- This topic has 41 replies, 5 voices, and was last updated 4 years, 11 months ago by
.
-
Uploads Anti-Exploit Guard (UAEG)
The Uploads Anti-Exploit Guard (UAEG) protects the WordPress uploads folder from being exploited with an .htaccess file that blocks remote access or execution of file types in your uploads folder that could be used to hack your website. UAEG is automatically activated on BPS Pro installation. UAEG can be manually deactivated on the B-Core >>> Security Modes page.Note: LiteSpeed Servers do not support the Apache SetEnvIf directive. The SetEnvIf directive is ignored on LiteSpeed servers. See the LiteSpeed UAEG htaccess Whitelisting Code help section for how to whitelist folders and files if your server is a LiteSpeed server.
Note: BPS Pro Custom Code has a CUSTOM CODE UAEG text box that is used for copying the UAEG .htaccess file code from the htaccess File Editor page > “Your Current Uploads htaccess File tab” so that you can edit and customize your UAEG htaccess file to add whitelist rules (allow certain files to be accessed remotely or executed) or other customizations. See the CUSTOM CODE UAEG Whitelisting Method section below.
CUSTOM CODE UAEG Whitelisting Method
To edit/customize your Uploads Anti-Exploit Guard (UAEG) .htaccess file go to the B-Core > htaccess File Editor tab page > “Your Current Uploads htaccess File” tab and do the steps below.
1. Copy and paste your entire Uploads .htaccess file code from the “Your Current Uploads htaccess File” tab on the htaccess File Editor page into the CUSTOM CODE UAEG text box on the BPS Custom Code tab page.
2. Edit/modify/customize your UAEG htaccess code in the CUSTOM CODE UAEG text box on the BPS Custom Code tab page.
3. Click the Save UAEG Custom Code button to save your UAEG custom code.
4. Go to the Security Modes page and click the UAEG BulletProof Mode Activate button.The edit that you want to do in step #2 is this below (see other examples for whitelisting files or folders for Apache and LiteSpeed servers below):
If you have an Apache server:
To whitelist a folder: Remove/delete the # sign from infront of this line of code in your UAEG htaccess code and change the folder name to your actual folder name that you want to whitelist.
To whitelist a file: Remove/delete the # sign from infront of this line of code in your UAEG htaccess code and change the file name to your actual file name that you want to whitelist.#SetEnvIf Request_URI "example-folder/.*$" whitelist #SetEnvIf Request_URI "example-file.php$" whitelistIf you have a LiteSpeed server:
To whitelist a folder: Remove/delete the # sign from infront of this line of code in your UAEG htaccess code and change the folder name to your actual folder name that you want to whitelist.
To whitelist a file: Remove/delete the # sign from infront of this line of code in your UAEG htaccess code and change the file name to your actual file name that you want to whitelist.#RewriteRule ^example-folder/.*$ - [L] #RewriteRule ^example-file.php$ - [L]If you have an Apache server (this step is not required if you have a LiteSpeed server):
Delete the # signs in front of #Require env whitelist and #Allow from env=whitelist shown highlighted in yellow below in your UAEG code that you copied to CUSTOM CODE UAEG.# FORBID THESE FILE EXTENSIONS FROM BEING ACCESSED OR EXECUTED REMOTELY <FilesMatch "\.(7z|as|bat|bin|cgi|chm|chml|class|cmd|com|command|dat|db|db2|db3|dba|dll|DS_Store|exe|gz|hta|htaccess|htc|htm|html|htx|idc|ini|ins|isp|jar|jav|java|js|jse|jsfl|json|jsp|jsx|lib|lnk|out|php|phps|php5|php4|php3|phtml|phpt|pl|py|pyd|pyc|pyo|shtm|shtml|sql|swf|sys|tar|taz|tgz|tpl|vb|vbe|vbs|war|ws|wsf|xhtml|xml|z)$"> <IfModule mod_authz_core.c> #Require env whitelist Require all denied </IfModule> <IfModule !mod_authz_core.c> <IfModule mod_access_compat.c> Order Allow,Deny #Allow from env=whitelist Deny from all </IfModule> </IfModule> </FilesMatch>
Example: Apache UAEG htaccess Whitelisting Code using SetEnvIf for specific files or folders
How to whitelist a specific file and an entire folder: The whitelisting code below shows how to whitelist a specific example.js file in the uploads folder and how to whitelist an entire subfolder in the uploads folder: /uploads/example-folder/. Notes: Copy your entire UAEG htaccess file to BPS UAEG Custom Code and then edit your UAEG htaccess code. For complete steps see the CUSTOM CODE UAEG Whitelisting Method help section above. Don’t forget to remove/delete the # sign in front of #Require env whitelist and #Allow from env=whitelist.
# BEGIN WHITELIST # Examples of whitelisting are commented out below. To create whitelist rules you would delete the # sign in front # of the whitelist rule you want to use, add the actual filename or folder name you want to whitelist and also # delete the # sign in front of #Require env whitelist and #Allow from env=whitelist. # Whitelist a specific php file in the uploads folder: example.php SetEnvIf Request_URI "example-file.php$" whitelist # Whitelist an entire folder in the uploads folder: /uploads/example-folder/ SetEnvIf Request_URI "example-folder/.*$" whitelist # END WHITELIST
Example: LiteSpeed UAEG htaccess Whitelisting Code for specific files or folders
How to whitelist a specific file and an entire folder: The whitelisting code below shows how to whitelist a specific example.js file in the uploads folder and how to whitelist an entire folder in the uploads folder: /uploads/example-folder/. Note: Copy your entire UAEG htaccess file to BPS UAEG Custom Code and then edit your UAEG htaccess code. For complete steps see the CUSTOM CODE UAEG Whitelisting Method help section above.
# BEGIN WHITELIST # Examples of whitelisting are commented out below. To create whitelist rules you would delete the # sign in front # of the whitelist rule you want to use and add the actual filename or folder name you want to whitelist. # Whitelist a specific php file in the uploads folder: example.php RewriteRule ^example-file.php$ - [L] # Whitelist an entire folder in the uploads folder: /uploads/example-folder/ RewriteRule ^example-folder/.*$ - [L] # END WHITELIST
Alternative Method: Whitelist all files with a certain file extension by removing the file extension from the security filter
Delete the file extension in the FilesMatch code that you want to allow and click the Save UAEG Custom Code button to save your changes.
# FORBID THESE FILE EXTENSIONS FROM BEING ACCESSED OR EXECUTED REMOTELY <FilesMatch "\.(7z|as|bat|bin|cgi|chm|chml|class|cmd|com|command|dat|db|db2|db3|dba|dll|DS_Store|exe|gz|hta|htaccess|htc|htm|html|htx|idc|ini|ins|isp|jar|jav|java|jse|jsfl|json|jsp|jsx|lib|lnk|out|php|phps|php5|php4|php3|phtml|phpt|pl|py|pyd|pyc|pyo|rar|shtm|shtml|sql|swf|sys|tar|taz|tgz|tpl|vb|vbe|vbs|war|ws|wsf|xhtml|xml|z)$"> Order Deny,Allow Deny from all </FilesMatch>
Alternative Method: RewriteEngine Off .htaccess File Method (if you have several files in a subfolder in the uploads folder. Example: /wp-content/uploads/my-subfolder/)
All files in the /my-subfolder/ folder will no longer be checked or blocked by UAEG.
1. Open Notepad or Notepad++ (NOT Word or WordPad) on your computer.
2. Add this one line of text in your new Notepad text file: RewriteEngine Off.
3. Save the text file with this name: securityoff.htaccess.
4. Upload the securityoff.htaccess file to the folder/directory where you want to turn security Off/prevent the parent .htaccess file from applying its security rules/directives in this folder. In this example case the folder would be: /wp-content/uploads/my-subfolder/.
5. Rename the securityoff.htaccess file to .htaccess (removing securityoff from the file name). /wp-content/uploads/my-subfolder/.htaccessUploads Anti-Exploit Guard (UAEG) Question Mark help text
Forum Help Links:
UAEG Forum Help Link
BPS Pro Troubleshooting StepsGeneral Help Info
The Setup Wizard automatically sets up and activates all BulletProof Modes and all other BPS settings with default settings. The Setup Wizard can be re-run at any time. If you change any BPS default settings, your custom settings will not be changed/reset by re-running the Setup Wizard. The manual Security Modes option settings are for doing things like changing default settings, adding custom htaccess code to BPS Custom Code, testing and troubleshooting by deactivating (turning Off) BulletProof Modes.Uploads Anti-Exploit Guard (UAEG) is activated automatically. If your Server type does not allow the /uploads/.htaccess file to be created automatically then use these manual controls to activate BulletProof Mode for your WordPress uploads folder.
Reset UAEG htaccess File:
Clicking the Reset UAEG htaccess File button will reset your UAEG htaccess file back to the default BPS Pro UAEG htaccess file and also delete UAEG htaccess code that has been saved to BPS UAEG Custom Code. If you have made any customizations to your UAEG file either directly or in BPS UAEG Custom Code then save your UAEG htaccess code/file before clicking the Reset button. You can then add any of your saved UAEG customizations into your new default UAEG htaccess file that is created after clicking the Reset button. If UAEG is currently deactivated then the default UAEG files will be replaced, but UAEG will not be activated until you Activate UAEG BulletProof Mode again.Troubleshooting the UAEG/uploads folder htaccess file
Check your BPS Security Log file for any security log entries showing that something is being blocked in your WordPress uploads folder. If you think the /uploads/.htaccess file may be causing a problem then click the UAEG BulletProof Mode Deactivate button. This deletes the /uploads/.htaccess file. Test whatever was not working and see if the problem is still occurring. If the problem is still occurring then UAEG is not causing the problem. Activate UAEG BulletProof Mode again by clicking the UAEG BulletProof Mode Activate button.IMPORTANT NOTE:
If you Deactivate UAEG BulletProof Mode using this manual control then this also turns Off automatic creation of the /uploads/.htaccess file and you will need to use this manual control to activate UAEG BulletProof Mode again to turn automatic creation of the /uploads/.htaccess file back On again.General Info
Activating UAEG BulletProof Mode for your WordPress uploads folder copies and renames the uploads.htaccess file located in the /plugins/bulletproof-security/admin/htaccess/ folder to your /uploads folder and renames it to just .htaccess.UAEG htaccess File Custom Code Steps
1. Copy and paste your entire Uploads .htaccess file code from the “Uploads htaccess File” tab on the htaccess File Editor page into the CUSTOM CODE UAEG text box.
2. Edit/modify/customize your UAEG htaccess code in the CUSTOM CODE UAEG text box.
3. Click the Save UAEG Custom Code button to save your UAEG custom code.
4. Go to the Security Modes page and click the UAEG BulletProof Mode Activate button.
- You must be logged in to reply to this topic.