1+
2+ server {
3+ listen 80;
4+ listen [::]:80;
5+
6+ server_name my.site www.my.site;
7+
8+ return 301 https://$host$request_uri;
9+ }
10+
11+ server {
12+ listen 443 http2 ssl;
13+ listen [::]:443 http2 ssl;
14+
15+ root /var/www/my.site;
16+
17+ index index.html index.htm index.php;
18+
19+ server_name my.site www.my.site;
20+
21+ client_max_body_size 500M;
22+
23+ ssl_certificate /etc/nginx/ssl/my.site.pem;
24+ ssl_certificate_key /etc/nginx/ssl/my.site.key;
25+
26+ error_log /var/log/nginx/my.site_error.log;
27+ access_log /var/log/nginx/my.site_access.log;
28+
29+ #Deny access to wp-content folders for suspicious files
30+ location ~* ^/(wp-content)/(.*?)\.(zip|gz|tar|bzip2|7z)$ {
31+ deny all;
32+ }
33+
34+ location ~ ^/wp-content/uploads/sucuri {
35+ deny all;
36+ }
37+
38+ location ~ ^/wp-content/updraft {
39+ deny all;
40+ }
41+
42+ #Disable execution of scripts other than PHP from your document root
43+ location ~* .(pl|cgi|py|sh|lua|asp)$ {
44+ return 404;
45+ }
46+
47+ #Disable access to your configuration files and other files that you don’t want to users are able to see
48+ location ~* /(wp-config.php|readme.html|license.txt|nginx.conf) {
49+ deny all;
50+ }
51+
52+ # Disable wp-config.txt
53+ location = /wp-config.txt {
54+ deny all;
55+ access_log off;
56+ log_not_found off;
57+ }
58+
59+ # nginx block xmlrpc.php requests
60+ location = /xmlrpc.php {
61+ deny all;
62+ access_log off;
63+ log_not_found off;
64+ return 404;
65+ }
66+
67+ # nginx block wpscann on plugins folder
68+ location ~* ^/wp-content/(?:plugins|themes)/.+\.(txt|log|md)$ {
69+ deny all;
70+ error_page 403 =404 / ;
71+ }
72+
73+ # block access to install.php and upgrade.php
74+ location ^~ /wp-admin/(install.php|upgrade.php) {
75+ deny all;
76+ error_page 403 =404 / ;
77+ }
78+
79+ #This module will allow us to pattern match certain key files and inject random text in the files that
80+ # is non-destructive / non-invasive and will most importantly alter the md5sum calculated on such files. All transparent to WPScan.
81+ location ~* ^/(license.txt|wp-includes/(.*)/.+\.(js|css)|wp-admin/(.*)/.+\.(js|css))$ {
82+ sub_filter_types text/css text/javascript text/plain;
83+ sub_filter_once on;
84+ sub_filter ';' '; /* $msec */ ';
85+ }
86+
87+ #Direct PHP File Access
88+ #If somehow, a hacker successfully sneaks in a PHP file onto your site,
89+ #they’ll be able to run this file by loading file which effectively becomes a backdoor to infiltrate your site.
90+ #We should disable direct access to any PHP files by adding the following rules:
91+ location ~* /(?:uploads|files|wp-content|wp-includes|akismet)/.*.php$ {
92+ deny all;
93+ access_log off;
94+ log_not_found off;
95+ }
96+
97+ #Dotfiles
98+ #Similar to PHP file, a dotfile like .htaccess, .user.ini, and .git may contain sensitive information.
99+ #To be on the safer side, it’s better to disable direct access to these files.
100+ location ~ /\.(svn|git)/* {
101+ deny all;
102+ access_log off;
103+ log_not_found off;
104+ }
105+
106+ location ~ /\.ht {
107+ deny all;
108+ access_log off;
109+ log_not_found off;
110+ }
111+
112+ location ~ /\.user.ini {
113+ deny all;
114+ access_log off;
115+ log_not_found off;
116+ }
117+
118+ # Deny backup extensions & log files
119+ location ~* ^.+\.(bak|log|old|orig|original|php#|php~|php_bak|save|swo|swp|sql)$ {
120+ deny all;
121+ access_log off;
122+ log_not_found off;
123+ }
124+
125+ # common nginx configuration to block sql injection and other attacks
126+ location ~* "(eval\()" {
127+ deny all;
128+ }
129+
130+ location ~* "(127\.0\.0\.1)" {
131+ deny all;
132+ }
133+
134+ location ~* "([a-z0-9]{2000})" {
135+ deny all;
136+ }
137+
138+ location ~* "(javascript\:)(.*)(\;)" {
139+ deny all;
140+ }
141+
142+ location ~* "(base64_encode)(.*)(\()" {
143+ deny all;
144+ }
145+
146+ location ~* "(GLOBALS|REQUEST)(=|\[|%)" {
147+ deny all;
148+ }
149+
150+ location ~* "(<|%3C).*script.*(>|%3)" {
151+ deny all;
152+ }
153+
154+ location ~ "(\|\.\.\.|\.\./|~|\`|<|>|\|)" {
155+ deny all;
156+ }
157+
158+ location ~* "(boot\.ini|etc/passwd|self/environ)" {
159+ deny all;
160+ }
161+
162+ location ~* "(thumbs?(_editor|open)?|tim(thumb)?)\.php" {
163+ deny all;
164+ }
165+
166+ location ~* "(\'|\")(.*)(drop|insert|md5|select|union)" {
167+ deny all;
168+ }
169+
170+ location ~* "(https?|ftp|php):/" {
171+ deny all;
172+ }
173+
174+ location ~* "(=\\'|=\%27|/\\'/?)\." {
175+ deny all;
176+ }
177+
178+ location ~ "(\{0\}|\(/\(|\.\.\.|\+\+\+|\"\")" {
179+ deny all;
180+ }
181+
182+ location ~ "(~|\`|<|>|:|;|%|\|\s|\{|\}|\[|\]|\|)" {
183+ deny all;
184+ }
185+
186+ location ~* "/(=|$&|_mm|(wp-)?config\.|cgi-|etc/passwd|muieblack)" {
187+ deny all;
188+ }
189+
190+ location ~* "(&pws=0|_vti_|\(null\)|\{$itemURL\}|echo(.*)kae|etc/passwd|eval\(|self/environ)" {
191+ deny all;
192+ }
193+
194+ location ~* "/(^$|mobiquo|phpinfo|shell|sqlpatch|thumb|thumb_editor|thumbopen|timthumb|webshell|config|settings|configuration)\.php" {
195+ deny all;
196+ }
197+
198+ location / {
199+ try_files $uri $uri/ /index.php?$args;
200+ }
201+
202+ location ~ \.php$ {
203+ include snippets/fastcgi-php.conf;
204+ fastcgi_pass unix:/var/run/php/php8.1-fpm-my_site.sock;
205+ }
206+ }
0 commit comments