)' /workspace/wordpress/apache-hardening.conf || {
     echo "Apache hardening must block PHP execution below uploads/files." >&2
     exit 1
 }
 
+grep -q 'wp-content/mu-plugins' /workspace/wordpress/apache-hardening.conf || {
+    echo "Apache hardening must block direct mu-plugin probing." >&2
+    exit 1
+}
+
 grep -q "'publicly_queryable'[[:space:]]*=>[[:space:]]*false" /workspace/wordpress/mu-plugins/azionelab-content.php || {
     echo "Structured show content must not be exposed as standalone public routes." >&2
     exit 1
 }
+
+grep -q "location = /wp-cron.php" /workspace/nginx/proxy-routes.conf || {
+    echo "NGINX must block external wp-cron.php requests." >&2
+    exit 1
+}
+
+grep -q "location = /readme.html" /workspace/nginx/proxy-routes.conf || {
+    echo "NGINX must hide the WordPress readme.html file." >&2
+    exit 1
+}
+
+grep -q "location ^~ /wp-content/mu-plugins/" /workspace/nginx/proxy-routes.conf || {
+    echo "NGINX must hide the mu-plugins directory from public probing." >&2
+    exit 1
+}