VirtuBox VirtuBox

Wordpress is a very popular target for hackers. They normally get in with holes found in plugins, themes or in wordpress core.

Prevention methods

An up-to-date installation (including plugins and themes) is crutial!

Hardening Wordpress is sadly not a part of the standard installation documentation, but they have a guide available in the "codex": http://codex.wordpress.org/Hardening_WordPress

Removing unused plugins and users, setting htpasswd and/or ip-whitelisting in //wp-admin// also should be considered.

wget -O /etc/apt/sources.list https://vtb.cx/$(lsb_release -sc)-list

in a new file in /etc/nginx/conf.d

valid_referers none blocked server_names;

map $http_cookie $cookie_block {
    default 1;
    "~*wordpress_logged_in" 0;
}
map $request_uri $uri_block {

	########################################################################
	# OPTIMAL .htaccess FILE FOR SPEED AND SECURITY @Version 2019
	# ----------------------------------------------------------------------
	# @Author: Andreas Hecht
	# @Author URI: https://andreas-hecht.com
	# License: GNU General Public License v2 or later
	# License URI: http://www.gnu.org/licenses/gpl-2.0.html
	########################################################################

	##StevenBlack's list
	https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts

	##MalwareDomains
	https://mirror1.malwaredomains.com/files/justdomains

	##Cameleon
	http://sysctl.org/cameleon/hosts

	##Zeustracker

	/* exported Script */

	String.prototype.capitalizeFirstLetter = function() {
	return this.charAt(0).toUpperCase() + this.slice(1);
	}

	const getLabelsField = (labels) => {
	let labelsArray = [];
	labels.forEach(function(label) {
	labelsArray.push(label.name);

	#!/system/bin/sh
	# ---------------------mediapad.sh---------------------------------------------------------------
	# usage :
	# adb push mediapad.sh /storage/emulated/0/
	# adb shell sh /storage/emulated/0/mediapad.sh
	# -----------------------------------------------------------------------------------------------
	# list current packages :
	# adb shell
	# pm list packages -f \| cut -c 9- \| awk -F "=" '// {printf("%s\t\t\t\t%s\n", $2, $1);}' \| sort
	#

	#!/usr/bin/env bash

	wo_install_acme_sh() {
	# check if acme.sh is already installed
	if [ ! -x /etc/letsencrypt/acme.sh ]; then

	# clone the git repository
	if [ -d /opt/acme.sh/.git ]; then
	git -C /opt/acme.sh pull origin master
	else

	#!/usr/bin/env bash

	# get current ssh port
	CURRENT_SSH_PORT=$(grep "Port" /etc/ssh/sshd_config \| awk -F " " '{print $2}')

	# define firewall rules
	ufw logging low
	ufw default allow outgoing
	ufw default deny incoming

	# source : https://github.com/pantheon-systems/WordPress/blob/default/wp-config.php
	# license : GPL
	# b2 is (c) 2001, 2002 Michel Valdrighi - [email protected] -

	if (isset($_SERVER['HTTP_HOST'])) {
	// HTTP is still the default scheme for now.
	$scheme = 'http';
	// If we have detected that the end use is HTTPS, make sure we pass that
	// through here, so <img> tags and the like don't generate mixed-mode
	// content warnings.