Last active
May 22, 2019 07:10
-
-
Save petskratt/17fdb56c75800fc38797a7c5bd1d1127 to your computer and use it in GitHub Desktop.
Perishable Press 6G firewall with slight modifications (archive.org bot enabled, no IP blocking part)
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
# 6G FIREWALL/BLACKLIST | |
# @ https://perishablepress.com/6g/ | |
# 6G:[QUERY STRINGS] | |
<IfModule mod_rewrite.c> | |
RewriteEngine On | |
RewriteCond %{QUERY_STRING} (eval\() [NC,OR] | |
RewriteCond %{QUERY_STRING} (127\.0\.0\.1) [NC,OR] | |
RewriteCond %{QUERY_STRING} ([a-z0-9]{2000}) [NC,OR] | |
RewriteCond %{QUERY_STRING} (javascript:)(.*)(;) [NC,OR] | |
RewriteCond %{QUERY_STRING} (base64_encode)(.*)(\() [NC,OR] | |
RewriteCond %{QUERY_STRING} (GLOBALS|REQUEST)(=|\[|%) [NC,OR] | |
RewriteCond %{QUERY_STRING} (<|%3C)(.*)script(.*)(>|%3) [NC,OR] | |
RewriteCond %{QUERY_STRING} (\\|\.\.\.|\.\./|~|`|<|>|\|) [NC,OR] | |
RewriteCond %{QUERY_STRING} (boot\.ini|etc/passwd|self/environ) [NC,OR] | |
RewriteCond %{QUERY_STRING} (thumbs?(_editor|open)?|tim(thumb)?)\.php [NC,OR] | |
RewriteCond %{QUERY_STRING} (\'|\")(.*)(drop|insert|md5|select|union) [NC] | |
RewriteRule .* - [F] | |
</IfModule> | |
# 6G:[REQUEST METHOD] | |
<IfModule mod_rewrite.c> | |
RewriteCond %{REQUEST_METHOD} ^(connect|debug|delete|move|put|trace|track) [NC] | |
RewriteRule .* - [F] | |
</IfModule> | |
# 6G:[REFERRERS] | |
<IfModule mod_rewrite.c> | |
RewriteCond %{HTTP_REFERER} ([a-z0-9]{2000}) [NC,OR] | |
RewriteCond %{HTTP_REFERER} (semalt.com|todaperfeita) [NC] | |
RewriteRule .* - [F] | |
</IfModule> | |
# 6G:[REQUEST STRINGS] | |
<IfModule mod_alias.c> | |
RedirectMatch 403 (?i)([a-z0-9]{2000}) | |
RedirectMatch 403 (?i)(https?|ftp|php):/ | |
RedirectMatch 403 (?i)(base64_encode)(.*)(\() | |
RedirectMatch 403 (?i)(=\\\'|=\\%27|/\\\'/?)\. | |
RedirectMatch 403 (?i)/(\$(\&)?|\*|\"|\.|,|&|&?)/?$ | |
RedirectMatch 403 (?i)(\{0\}|\(/\(|\.\.\.|\+\+\+|\\\"\\\") | |
RedirectMatch 403 (?i)(~|`|<|>|:|;|,|%|\\|\s|\{|\}|\[|\]|\|) | |
RedirectMatch 403 (?i)/(=|\$&|_mm|cgi-|etc/passwd|muieblack) | |
RedirectMatch 403 (?i)(&pws=0|_vti_|\(null\)|\{\$itemURL\}|echo(.*)kae|etc/passwd|eval\(|self/environ) | |
RedirectMatch 403 (?i)\.(aspx?|bash|bak?|cfg|cgi|dll|exe|git|hg|ini|jsp|log|mdb|out|sql|svn|swp|tar|rar|rdf)$ | |
RedirectMatch 403 (?i)/(^$|(wp-)?config|mobiquo|phpinfo|shell|sqlpatch|thumb|thumb_editor|thumbopen|timthumb|webshell)\.php | |
</IfModule> | |
# 6G:[USER AGENTS] | |
<IfModule mod_setenvif.c> | |
SetEnvIfNoCase User-Agent ([a-z0-9]{2000}) bad_bot | |
SetEnvIfNoCase User-Agent (binlar|casper|checkpriv|choppy|clshttp|cmsworld|diavol|dotbot|extract|feedfinder|flicky|g00g1e|harvest|httrack|kmccrew|loader|miner|nikto|nutch|planetwork|postrank|purebot|pycurl|python|seekerspider|siclab|skygrid|sqlmap|sucker|turnit|vikspider|winhttp|xxxyy|youda|zmeu|zune) bad_bot | |
# Apache < 2.3 | |
<IfModule !mod_authz_core.c> | |
Order Allow,Deny | |
Allow from all | |
Deny from env=bad_bot | |
</IfModule> | |
# Apache >= 2.3 | |
<IfModule mod_authz_core.c> | |
<RequireAll> | |
Require all Granted | |
Require not env bad_bot | |
</RequireAll> | |
</IfModule> | |
</IfModule> | |
# 6G:[CUSTOM] | |
<IfModule mod_alias.c> | |
RedirectMatch 403 (?i)/(readme\.html|readme\.txt|readme\.md|license\.txt) | |
RedirectMatch 403 (?i)debug.log | |
</IfModule> | |
# 6G END |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
# disable code execution in folder and subfolders | |
# fit for wp-content/uploads and also full wp-content if plugins/themes well written | |
# extensions list for zone.ee (Apache 2.4 version) | |
Options -ExecCGI | |
RemoveType .php .php3 .phtml .inc | |
RemoveHandler .php .php3 .phtml .inc | |
<FilesMatch "\.(?i:php|php3|phtml|inc)($|\.)"> | |
Require all denied | |
</FilesMatch> | |
<IfModule mod_php7.c> | |
php_flag engine off | |
</IfModule> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
# disable code execution in wp-includes | |
# extensions list for zone.ee (Apache 2.4 version) | |
Options -ExecCGI | |
RemoveType .php3 .phtml .inc | |
RemoveHandler .php3 .phtml .inc | |
<FilesMatch "\.(?i:php|php3|phtml|inc)($|\.)"> | |
Require all denied | |
</FilesMatch> | |
<Files wp-tinymce.php> | |
Require all granted | |
</Files> | |
<Files ms-files.php> | |
Require all granted | |
</Files> |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
I humbly suggest adding an info about [QUERY STRINGS] section, that should be excluded from main .htaccess and added into /wp-folder/ .htaccess if WordPress is installed in a "/wp-folder/" subfolder (info from Perishable Press). Just my 2 cents. Keep up the good work !!