jennimckinnon’s gists

jennimckinnon / .htaccess

Created May 18, 2016 22:25

Protect error logs, wp-config.php, php.ini and .htaccess for WordPress sites.

	<FilesMatch "^.(error_log\|wp-config\.php\|php.ini\|\.[hH][tT][aApP].)$">
	Order deny,allow
	Deny from all
	</FilesMatch>

jennimckinnon / .htaccess

Created May 18, 2016 21:31

For Multisites using sub-domains.

	RewriteEngine On
	RewriteBase /
	RewriteRule ^index\.php$ - [L]

	# add a trailing slash to /wp-admin
	RewriteRule ^wp-admin$ wp-admin/ [R=301,L]

	RewriteCond %{REQUEST_FILENAME} -f [OR]
	RewriteCond %{REQUEST_FILENAME} -d
	RewriteRule ^ - [L]

jennimckinnon / .htaccess

Created May 18, 2016 21:29

For Multisites using sub-directories.

	RewriteEngine On
	RewriteBase /
	RewriteRule ^index\.php$ - [L]

	# add a trailing slash to /wp-admin
	RewriteRule ^([_0-9a-zA-Z-]+/)?wp-admin$ $1wp-admin/ [R=301,L]

	RewriteCond %{REQUEST_FILENAME} -f [OR]
	RewriteCond %{REQUEST_FILENAME} -d
	RewriteRule ^ - [L]

jennimckinnon / .htaccess

Created May 18, 2016 21:27

For single installs of WordPress.

	# BEGIN WordPress
	<IfModule mod_rewrite.c>
	RewriteEngine On
	RewriteBase /
	RewriteRule ^index\.php$ - [L]
	RewriteCond %{REQUEST_FILENAME} !-f
	RewriteCond %{REQUEST_FILENAME} !-d
	RewriteRule . /index.php [L]
	</IfModule>
	# END WordPress

jennimckinnon / filter access log

Created May 16, 2016 06:04

Example from: https://blog.sucuri.net/2015/08/ask-sucuri-how-did-my-wordpress-website-get-hacked-a-tutorial.html

$ cat access-log |grep -E "wp-admin|wp-login|POST /" |grep -v "^1.2.3.4|1.2.3.5" | more

jennimckinnon / filter access log

Created May 16, 2016 06:00

Example from: https://blog.sucuri.net/2015/08/ask-sucuri-how-did-my-wordpress-website-get-hacked-a-tutorial.html

$ cat access-log |grep -E "wp-admin|wp-login|POST /" | more

jennimckinnon / filter access log

Created May 16, 2016 05:53

Example from: https://blog.sucuri.net/2015/08/ask-sucuri-how-did-my-wordpress-website-get-hacked-a-tutorial.html

$ cat access-log |grep -Ev "\.(js|css|png|jpg|jpeg) HTTP/1" |grep -Ev " GET (/|/contact|/signup) HTTP/1"| more

jennimckinnon / access log sample

Last active May 16, 2016 01:35

A sample access log from cPanel for a WordPress Multisite.

	12.345.678.910 - - [15/May/2016:15:15:03 -0700] "GET /wp-admin/network/ HTTP/1.1" 302 - "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.94 Safari/537.36"
	12.345.678.910 - - [15/May/2016:15:15:04 -0700] "GET /wp-login.php?redirect_to=http%3A%2F%2Fyour-site.com%2Fwp-admin%2Fnetwork%2F&reauth=1 HTTP/1.1" 200 2564 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.94 Safari/537.36"
	12.345.678.910 - - [15/May/2016:15:15:06 -0700] "GET /wp-admin/load-styles.php?c=1&dir=ltr&load%5B%5D=dashicons,buttons,forms,l10n,login&ver=29ef489256bcba8815b5864843de10bb HTTP/1.1" 200 38435 "http://your-site.com/wp-login.php?redirect_to=http%3A%2F%2Fwpwringer.com%2Fwp-admin%2Fnetwork%2F&reauth=1" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.94 Safari/537.36"
	12.345.678.910 - - [15/May/2016:15:15:07 -0700] "GET /wp-admin/images/wordpress-logo.svg?ver=20131107 HTTP/1.1" 200 1521 "http://you

jennimckinnon / error log sample

Created May 16, 2016 01:05

Sample line from an error log in cPanel.

[Fri May 06 23:14:24.856758 2016] [core:error] [pid 27290] (13)Permission denied: [client 12.345.68.90:33106] AH00132: file permissions deny server access: /path/to/your-site/.htaccess

jennimckinnon / Global Theme CSS

Created May 12, 2016 07:09

	p {
	font-family: FontName;
	}