Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I have a WordPress website on a VPS running nginx. I have installed the WP Security plugin to improve the security of my site. After changing all the settings to my liking, a pop-up notifies me that I need rewrite the rules to save my changes. Part of it said "See the Better WP Security Dashboard for a list of the rewrite rules you will need." The list of rewrite rules can be found here:

# BEGIN Better WP Security
    # Begin HackRepair.com Blacklist
        if ($http_user_agent ~* "^BlackWidow"){ return 403; }
        if ($http_user_agent ~ "^Bolt"){ return 403; }
        if ($http_user_agent ~* "CazoodleBot"){ return 403; }
        if ($http_user_agent ~* "^ChinaClaw"){ return 403; }
        if ($http_user_agent ~* "^Custo"){ return 403; }
        if ($http_user_agent ~ "^Default"){ return 403; }
        if ($http_user_agent ~* "^DIIbot"){ return 403; }
        if ($http_user_agent ~* "^DISCo"){ return 403; }
        if ($http_user_agent ~* "discobot"){ return 403; }
        if ($http_user_agent ~* "^eCatch"){ return 403; }
        if ($http_user_agent ~* "ecxi"){ return 403; }
        if ($http_user_agent ~* "^EirGrabber"){ return 403; }
        if ($http_user_agent ~* "^EmailCollector"){ return 403; }
        if ($http_user_agent ~* "^EmailSiphon"){ return 403; }
        if ($http_user_agent ~* "^EmailWolf"){ return 403; }
        if ($http_user_agent ~* "^ExtractorPro"){ return 403; }
        if ($http_user_agent ~* "^EyeNetIE"){ return 403; }
        if ($http_user_agent ~* "^FlashGet"){ return 403; }
        if ($http_user_agent ~* "^GetRight"){ return 403; }
        if ($http_user_agent ~* "^GetWeb!"){ return 403; }
        if ($http_user_agent ~* "^Go!Zilla"){ return 403; }
        if ($http_user_agent ~* "^Go-Ahead-Got-It"){ return 403; }
        if ($http_user_agent ~* "^GrabNet"){ return 403; }
        if ($http_user_agent ~* "^Grafula"){ return 403; }
        if ($http_user_agent ~* "GT::WWW"){ return 403; }
        if ($http_user_agent ~* "heritrix"){ return 403; }
        if ($http_user_agent ~* "^HMView"){ return 403; }
        if ($http_user_agent ~* "HTTP::Lite"){ return 403; }
        if ($http_user_agent ~* "HTTrack"){ return 403; }
        if ($http_user_agent ~* "ia_archiver"){ return 403; }
        if ($http_user_agent ~* "IDBot"){ return 403; }
        if ($http_user_agent ~* "id-search"){ return 403; }
        if ($http_user_agent ~* "id-search.org"){ return 403; }
        if ($http_user_agent ~* "^InterGET"){ return 403; }
        if ($http_user_agent ~* "^InternetSeer.com"){ return 403; }
        if ($http_user_agent ~* "IRLbot"){ return 403; }
        if ($http_user_agent ~* "^Java"){ return 403; }
        if ($http_user_agent ~* "^JetCar"){ return 403; }
        if ($http_user_agent ~* "^larbin"){ return 403; }
        if ($http_user_agent ~* "^LeechFTP"){ return 403; }
        if ($http_user_agent ~* "libwww"){ return 403; }
        if ($http_user_agent ~* "libwww-perl"){ return 403; }
        if ($http_user_agent ~* "^Link"){ return 403; }
        if ($http_user_agent ~* "LinksManager.com_bot"){ return 403; }
        if ($http_user_agent ~* "linkwalker"){ return 403; }
        if ($http_user_agent ~* "lwp-trivial"){ return 403; }
        if ($http_user_agent ~* "^Maxthon$"){ return 403; }
        if ($http_user_agent ~* "MFC_Tear_Sample"){ return 403; }
        if ($http_user_agent ~* "^microsoft.url"){ return 403; }
        if ($http_user_agent ~ "Microsoft"){ return 403; }
        if ($http_user_agent ~* "^Mozilla.*Indy"){ return 403; }
        if ($http_user_agent ~* "^Mozilla.*NEWT"){ return 403; }
        if ($http_user_agent ~* "^MSFrontPage"){ return 403; }
        if ($http_user_agent ~* "^Navroad"){ return 403; }
        if ($http_user_agent ~* "^NearSite"){ return 403; }
        if ($http_user_agent ~* "^NetAnts"){ return 403; }
        if ($http_user_agent ~* "^NetSpider"){ return 403; }
        if ($http_user_agent ~* "^NetZIP"){ return 403; }
        if ($http_user_agent ~* "^Nutch"){ return 403; }
        if ($http_user_agent ~* "^Octopus"){ return 403; }
        if ($http_user_agent ~* "^PageGrabber"){ return 403; }
        if ($http_user_agent ~* "panscient.com"){ return 403; }
        if ($http_user_agent ~* "^pavuk"){ return 403; }
        if ($http_user_agent ~* "PECL::HTTP"){ return 403; }
        if ($http_user_agent ~* "^PeoplePal"){ return 403; }
        if ($http_user_agent ~* "^pcBrowser"){ return 403; }
        if ($http_user_agent ~* "PHPCrawl"){ return 403; }
        if ($http_user_agent ~* "PleaseCrawl"){ return 403; }
        if ($http_user_agent ~* "^psbot"){ return 403; }
        if ($http_user_agent ~* "^RealDownload"){ return 403; }
        if ($http_user_agent ~* "^ReGet"){ return 403; }
        if ($http_user_agent ~ "^Rippers"){ return 403; }
        if ($http_user_agent ~* "SBIder"){ return 403; }
        if ($http_user_agent ~* "^SeaMonkey$"){ return 403; }
        if ($http_user_agent ~* "^sitecheck.internetseer.com"){ return 403; }
        if ($http_user_agent ~* "^SiteSnagger"){ return 403; }
        if ($http_user_agent ~* "^SmartDownload"){ return 403; }
        if ($http_user_agent ~* "Snoopy"){ return 403; }
        if ($http_user_agent ~* "Steeler"){ return 403; }
        if ($http_user_agent ~* "^SuperBot"){ return 403; }
        if ($http_user_agent ~* "^SuperHTTP"){ return 403; }
        if ($http_user_agent ~* "^Surfbot"){ return 403; }
        if ($http_user_agent ~* "^tAkeOut"){ return 403; }
        if ($http_user_agent ~ "^Teleport"){ return 403; }
        if ($http_user_agent ~ "^Toata"){ return 403; }
        if ($http_user_agent ~* "URI::Fetch"){ return 403; }
        if ($http_user_agent ~* "urllib"){ return 403; }
        if ($http_user_agent ~* "User-Agent"){ return 403; }
        if ($http_user_agent ~* "^VoidEYE"){ return 403; }
        if ($http_user_agent ~* "webalta"){ return 403; }
        if ($http_user_agent ~* "^WebAuto"){ return 403; }
        if ($http_user_agent ~* "^[Ww]eb[Bb]andit"){ return 403; }
        if ($http_user_agent ~* "WebCollage"){ return 403; }
        if ($http_user_agent ~* "^WebCopier"){ return 403; }
        if ($http_user_agent ~* "^WebFetch"){ return 403; }
        if ($http_user_agent ~* "^WebLeacher"){ return 403; }
        if ($http_user_agent ~* "^WebReaper"){ return 403; }
        if ($http_user_agent ~* "^WebSauger"){ return 403; }
        if ($http_user_agent ~* "^WebStripper"){ return 403; }
        if ($http_user_agent ~* "^WebWhacker"){ return 403; }
        if ($http_user_agent ~* "^WebZIP"){ return 403; }
        if ($http_user_agent ~* "^Wget"){ return 403; }
        if ($http_user_agent ~* "^Widow"){ return 403; }
        if ($http_user_agent ~* "^WWW-Mechanize"){ return 403; }
        if ($http_user_agent ~* "^WWWOFFLE"){ return 403; }
        if ($http_user_agent ~* "zermelo"){ return 403; }
        if ($http_user_agent ~* "^Zeus"){ return 403; }
        if ($http_user_agent ~* "^Zeus.*Webster"){ return 403; }
        if ($http_user_agent ~* "ZyBorg"){ return 403; }
    # End HackRepair.com Blacklist

    location ~ /\.ht { deny all; }
    location ~ wp-config.php { deny all; }
    location ~ readme.html { deny all; }
    location ~ readme.txt { deny all; }
    location ~ /install.php { deny all; }
    set $susquery 0;
    set $rule_2 0;
    set $rule_3 0;
    rewrite ^wp-includes/(.*).php /not_found last;
    rewrite ^/wp-admin/includes(.*)$ /not_found last;
    if ($request_method ~* "^(TRACE|DELETE|TRACK)"){ return 403; }
    if ($args ~* "\.\./") { set $susquery 1; }
    if ($args ~* ".(bash|git|hg|log|svn|swp|cvs)") { set $susquery 1; }
    if ($args ~* "etc/passwd") { set $susquery 1; }
    if ($args ~* "boot.ini") { set $susquery 1; }
    if ($args ~* "ftp:") { set $susquery 1; }
    if ($args ~* "http:") { set $susquery 1; }
    if ($args ~* "https:") { set $susquery 1; }
    if ($args ~* "(<|%3C).*script.*(>|%3E)") { set $susquery 1; }
    if ($args ~* "mosConfig_[a-zA-Z_]{1,21}(=|%3D)") { set $susquery 1; }
    if ($args ~* "base64_encode") { set $susquery 1; }
    if ($args ~* "(%24&x)") { set $susquery 1; }
    if ($args ~* "(\[|\]|\(|\)|<|>|ê|\"|;|\?|\*|=$)"){ set $susquery 1; }
    if ($args ~* "(&#x22;|&#x27;|&#x3C;|&#x3E;|&#x5C;|&#x7B;|&#x7C;|%24&x)"){ set $susquery 1; }
    if ($args ~* "(127.0)") { set $susquery 1; }
    if ($args ~* "(%0|%A|%B|%C|%D|%E|%F)") { set $susquery 1; }
    if ($args ~* "(globals|encode|localhost|loopback)") { set $susquery 1; }
    if ($args ~* "(request|select|insert|concat|union|declare)") { set $susquery 1; }
    if ($http_cookie !~* "wordpress_logged_in_" ) {
        set $susquery 2$susquery;
        set $rule_2 1;
        set $rule_3 1;
    }
    if ($args !~ "^loggedout=true") { set $susquery 3$susquery; }
    if ($susquery = 4321) { return 403; }
    rewrite ^/login/?$ /wp-login.php?nw61e1jrijsnetr1xokgx redirect;
    if ($rule_2 = 1) { rewrite ^/totalaccess/?$ /wp-login.php?nw61e1jrijsnetr1xokgx&redirect_to=/wp-admin/ redirect; }
    if ($rule_2 = 0) { rewrite ^/totalaccess/?$ /wp-admin/?nw61e1jrijsnetr1xokgx redirect; }
    rewrite ^/register/?$ /wp-login.php?nw61e1jrijsnetr1xokgx&action=register redirect;
    if ($uri !~ "^(.*)admin-ajax.php") { set $rule_3 2$rule_3; }
    if ($http_referer !~* wp-admin ) { set $rule_3 3$rule_3; }
    if ($http_referer !~* wp-login.php ) { set $rule_3 4$rule_3; }
    if ($http_referer !~* login ) { set $rule_3 5$rule_3; }
    if ($http_referer !~* totalaccess ) { set $rule_3 6$rule_3; }
    if ($http_referer !~* register ) { set $rule_3 7$rule_3; }
    if ($args !~ "^action=logout") { set $rule_3 8$rule_3; }
    if ($args !~ "^nw61e1jrijsnetr1xokgx") { set $rule_3 9$rule_3; }
    if ($args !~ "^action=rp") { set $rule_3 0$rule_3; }
    if ($args !~ "^action=register") { set $rule_3 a$rule_3; }
    if ($args !~ "^action=postpass") { set $rule_3 b$rule_3; }
    if ($rule_3 = ba0987654321) {
        rewrite ^(.*/)?wp-login.php /not_found redirect;
        rewrite ^/wp-admin(.*)$ /not_found redirect;
    }
# END Better WP Security

I'm not actually sure whether the changes from the plugin have really taken effect since I have modified any file myself with these rules. I asked and did some Googling, but I could not find an answer. So I'm just wondering how I can "rewrite" this rules to make sure the security is properly in place.

share|improve this question
    
You can for example try to view the readme.html file in your browser. –  birgire Jan 4 at 11:11
    
Hello. I did take a look at the readme files, but unfortunately they did not seem to answer this question. –  DrDinosaur Jan 4 at 12:04
    
then it looks like you aren't including it correctly, if it's included then you should get a 403 Forbidden message. –  birgire Jan 4 at 17:01
add comment

1 Answer

up vote 0 down vote accepted

Please try this:

1) Save the rewrite rules to the file: /absolute/path/to/wp_security.conf.

2) Then include it in your NginX configuration file, with the line:

           include /absolute/path/to/wp_security.conf;

and place it in the server context:

server {
           #... cut ...       

           ##
           # include the Better WP Security configuration file
           ##
           include /absolute/path/to/wp_security.conf;

           location / {
                        try_files  $uri $uri/ /index.php?$args;
           }

           #... cut ...           
}

3) Remember to reload NginX:

nginx -t && service nginx reload

4) One of the things you can easily test is this part:

location ~ readme.html { deny all; }

When this rule is activated it should deny access to the readme.html file when you try to view it in a browser:

403

share|improve this answer
    
Thanks for the reply. However, I get this error: root@MainServer:/etc/nginx# nginx -t && service nginx reload nginx: [emerg] "if" directive is not allowed here in /var/www/wp-content/plugins/better-wp- security/rules.conf:3 nginx: configuration file /etc/nginx/nginx.conf test failed root@MainServer:/etc/nginx# service nginx status * nginx is running My full file can be found here: pastebin.com/iMgAXDkZ –  DrDinosaur Jan 4 at 23:02
    
You have added it in the http context, not the server context. Take a look into the /etc/nginx/sites-enabled/* files. –  birgire Jan 4 at 23:34
    
Ah, I'm pretty sure that did it. Thanks for helping a novice like me! –  DrDinosaur Jan 5 at 6:03
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.