fix: harden wordpress edge exposure

wordpress/Dockerfile

@@ -4,10 +4,12 @@ COPY php.ini /usr/local/etc/php/conf.d/azionelab.ini
 COPY .htaccess /opt/azionelab/.htaccess
 COPY entrypoint-wrapper.sh /usr/local/bin/azionelab-entrypoint
 COPY healthcheck.php /usr/local/bin/azionelab-healthcheck.php
+COPY apache-hardening.conf /etc/apache2/conf-available/azionelab-apache-hardening.conf
 COPY theme/azionelab /opt/azionelab/theme
 COPY mu-plugins/azionelab-content.php /opt/azionelab/azionelab-content.php
 
 RUN sed -ri 's!^[[:space:]]*CustomLog .*!CustomLog /dev/null combined!' /etc/apache2/sites-available/000-default.conf \
+    && a2enconf azionelab-apache-hardening \
     && chmod 755 /usr/local/bin/azionelab-entrypoint \
     && chmod 644 /usr/local/bin/azionelab-healthcheck.php \
     && chown -R www-data:www-data /opt/azionelab

wordpress/apache-hardening.conf

@@ -0,0 +1,27 @@
+ServerTokens Prod
+ServerSignature Off
+TraceEnable Off
+
+<LocationMatch "^/wp-content/(uploads|files)/.*\.php$">
+    Require all denied
+</LocationMatch>
+
+<LocationMatch "^/wp-config\.php$">
+    Require all denied
+</LocationMatch>
+
+<LocationMatch "^/wp-admin/includes/">
+    Require all denied
+</LocationMatch>
+
+<LocationMatch "^/wp-includes/[^/]+\.php$">
+    Require all denied
+</LocationMatch>
+
+<LocationMatch "^/wp-includes/js/tinymce/langs/.+\.php$">
+    Require all denied
+</LocationMatch>
+
+<LocationMatch "^/wp-includes/theme-compat/">
+    Require all denied
+</LocationMatch>