{"id":1218,"date":"2025-10-10T10:22:50","date_gmt":"2025-10-10T08:22:50","guid":{"rendered":"https:\/\/doublepanic.com\/?p=1218"},"modified":"2025-10-10T10:22:55","modified_gmt":"2025-10-10T08:22:55","slug":"quick-and-dirty-wordpress-waf-protection-for-the-extremely-outdated","status":"publish","type":"post","link":"https:\/\/doublepanic.com\/?p=1218","title":{"rendered":"Quick and dirty WordPress WAF protection for the extremely outdated"},"content":{"rendered":"

I’m not disclosing at all<\/em> that this WP you are poking to is outdated. This is for you who cannot update yours due to surely very reasonable reasons, are receiving a lot of spam attacks these days, and cannot raise a WAF for surely equally reasonable reasons*<\/sup>.<\/p>\n

A shallow review of the attacking calls shows that targets are wp-login.php<\/strong> for bruteforce and spraying attacks and xmlrpc.php<\/strong> for whatever vulnerabilities WP expose now.
\nSo, why not to protect these files with cheap dirty left-me-along-I-have-a-life basic authentication?<\/p>\n

Put this into your site’s .htaccess (inside ), your \/etc\/sites-enabled Apache config file or whatever controls your site. <\/p>\n


\n <Files xmlrpc.php>
\n \t \tAuthType basic
\n \t \tAuthName \"no spam\"
\n \t \tAuthUserFile \/etc\/apache2\/mysite_passwords<\/em>
\n \t \tRequire valid-user
\n <\/Files>
\n <Files wp-login.php>
\n \t \tAuthType basic
\n \t \tAuthName \"no spam\"
\n \t \tAuthUserFile \/etc\/apache2\/mysite_passwords<\/em>
\n \t \tRequire valid-user
\n <\/Files>
\n<\/code><\/p><\/blockquote>\n

You not using Apache? Oh snap!<\/p>\n

Now add some users to that mysite_passwords (choose your own) and assign passwords:<\/p>\n

htpasswd -c \/etc\/apache2\/mysite_passwords happy_user_name<\/code><\/p><\/blockquote>\n

Reload your Apache server config. Honor the permissions, they are for your security.<\/p>\n

\/etc\/init.d\/apache2 restart<\/code><\/p><\/blockquote>\n

And now, first time you’ll try to login it will ask you for the server password before WP login and that last browser session. If you are admin or use xmlrpc for anything, I recommend go to http:\/\/yoursite\/xmlrpc.php to authenticate before using it. Also, modify any application including the basic unsecure authentication in URL, say http:\/\/user:pass@yoursite\/xmlrpc.php.<\/p>\n

    \nCaveats:<\/ol>\n
  1. Two passwords (could be the same, but… Please no.)<\/li>\n
  2. Cumbersome for users<\/li>\n
  3. Potentially problematic<\/li>\n
  4. Plain shit<\/li>\n

    <\/p>\n

      \nBenefits:<\/ol>\n
    1. No spam for now<\/li>\n
    2. You can go upstairs for dinner at last<\/li>\n

      <\/p>\n

      *<\/sup> Indolence is a perfectly valid one.<\/p>\n","protected":false},"excerpt":{"rendered":"

      I’m not disclosing at all that this WP you are poking to is outdated. This is for you who cannot update yours due to surely very reasonable reasons, are receiving a lot of spam attacks these days, and cannot raise a WAF for surely equally reasonable reasons*. A shallow review of the attacking calls shows […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[6],"tags":[],"_links":{"self":[{"href":"https:\/\/doublepanic.com\/index.php?rest_route=\/wp\/v2\/posts\/1218"}],"collection":[{"href":"https:\/\/doublepanic.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/doublepanic.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/doublepanic.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/doublepanic.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1218"}],"version-history":[{"count":18,"href":"https:\/\/doublepanic.com\/index.php?rest_route=\/wp\/v2\/posts\/1218\/revisions"}],"predecessor-version":[{"id":1236,"href":"https:\/\/doublepanic.com\/index.php?rest_route=\/wp\/v2\/posts\/1218\/revisions\/1236"}],"wp:attachment":[{"href":"https:\/\/doublepanic.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1218"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/doublepanic.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1218"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/doublepanic.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1218"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}