Root and wp-admin htaccess File Significant Changes

Home Forums BulletProof Security Pro Root and wp-admin htaccess File Significant Changes

This topic contains 8 replies, has 2 voices, and was last updated by  popljubo 2 years, 4 months ago.

Viewing 9 posts - 1 through 9 (of 9 total)
  • Author
    Posts
  • #18743

    AITpro Admin
    Keymaster

    Significant Root htaccess file changes in BPS Pro 11.6+ and BPS .53.2+

    Depending on your web host the BPS Root htaccess file Request Methods Filtered code will be either one of the example code blocks below. Either block of code does the exact same thing and the whitelisting method to allow HEAD Request is exactly the same: You would comment out the last 2 lines of either block of code with a # sign as shown below, copy the modified code to this BPS Custom Code text box:  CUSTOM CODE REQUEST METHODS FILTERED, save your code, go to the BPS Security Modes page and click the Root Folder BulletProof Mode Activate button.

    # REQUEST METHODS FILTERED
    # If you want to allow HEAD Requests use BPS Custom Code and copy 
    # this entire REQUEST METHODS FILTERED section of code to this BPS Custom Code 
    # text box: CUSTOM CODE REQUEST METHODS FILTERED.
    # See the CUSTOM CODE REQUEST METHODS FILTERED help text for additional steps.
    RewriteCond %{REQUEST_METHOD} ^(TRACE|DELETE|TRACK|DEBUG) [NC]
    RewriteRule ^(.*)$ - [F]
    #RewriteCond %{REQUEST_METHOD} ^(HEAD) [NC]
    #RewriteRule ^(.*)$ /wp-content/plugins/bulletproof-security/405.php [L]

    Or you may see this REQUEST METHODS FILTERED code:

    # REQUEST METHODS FILTERED
    # If you want to allow HEAD Requests use BPS Custom Code and copy
    # this entire REQUEST METHODS FILTERED section of code to this BPS Custom Code
    # text box: CUSTOM CODE REQUEST METHODS FILTERED.
    # See the CUSTOM CODE REQUEST METHODS FILTERED help text for additional steps.
    RewriteCond %{REQUEST_METHOD} ^(TRACE|DELETE|TRACK|DEBUG) [NC]
    RewriteRule ^(.*)$ - [F]
    #RewriteCond %{REQUEST_METHOD} ^(HEAD) [NC]
    #RewriteRule ^(.*)$ - [R=405,L]

    Significant Root htaccess file changes in BPS Pro 11.5+ and BPS .53.1+

    The ERROR LOGGING AND TRACKING and REQUEST METHODS FILTERED blocks of Root htaccess code have been changed significantly.

    # BPS PRO ERROR LOGGING AND TRACKING
    # Use BPS Custom Code to modify/edit/change this code and to save it permanently.
    # BPS Pro has premade 400 Bad Request, 403 Forbidden, 404 Not Found, 405 Method Not Allowed and
    # 410 Gone template logging files that are used to track and log 400, 403, 404, 405 and 410 errors
    # that occur on your website. When a hacker attempts to hack your website the hackers IP address,
    # Host name, Request Method, Referering link, the file name or requested resource, the user agent
    # of the hacker and the query string used in the hack attempt are logged.
    # All BPS Pro log files are htaccess protected so that only you can view them.
    # The 400.php, 403.php, 404.php, 405.php and 410.php files are located in /wp-content/plugins/bulletproof-security/
    # The 400, 403, 405 and 410 Error logging files are already set up and will automatically start logging errors
    # after you install BPS Pro and have activated BulletProof Mode for your Root folder.
    # If you would like to log 404 errors you will need to copy the logging code in the BPS Pro 404.php file
    # to your Theme's 404.php template file. Simple instructions are included in the BPS Pro 404.php file.
    # You can open the BPS Pro 404.php file using the WP Plugins Editor or by using the BPS Pro File Manager.
    # NOTE: By default WordPress automatically looks in your Theme's folder for a 404.php Theme template file.
    
    ErrorDocument 400 /wp-content/plugins/bulletproof-security/400.php
    ErrorDocument 401 default
    ErrorDocument 403 /wp-content/plugins/bulletproof-security/403.php
    ErrorDocument 404 /404.php
    ErrorDocument 405 /wp-content/plugins/bulletproof-security/405.php
    ErrorDocument 410 /wp-content/plugins/bulletproof-security/410.php
    
    # REQUEST METHODS FILTERED
    # If you want to allow HEAD Requests use BPS Custom Code and copy
    # this entire REQUEST METHODS FILTERED section of code to this BPS Custom Code
    # text box: CUSTOM CODE REQUEST METHODS FILTERED.
    # See the CUSTOM CODE REQUEST METHODS FILTERED help text for additional steps.
    RewriteCond %{REQUEST_METHOD} ^(TRACE|DELETE|TRACK|DEBUG) [NC]
    RewriteRule ^(.*)$ - [F]
    RewriteCond %{REQUEST_METHOD} ^(HEAD) [NC]
    RewriteRule ^(.*)$ - [R=405,L]

    Significant Root htaccess file changes in BPS Pro 11+ and BPS .52.5+

    BPS automatically checks which Apache Modules are loaded on your server: mod_access_compat, mod_authz_core and mod_authz_host and checks availability|forward|backward compatibility and also IfModule conditions support to automatically create the correct htaccess code and files for your website|server.

    Affects the DENY BROWSER ACCESS TO THESE FILES block of Root htaccess code and BPS internal Core protection htaccess files.  Either mod_authz_core compatible htaccess code or mod_access_compat htaccess code will be automatically created depending on your server/modules/etc.

    mod_authz_core htaccess code:

    <FilesMatch "^(wp-config\.php|php\.ini|php5\.ini|readme\.html|bb-config\.php)">
    <IfModule mod_authz_core.c>
    Require all denied
    #Require ip 127.0.0.1
    </IfModule>
    
    <IfModule !mod_authz_core.c>
    <IfModule mod_access_compat.c>
    Order Allow,Deny
    Deny from all
    #Allow from 127.0.0.1
    </IfModule>
    </IfModule>
    </FilesMatch>

    mod_access_compat htaccess code

    <FilesMatch \"^(wp-config\.php|php\.ini|php5\.ini|readme\.html|bb-config\.php)\">
    Order Allow,Deny
    Deny from all
    #Allow from 127.0.0.1
    </FilesMatch>

    Significant Root and wp-admin htaccess file changes in BPS Pro 9.8+ and BPS .51.2+

    Significant Difference in Visual Appearance: The visual appearance/format/structure of the root and wp-admin htaccess files is significantly different. This is probably the most important reason to notify folks about the significant changes to the BPS htaccess files to avoid confusion or concern about the new significant changes made in these files.

    Personal Customizations to Help Text: Hypothetically if someone has created their own personal customizations or added additional help text in the htaccess files then doing a typical automatic string replacement in the htaccess files could in theory delete or remove personal customizations. This is probably the second most important reason to notify folks about the significant changes to the BPS htaccess files instead of just doing the normal/typical automatic update of the BPS htaccess files.

    Most Important changes/fixes/improvements to the BPS root and wp-admin htaccess files:

    Important root htaccess file/code fix: Removal of additional instances of “BEGIN WordPress” and “END WordPress” text from the root htaccess file which caused multiple instances of the default wp htaccess code to be created in the root htaccess file when the WP flush_rewrite_rules function was executed by other plugins and themes.

    htaccess help text improvement overall: The help text throughout both the root and wp-admin htaccess files was very dated and was in need of updating. Better/clearer examples have been created in the help text. Overall the htaccess files are more streamlined and less cluttered looking visually.

    Structure/Order Code Changes:  Several blocks of htaccess code has been structured differently as far as the general order/sequence of code goes in the root htaccess file and more importantly what code will remain in the root htaccess file in the event that the WP flush_rewrite_rules function is executed by another plugin or theme.  There are several technical reasons for making these structure/order changes, which I will not bore you with.  Basically things are structured/ordered much better for any/every possible scenario that may occur.

    Note: This is a one-time BPS Update that requires manual steps to be performed. All future versions of BPS will do the normal/typical automatic update of the BPS htaccess files. Overall we felt that creating a Notice about these significant changes vs just doing a normal automatic update was the best route to take for the primary reasons stated above and some additional reasons not stated here.

    Root htaccess File

    # BULLETPROOF PRO 9.8 SECURE .HTACCESS
    
    # PHP/PHP.INI HANDLER/CACHE CODE
    # Use BPS Custom Code to add php/php.ini Handler and Cache htaccess code and to save it permanently.
    # Most Hosts do not have/use/require php/php.ini Handler htaccess code
    
    # TURN OFF YOUR SERVER SIGNATURE
    # Suppresses the footer line server version number and ServerName of the serving virtual host
    ServerSignature Off
    
    # DO NOT SHOW DIRECTORY LISTING
    # Disallow mod_autoindex from displaying a directory listing
    # If a 500 Internal Server Error occurs when activating Root BulletProof Mode
    # copy the entire DO NOT SHOW DIRECTORY LISTING and DIRECTORY INDEX sections of code
    # and paste it into BPS Custom Code and comment out Options -Indexes
    # by adding a # sign in front of it.
    # Example: #Options -Indexes
    Options -Indexes
    
    # DIRECTORY INDEX FORCE INDEX.PHP
    # Use index.php as default directory index file. index.html will be ignored.
    # If a 500 Internal Server Error occurs when activating Root BulletProof Mode
    # copy the entire DO NOT SHOW DIRECTORY LISTING and DIRECTORY INDEX sections of code
    # and paste it into BPS Custom Code and comment out DirectoryIndex
    # by adding a # sign in front of it.
    # Example: #DirectoryIndex index.php index.html /index.php
    DirectoryIndex index.php index.html /index.php
    
    # BRUTE FORCE LOGIN PAGE PROTECTION
    # PLACEHOLDER ONLY
    # Use BPS Custom Code to add Brute Force Login protection code and to save it permanently.
    # See this link: http://forum.ait-pro.com/forums/topic/protect-login-page-from-brute-force-login-attacks/
    # for more information.
    
    # BPS PRO ERROR LOGGING AND TRACKING
    # Use BPS Custom Code to modify/edit/change this code and to save it permanently.
    # BPS Pro has premade 403 Forbidden, 400 Bad Request and 404 Not Found files that are used
    # to track and log 403, 400 and 404 errors that occur on your website. When a hacker attempts to
    # hack your website the hackers IP address, Host name, Request Method, Referering link, the file name or
    # requested resource, the user agent of the hacker and the query string used in the hack attempt are logged.
    # All BPS Pro log files are htaccess protected so that only you can view them.
    # The 400.php, 403.php and 404.php files are located in /wp-content/plugins/bulletproof-security/
    # The 400 and 403 Error logging files are already set up and will automatically start logging errors
    # after you install BPS Pro and have activated BulletProof Mode for your Root folder.
    # If you would like to log 404 errors you will need to copy the logging code in the BPS Pro 404.php file
    # to your Theme's 404.php template file. Simple instructions are included in the BPS Pro 404.php file.
    # You can open the BPS Pro 404.php file using the WP Plugins Editor or by using the BPS Pro File Manager.
    # NOTE: By default WordPress automatically looks in your Theme's folder for a 404.php Theme template file.
    
    ErrorDocument 400 /wp-content/plugins/bulletproof-security/400.php
    ErrorDocument 401 default
    ErrorDocument 403 /wp-content/plugins/bulletproof-security/403.php
    ErrorDocument 404 /404.php
    
    # DENY ACCESS TO PROTECTED SERVER FILES AND FOLDERS
    # Use BPS Custom Code to modify/edit/change this code and to save it permanently.
    # Files and folders starting with a dot: .htaccess, .htpasswd, .errordocs, .logs
    RedirectMatch 403 \.(htaccess|htpasswd|errordocs|logs)$
    
    # WP-ADMIN/INCLUDES
    # Use BPS Custom Code to remove this code permanently.
    RewriteEngine On
    RewriteBase /
    RewriteRule ^wp-admin/includes/ - [F]
    RewriteRule !^wp-includes/ - [S=3]
    RewriteRule ^wp-includes/[^/]+\.php$ - [F]
    RewriteRule ^wp-includes/js/tinymce/langs/.+\.php - [F]
    RewriteRule ^wp-includes/theme-compat/ - [F]
    
    # WP REWRITE LOOP START
    RewriteEngine On
    RewriteBase /
    RewriteRule ^index\.php$ - [L]
    
    # REQUEST METHODS FILTERED
    # If you want to allow HEAD Requests use BPS Custom Code and
    # remove/delete HEAD| from the Request Method filter.
    # Example: RewriteCond %{REQUEST_METHOD} ^(TRACE|DELETE|TRACK|DEBUG) [NC]
    # The TRACE, DELETE, TRACK and DEBUG Request methods should never be removed.
    RewriteCond %{REQUEST_METHOD} ^(HEAD|TRACE|DELETE|TRACK|DEBUG) [NC]
    RewriteRule ^(.*)$ - [F]
    
    # PLUGINS/THEMES AND VARIOUS EXPLOIT FILTER SKIP RULES
    # To add plugin/theme skip/bypass rules use BPS Custom Code.
    # The [S] flag is used to skip following rules. Skip rule [S=12] will skip 12 following RewriteRules.
    # The skip rules MUST be in descending consecutive number order: 12, 11, 10, 9...
    # If you delete a skip rule, change the other skip rule numbers accordingly.
    # Examples: If RewriteRule [S=5] is deleted than change [S=6] to [S=5], [S=7] to [S=6], etc.
    # If you add a new skip rule above skip rule 12 it will be skip rule 13: [S=13]
    
    # Adminer MySQL management tool data populate
    RewriteCond %{REQUEST_URI} ^/wp-content/plugins/adminer/ [NC]
    RewriteRule . - [S=12]
    # Comment Spam Pack MU Plugin - CAPTCHA images not displaying
    RewriteCond %{REQUEST_URI} ^/wp-content/mu-plugins/custom-anti-spam/ [NC]
    RewriteRule . - [S=11]
    # Peters Custom Anti-Spam display CAPTCHA Image
    RewriteCond %{REQUEST_URI} ^/wp-content/plugins/peters-custom-anti-spam-image/ [NC]
    RewriteRule . - [S=10]
    # Status Updater plugin fb connect
    RewriteCond %{REQUEST_URI} ^/wp-content/plugins/fb-status-updater/ [NC]
    RewriteRule . - [S=9]
    # Stream Video Player - Adding FLV Videos Blocked
    RewriteCond %{REQUEST_URI} ^/wp-content/plugins/stream-video-player/ [NC]
    RewriteRule . - [S=8]
    # XCloner 404 or 403 error when updating settings
    RewriteCond %{REQUEST_URI} ^/wp-content/plugins/xcloner-backup-and-restore/ [NC]
    RewriteRule . - [S=7]
    # BuddyPress Logout Redirect
    RewriteCond %{QUERY_STRING} action=logout&redirect_to=http%3A%2F%2F(.*) [NC]
    RewriteRule . - [S=6]
    # redirect_to=
    RewriteCond %{QUERY_STRING} redirect_to=(.*) [NC]
    RewriteRule . - [S=5]
    # Login Plugins Password Reset And Redirect 1
    RewriteCond %{QUERY_STRING} action=resetpass&key=(.*) [NC]
    RewriteRule . - [S=4]
    # Login Plugins Password Reset And Redirect 2
    RewriteCond %{QUERY_STRING} action=rp&key=(.*) [NC]
    RewriteRule . - [S=3]
    
    # TIMTHUMB FORBID RFI and MISC FILE SKIP/BYPASS RULE
    # Use BPS Custom Code to modify/edit/change this code and to save it permanently.
    # Remote File Inclusion (RFI) security rules
    # Note: Only whitelist your additional domains or files if needed - do not whitelist hacker domains or files
    RewriteCond %{QUERY_STRING} ^.*(http|https|ftp)(%3A|:)(%2F|/)(%2F|/)(w){0,3}.?(blogger|picasa|blogspot|tsunami|petapolitik|photobucket|imgur|imageshack|wordpress\.com|img\.youtube|tinypic\.com|upload\.wikimedia|kkc|start-thegame).*$ [NC,OR]
    RewriteCond %{THE_REQUEST} ^.*(http|https|ftp)(%3A|:)(%2F|/)(%2F|/)(w){0,3}.?(blogger|picasa|blogspot|tsunami|petapolitik|photobucket|imgur|imageshack|wordpress\.com|img\.youtube|tinypic\.com|upload\.wikimedia|kkc|start-thegame).*$ [NC]
    RewriteRule .* index.php [F]
    #
    # Example: Whitelist additional misc files: (example\.php|another-file\.php|phpthumb\.php|thumb\.php|thumbs\.php)
    RewriteCond %{REQUEST_URI} (timthumb\.php|phpthumb\.php|thumb\.php|thumbs\.php) [NC]
    # Example: Whitelist additional website domains: RewriteCond %{HTTP_REFERER} ^.*(YourWebsite.com|AnotherWebsite.com).*
    RewriteCond %{HTTP_REFERER} ^.*aitpro.local.*
    RewriteRule . - [S=1]
    
    # BEGIN BPSQSE BPS QUERY STRING EXPLOITS
    # The libwww-perl User Agent is forbidden - Many bad bots use libwww-perl modules, but some good bots use it too.
    # Good sites such as W3C use it for their W3C-LinkChecker.
    # Use BPS Custom Code to add or remove user agents temporarily or permanently from the
    # User Agent filters directly below or to modify/edit/change any of the other security code rules below.
    RewriteCond %{HTTP_USER_AGENT} (havij|libwww-perl|wget|python|nikto|curl|scan|java|winhttp|clshttp|loader) [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} (%0A|%0D|%27|%3C|%3E|%00) [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} (;|<|>|'|"|\)|\(|%0A|%0D|%22|%27|%28|%3C|%3E|%00).*(libwww-perl|wget|python|nikto|curl|scan|java|winhttp|HTTrack|clshttp|archiver|loader|email|harvest|extract|grab|miner) [NC,OR]
    RewriteCond %{THE_REQUEST} (\?|\*|%2a)+(%20+|\\s+|%20+\\s+|\\s+%20+|\\s+%20+\\s+)HTTP(:/|/) [NC,OR]
    RewriteCond %{THE_REQUEST} etc/passwd [NC,OR]
    RewriteCond %{THE_REQUEST} cgi-bin [NC,OR]
    RewriteCond %{THE_REQUEST} (%0A|%0D|\\r|\\n) [NC,OR]
    RewriteCond %{REQUEST_URI} owssvr\.dll [NC,OR]
    RewriteCond %{HTTP_REFERER} (%0A|%0D|%27|%3C|%3E|%00) [NC,OR]
    RewriteCond %{HTTP_REFERER} \.opendirviewer\. [NC,OR]
    RewriteCond %{HTTP_REFERER} users\.skynet\.be.* [NC,OR]
    RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=http:// [NC,OR]
    RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=(\.\.//?)+ [NC,OR]
    RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=/([a-z0-9_.]//?)+ [NC,OR]
    RewriteCond %{QUERY_STRING} \=PHP[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12} [NC,OR]
    RewriteCond %{QUERY_STRING} (\.\./|%2e%2e%2f|%2e%2e/|\.\.%2f|%2e\.%2f|%2e\./|\.%2e%2f|\.%2e/) [NC,OR]
    RewriteCond %{QUERY_STRING} ftp\: [NC,OR]
    RewriteCond %{QUERY_STRING} http\: [NC,OR]
    RewriteCond %{QUERY_STRING} https\: [NC,OR]
    RewriteCond %{QUERY_STRING} \=\|w\| [NC,OR]
    RewriteCond %{QUERY_STRING} ^(.*)/self/(.*)$ [NC,OR]
    RewriteCond %{QUERY_STRING} ^(.*)cPath=http://(.*)$ [NC,OR]
    RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
    RewriteCond %{QUERY_STRING} (<|%3C)([^s]*s)+cript.*(>|%3E) [NC,OR]
    RewriteCond %{QUERY_STRING} (\<|%3C).*embed.*(\>|%3E) [NC,OR]
    RewriteCond %{QUERY_STRING} (<|%3C)([^e]*e)+mbed.*(>|%3E) [NC,OR]
    RewriteCond %{QUERY_STRING} (\<|%3C).*object.*(\>|%3E) [NC,OR]
    RewriteCond %{QUERY_STRING} (<|%3C)([^o]*o)+bject.*(>|%3E) [NC,OR]
    RewriteCond %{QUERY_STRING} (\<|%3C).*iframe.*(\>|%3E) [NC,OR]
    RewriteCond %{QUERY_STRING} (<|%3C)([^i]*i)+frame.*(>|%3E) [NC,OR]
    RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [NC,OR]
    RewriteCond %{QUERY_STRING} base64_(en|de)code[^(]*\([^)]*\) [NC,OR]
    RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
    RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2}) [OR]
    RewriteCond %{QUERY_STRING} ^.*(\(|\)|<|>|%3c|%3e).* [NC,OR]
    RewriteCond %{QUERY_STRING} ^.*(\x00|\x04|\x08|\x0d|\x1b|\x20|\x3c|\x3e|\x7f).* [NC,OR]
    RewriteCond %{QUERY_STRING} (NULL|OUTFILE|LOAD_FILE) [OR]
    RewriteCond %{QUERY_STRING} (\.{1,}/)+(motd|etc|bin) [NC,OR]
    RewriteCond %{QUERY_STRING} (localhost|loopback|127\.0\.0\.1) [NC,OR]
    RewriteCond %{QUERY_STRING} (<|>|'|%0A|%0D|%27|%3C|%3E|%00) [NC,OR]
    RewriteCond %{QUERY_STRING} concat[^\(]*\( [NC,OR]
    RewriteCond %{QUERY_STRING} union([^s]*s)+elect [NC,OR]
    RewriteCond %{QUERY_STRING} union([^a]*a)+ll([^s]*s)+elect [NC,OR]
    RewriteCond %{QUERY_STRING} \-[sdcr].*(allow_url_include|allow_url_fopen|safe_mode|disable_functions|auto_prepend_file) [NC,OR]
    RewriteCond %{QUERY_STRING} (;|<|>|'|"|\)|%0A|%0D|%22|%27|%3C|%3E|%00).*(/\*|union|select|insert|drop|delete|update|cast|create|char|convert|alter|declare|order|script|set|md5|benchmark|encode) [NC,OR]
    RewriteCond %{QUERY_STRING} (sp_executesql) [NC]
    RewriteRule ^(.*)$ - [F]
    # END BPSQSE BPS QUERY STRING EXPLOITS
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule . /index.php [L]
    # WP REWRITE LOOP END
    
    # DENY BROWSER ACCESS TO THESE FILES
    # Use BPS Custom Code to modify/edit/change this code and to save it permanently.
    # wp-config.php, bb-config.php, php.ini, php5.ini, readme.html
    # Replace 88.77.66.55 with your current IP address and remove the
    # pound sign # in front of the Allow from line of code below to be able to access
    # any of these files directly from your Browser.
    
    <FilesMatch "^(wp-config\.php|php\.ini|php5\.ini|readme\.html|bb-config\.php)">
    Order Allow,Deny
    Deny from all
    #Allow from 88.77.66.55
    </FilesMatch>
    
    # HOTLINKING/FORBID COMMENT SPAMMERS/BLOCK BOTS/BLOCK IP/REDIRECT CODE
    # PLACEHOLDER ONLY
    # Use BPS Custom Code to add custom code and save it permanently here.

    wp-admin htaccess File

    # BULLETPROOF PRO 9.8 WP-ADMIN SECURE .HTACCESS
    
    # DO NOT ADD URL REWRITING IN THIS FILE OR WORDPRESS WILL BREAK
    # RewriteRule ^(.*)$ - [F] works in /wp-admin without breaking WordPress
    # RewriteRule . /index.php [L] will break WordPress
    
    # WPADMIN DENY BROWSER ACCESS TO FILES
    # Deny Browser access to /wp-admin/install.php
    # Use BPS wp-admin Custom Code to modify/edit/change this code and to save it permanently.
    # Replace 88.77.66.55 with your current IP address and remove the
    # pound sign # in front of the Allow from line of code below to be able to access
    # the /wp-admin/install.php file directly from your Browser.
    
    # BEGIN BPS WPADMIN DENY ACCESS TO FILES
    <FilesMatch "^(install\.php)">
    Order Allow,Deny
    Deny from all
    #Allow from 88.77.66.55
    </FilesMatch>
    # END BPS WPADMIN DENY ACCESS TO FILES
    
    # BEGIN OPTIONAL WP-ADMIN ADDITIONAL SECURITY MEASURES:
    
    # BEGIN CUSTOM CODE WPADMIN TOP
    # Use BPS wp-admin Custom Code to modify/edit/change this code and to save it permanently.
    # CCWTOP
    # END CUSTOM CODE WPADMIN TOP
    
    # BEGIN EXAMPLE OF OPTIONAL/ADDITIONAL SECURITY MEASURES
    # EXAMPLE WP-ADMIN DIRECTORY PASSWORD PROTECTION - .htpasswd
    # Use BPS wp-admin Custom Code to modify/edit/change this code and to save it permanently.
    # This code example from BEGIN EXAMPLE to END EXAMPLE is just an example of optional
    # code that you could add to your wp-admin htaccess file in the CUSTOM CODE WPADMIN TOP text box.
    # IMPORTANT: To setup Directory Password Protection use your web host control panel.
    # This example code is just showing you what the code will look like after you setup
    # Directory Password Protection using your web host control panel.
    # NOTES: Adding Directory Password Protection creates an additional password login
    # to gain access to your wp-admin folder/WordPress Login page.
    # Users / visitors to your site will not be able to register or login to your site
    # unless you give them the Directory Password Protection username and password.
    # You can specify a single specific user or use valid-user to allow all valid
    # user accounts to be able to login to your site.
    
    # EXAMPLE:
    #AuthType basic
    #AuthGroupFile /dev/null
    #AuthUserFile /path/to/protected/server/directory/.htpasswd
    #AuthName "Password Protected Area"
    #require user JohnDoe
    #require valid-user
    # END EXAMPLE OF OPTIONAL/ADDITIONAL SECURITY MEASURES
    
    # END OPTIONAL WP-ADMIN ADDITIONAL SECURITY MEASURES
    
    # REQUEST METHODS FILTERED
    RewriteEngine On
    RewriteCond %{REQUEST_METHOD} ^(TRACE|DELETE|TRACK|DEBUG) [NC]
    RewriteRule ^(.*)$ - [F]
    
    # BEGIN CUSTOM CODE WPADMIN PLUGIN/FILE SKIP RULES
    # To add wp-admin plugin skip/bypass rules use BPS wp-admin Custom Code.
    # If a plugin is calling a wp-admin file in a way that it is being blocked/forbidden
    # by BPS you can whitelist that file name by creating a skip rule for that file.
    #
    # Example: skip/bypass rule for the admin-ajax.php file and post.php file
    # RewriteCond %{REQUEST_URI} (admin-ajax\.php|post\.php) [NC]
    # RewriteRule . - [S=2]
    #
    # The [S] flag is used to skip following rules. Skip rule [S=2] will skip 2 following RewriteRules.
    # The skip rules MUST be in descending consecutive number order: 4, 3, 2...
    # If you add a new skip rule above skip rule 2 it will be skip rule 3: [S=3]
    #
    # Example: Multiple skip rules in descending consecutive number order.
    # Yoast Facebook OpenGraph wp-admin plugin skip/bypass rule
    # RewriteCond %{QUERY_STRING} page=wpseo_social&key=(.*) [NC]
    # RewriteRule . - [S=3]
    # skip/bypass rule for the admin-ajax.php file and post.php file
    # RewriteCond %{REQUEST_URI} (admin-ajax\.php|post\.php) [NC]
    # RewriteRule . - [S=2]
    #
    # CCWPF
    # END CUSTOM CODE WPADMIN PLUGIN/FILE SKIP RULES
    
    # DEFAULT WHITELIST SKIP RULE FOR WP PRESS THIS
    RewriteCond %{REQUEST_URI} (press-this\.php) [NC]
    RewriteRule . - [S=1]
    
    # BEGIN BPSQSE-check BPS QUERY STRING EXPLOITS AND FILTERS
    # WORDPRESS WILL BREAK IF ALL THE BPSQSE FILTERS ARE DELETED
    # Use BPS wp-admin Custom Code to modify/edit/change this code and to save it permanently.
    RewriteCond %{HTTP_USER_AGENT} (%0A|%0D|%27|%3C|%3E|%00) [NC,OR]
    RewriteCond %{HTTP_USER_AGENT} (libwww-perl|wget|python|nikto|curl|scan|java|winhttp|HTTrack|clshttp|archiver|loader|email|harvest|extract|grab|miner) [NC,OR]
    RewriteCond %{THE_REQUEST} (\?|\*|%2a)+(%20+|\\s+|%20+\\s+|\\s+%20+|\\s+%20+\\s+)HTTP(:/|/) [NC,OR]
    RewriteCond %{THE_REQUEST} etc/passwd [NC,OR]
    RewriteCond %{THE_REQUEST} cgi-bin [NC,OR]
    RewriteCond %{THE_REQUEST} (%0A|%0D) [NC,OR]
    RewriteCond %{REQUEST_URI} owssvr\.dll [NC,OR]
    RewriteCond %{HTTP_REFERER} (%0A|%0D|%27|%3C|%3E|%00) [NC,OR]
    RewriteCond %{HTTP_REFERER} \.opendirviewer\. [NC,OR]
    RewriteCond %{HTTP_REFERER} users\.skynet\.be.* [NC,OR]
    RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=http:// [NC,OR]
    RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=(\.\.//?)+ [NC,OR]
    RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=/([a-z0-9_.]//?)+ [NC,OR]
    RewriteCond %{QUERY_STRING} \=PHP[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12} [NC,OR]
    RewriteCond %{QUERY_STRING} (\.\./|%2e%2e%2f|%2e%2e/|\.\.%2f|%2e\.%2f|%2e\./|\.%2e%2f|\.%2e/) [NC,OR]
    RewriteCond %{QUERY_STRING} ftp\: [NC,OR]
    RewriteCond %{QUERY_STRING} http\: [NC,OR]
    RewriteCond %{QUERY_STRING} https\: [NC,OR]
    RewriteCond %{QUERY_STRING} \=\|w\| [NC,OR]
    RewriteCond %{QUERY_STRING} ^(.*)/self/(.*)$ [NC,OR]
    RewriteCond %{QUERY_STRING} ^(.*)cPath=http://(.*)$ [NC,OR]
    RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
    RewriteCond %{QUERY_STRING} (<|%3C)([^s]*s)+cript.*(>|%3E) [NC,OR]
    RewriteCond %{QUERY_STRING} (\<|%3C).*iframe.*(\>|%3E) [NC,OR]
    RewriteCond %{QUERY_STRING} (<|%3C)([^i]*i)+frame.*(>|%3E) [NC,OR]
    RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [NC,OR]
    RewriteCond %{QUERY_STRING} base64_(en|de)code[^(]*\([^)]*\) [NC,OR]
    RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
    RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2}) [OR]
    RewriteCond %{QUERY_STRING} ^.*(\(|\)|<|>).* [NC,OR]
    RewriteCond %{QUERY_STRING} (NULL|OUTFILE|LOAD_FILE) [OR]
    RewriteCond %{QUERY_STRING} (\.{1,}/)+(motd|etc|bin) [NC,OR]
    RewriteCond %{QUERY_STRING} (localhost|loopback|127\.0\.0\.1) [NC,OR]
    RewriteCond %{QUERY_STRING} (<|>|'|%0A|%0D|%27|%3C|%3E|%00) [NC,OR]
    RewriteCond %{QUERY_STRING} concat[^\(]*\( [NC,OR]
    RewriteCond %{QUERY_STRING} union([^s]*s)+elect [NC,OR]
    RewriteCond %{QUERY_STRING} union([^a]*a)+ll([^s]*s)+elect [NC,OR]
    RewriteCond %{QUERY_STRING} (;|<|>|'|"|\)|%0A|%0D|%22|%27|%3C|%3E|%00).*(/\*|union|select|insert|drop|delete|update|cast|create|char|convert|alter|declare|order|script|set|md5|benchmark|encode) [NC,OR]
    RewriteCond %{QUERY_STRING} (sp_executesql) [NC]
    RewriteRule ^(.*)$ - [F]
    # END BPSQSE-check BPS QUERY STRING EXPLOITS AND FILTERS
    #28064

    popljubo
    Participant

    Hi,
    After the update from V.53.1 > V.53.2, I followed described steps of new CUSTOM CODE REQUEST METHODS FILTERED, inserting:

     RewriteCond %{REQUEST_METHOD} ^(TRACE|DELETE|TRACK|DEBUG) [NC]
    RewriteRule ^(.*)$ - [F]
    RewriteCond %{REQUEST_METHOD} ^(HEAD) [NC]
    RewriteRule ^(.*)$ /wp-content/plugins/bulletproof-security/405.php [L]

    activated Root Folder BulletProof Mode but I’ve got Internal Server Error
    Restoring htaccess File with backup containing “old” code:

    RewriteEngine On
    RewriteCond %{REQUEST_METHOD} ^(TRACE|DELETE|TRACK|DEBUG) [NC]
    RewriteRule ^(.*)$ - [F,L]

    no more error.
    Previously I’ve updated another 3 sites on other server and everything was fine.
    Please tell me what do I need to check, what to do in this case or tell me what specific info I must provide.

    Update:
    if I comment out these 2 lines of code with # signs, in order to Allow HEAD Requests I’ve got the same error:

    RewriteCond %{REQUEST_METHOD} ^(TRACE|DELETE|TRACK|DEBUG) [NC]
    RewriteRule ^(.*)$ - [F]
    #RewriteCond %{REQUEST_METHOD} ^(HEAD) [NC]
    #RewriteRule ^(.*)$ /wp-content/plugins/bulletproof-security/405.php [L]

    below are two error log messages from last atempt:

    [Wed Feb 03 18:58:43.133652 2016] [core:alert] [client MY ISP IP] .../public_html/.htaccess: RewriteCond: bad flag delimiters, referer: .../wp-admin/admin.php?page=bulletproof-security%2Fadmin%2Fcore%2Fcore.php

    and

    [Wed Feb 03 18:57:41.949544 2016] [core:alert] [client MY ISP IP] .../public_html/.htaccess: RewriteCond: bad flag delimiters, referer: .../wp-admin/admin.php?page=bulletproof-security/admin/core/core.php
    #28069

    AITpro Admin
    Keymaster

    Root htaccess File Custom Code Setup Steps
    1. Delete any code that is in the 
    2. Click the Save Root Custom Code button to save your Root custom code.
    3. Go to the BPS Security Modes page and click the Root Folder BulletProof Mode Activate button.

    BPS will automatically create the correct code for your website in your root htaccess file.  Copy that CUSTOM CODE REQUEST METHODS FILTERED code out of your root htaccess file and paste it into the CUSTOM CODE CUSTOM CODE REQUEST METHODS FILTERED text box if you want to allow HEAD Requests.  You should only see either one of these varitions of the new code.  Each have been commented out with a # sign to allow HEAD Requests (note: you need to copy the entire block of REQUEST METHODS FILTERED code and I am only showing the last 2 lines of either code below).

    #RewriteCond %{REQUEST_METHOD} ^(HEAD) [NC]
    #RewriteRule ^(.*)$ /wp-content/plugins/bulletproof-security/405.php [L]
    #RewriteCond %{REQUEST_METHOD} ^(HEAD) [NC]
    #RewriteRule ^(.*)$ - [R=405,L]
    #28072

    popljubo
    Participant

    Thank you for your really fast reply!
    I’ve got 500 Internal Server Error just deleting code that is in the CUSTOM CODE CUSTOM CODE REQUEST METHODS FILTERED text box / saving Root Custom Code.
    This is weird! I’ve tried that several times and once, somehow, I managed to fulfill all four steps, described by you but in the end I’ve got that 500 Internal Server Error

    #28073

    AITpro Admin
    Keymaster

    Ok that means you have invalid/bad code somewhere.  Use FTP and delete your root htaccess file.

    1. Copy this code below to this BPS Root Custom Code text box:  CUSTOM CODE CUSTOM CODE REQUEST METHODS FILTERED
    2. If you have added any other custom code in any other Custom Code text boxes then make a copy of it and delete it.
    3. Click the Save Root Custom Code button.
    4. Go to the BPS Security Modes page and click the Root Folder BulletProof Mode Activate button.

    # REQUEST METHODS FILTERED
    # If you want to allow HEAD Requests use BPS Custom Code and copy 
    # this entire REQUEST METHODS FILTERED section of code to this BPS Custom Code 
    # text box: CUSTOM CODE REQUEST METHODS FILTERED.
    # See the CUSTOM CODE REQUEST METHODS FILTERED help text for additional steps.
    RewriteCond %{REQUEST_METHOD} ^(TRACE|DELETE|TRACK|DEBUG) [NC]
    RewriteRule ^(.*)$ - [F]
    #RewriteCond %{REQUEST_METHOD} ^(HEAD) [NC]
    #RewriteRule ^(.*)$ /wp-content/plugins/bulletproof-security/405.php [L]

     

    #28074

    popljubo
    Participant

    All this time I’ve deleted root htaccess file via FTP cause is the only way to login again in case of 500 Internal Server Error.
    But you are right about having invalid/bad code somewhere or it was a problem with browser cache … cause no matter what was doing …
    I figured that the lines of code from current root .htaccess file in htaccess File Editor was different then the same lines in file on other 3 sites [another server]. So doing all that steps described by you but from another browser helped.
    Now its ok. Thank you!
    Please tell me which should be the right result checking by making a HEAD Request @ System info > Website Headers Check Tool cause i have 2 different situation at 4 diff.sites:
    only one site generated 404:

    HTTP/1.1 404 Not Found
    Date: Wed, 03 Feb 2016 20:36:16 GMT
    Server: Apache/2.4.9 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4 mod_fcgid/2.3.9
    Content-Type: text/html; charset=iso-8859-1

    and other 3 generated 500:

    HTTP/1.1 500 Internal Server Error
    Date: Wed, 03 Feb 2016 20:39:35 GMT
    Server: Apache/2.4.12 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4 mod_fcgid/2.3.9
    Connection: close
    Content-Type: text/html; charset=iso-8859-1
    #28075

    AITpro Admin
    Keymaster

    You should not be seeing a 404 error or 500 errors and should either be seeing a 200 OK or 403 Forbidden error. If you want me to figure out what is going on on each of these sites then I need FTP access to each of these sites. Send the FTP login information in this format below to this email address: info at ait-pro dot com.

    I assume this is FTP and not sftp.
    Hostname:
    Username:
    password:

    #28087

    AITpro Admin
    Keymaster

    Added the # signs directly in the root htaccess file via FTP as shown below on website: sayitnow.ro and everything worked fine. I was not able to connect via FTP to website: http://www.tntimisoara.com/

    Did a HEAD Request Headers check: HEAD Request Headers: http://sayitnow.ro/

    HTTP/1.1 200 OK
    Date: Thu, 04 Feb 2016 21:03:45 GMT
    Server: Apache/2.4.12 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4 mod_fcgid/2.3.9
    X-Powered-By: PHP/5.4.41
    Link: ; rel="https://api.w.org/", ; rel=shortlink
    Set-Cookie: lang=en_US; path=/
    X-Content-Type-Options: nosniff
    Content-Type: text/html; charset=UTF-8
    # CUSTOM CODE REQUEST METHODS FILTERED
    # REQUEST METHODS FILTERED
    # If you want to allow HEAD Requests use BPS Custom Code and copy
    # this entire REQUEST METHODS FILTERED section of code to this BPS Custom Code
    # text box: CUSTOM CODE REQUEST METHODS FILTERED.
    # See the CUSTOM CODE REQUEST METHODS FILTERED help text for additional steps.
    RewriteCond %{REQUEST_METHOD} ^(TRACE|DELETE|TRACK|DEBUG) [NC]
    RewriteRule ^(.*)$ - [F]
    #RewriteCond %{REQUEST_METHOD} ^(HEAD) [NC]
    #RewriteRule ^(.*)$ /wp-content/plugins/bulletproof-security/405.php [L]

    Summary: What I think may be happening is that you are copying # signs from some application like Word or WordPad. htaccess code should either be typed in directly in the BPS Custom Code text boxes or if you are going to copy and paste htaccess code you need to use Notepad or Notepad++. Word and WordPad will add hidden formatting characters to the # signs that are not visible to the eye.

    #28089

    popljubo
    Participant

    Hi,
    Thank you for your support and my apology for this late response cause I was on the road.
    Yes I use only a Notepad++ for editing but in this case I just copy/pasted from right to left text box (UI: BulletProof Security ~ htaccess Core > Custom Code), so no other text editor was involved.
    I figured that the lines of code from current root .htaccess file in htaccess File Editor (UI: BulletProof Security ~ htaccess Core > File Editor), was different then the same lines in similar htaccess files on other 3 sites [another server].
    Using UI: BulletProof Security ~ htaccess Core > Custom Code somehow one line was deleted at creation of new htaccess file, this is how it looks:

    # WP REWRITE LOOP START
    RewriteEngine On
    RewriteBase /
    RewriteRule ^index\.php$ - [L]
    # CUSTOM CODE REQUEST METHODS FILTERED
    # REQUEST METHODS FILTERED
    # If you want to allow HEAD Requests use BPS Custom Code and copy
    # this entire REQUEST METHODS FILTERED section of code to this BPS Custom Code
    # text box: CUSTOM CODE REQUEST METHODS FILTERED.
    # See the CUSTOM CODE REQUEST METHODS FILTERED help text for additional steps.
    RewriteCond %{REQUEST_METHOD} ^(TRACE|DELETE|TRACK|DEBUG) [NC]
    RewriteRule ^(.*)$ - [F]
    RewriteCond %{REQUEST_METHOD} ^(HEAD) [NC]
    RewriteRule ^(.*)$ /wp-content/plugins/bulletproof-security/405.php [L]

    So I just added a line between:

    RewriteRule ^index\.php$ - [L]

    and

    # CUSTOM CODE REQUEST METHODS FILTERED

    and all problems was gone!

Viewing 9 posts - 1 through 9 (of 9 total)

You must be logged in to reply to this topic.