├── .gitattributes ├── .gitignore ├── .htpasswd ├── README.md ├── cert ├── letsencrypt-root-ca.pem └── ssl-example ├── cloudflare ├── common ├── country-cz ├── debug_vars ├── extras ├── cron │ └── certbot-renew ├── fail2ban │ ├── filter.d │ │ ├── nginx-404.conf │ │ ├── wp-auth-failed.conf │ │ ├── wp-auth.conf │ │ └── wp-strange.conf │ └── jail.d │ │ ├── nginx-404.conf │ │ ├── wp-auth-failed.conf │ │ ├── wp-auth.conf │ │ └── wp-strange.conf ├── log-rotate │ └── nginx ├── mu-plugins │ ├── lynt-custom-login.php │ ├── lynt-enhancer.php │ ├── lynt-mailfixer.php │ ├── lynt-mo-cache-igb.php │ ├── lynt-mo-cache.php │ └── lynt-team-cookie.php └── php-fpm │ └── www.conf ├── fastcgi_params ├── fbclid-redir ├── limit ├── limit-pass ├── microcache ├── nginx.conf ├── php5 ├── php5.load ├── php7 ├── php7.load ├── production ├── ssl-config ├── vhosts.d ├── example.conf └── sslexample.conf └── wordpress /.gitattributes: -------------------------------------------------------------------------------- 1 | # Auto detect text files and perform LF normalization 2 | * text=auto 3 | 4 | # Custom for Visual Studio 5 | *.cs diff=csharp 6 | 7 | # Standard to msysgit 8 | *.doc diff=astextplain 9 | *.DOC diff=astextplain 10 | *.docx diff=astextplain 11 | *.DOCX diff=astextplain 12 | *.dot diff=astextplain 13 | *.DOT diff=astextplain 14 | *.pdf diff=astextplain 15 | *.PDF diff=astextplain 16 | *.rtf diff=astextplain 17 | *.RTF diff=astextplain 18 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | # Windows image file caches 2 | Thumbs.db 3 | ehthumbs.db 4 | 5 | # Folder config file 6 | Desktop.ini 7 | 8 | # Recycle Bin used on file shares 9 | $RECYCLE.BIN/ 10 | 11 | # Windows Installer files 12 | *.cab 13 | *.msi 14 | *.msm 15 | *.msp 16 | 17 | # Windows shortcuts 18 | *.lnk 19 | 20 | # ========================= 21 | # Operating System Files 22 | # ========================= 23 | 24 | # OSX 25 | # ========================= 26 | 27 | .DS_Store 28 | .AppleDouble 29 | .LSOverride 30 | 31 | # Thumbnails 32 | ._* 33 | 34 | # Files that might appear in the root of a volume 35 | .DocumentRevisions-V100 36 | .fseventsd 37 | .Spotlight-V100 38 | .TemporaryItems 39 | .Trashes 40 | .VolumeIcon.icns 41 | 42 | # Directories potentially created on remote AFP share 43 | .AppleDB 44 | .AppleDesktop 45 | Network Trash Folder 46 | Temporary Items 47 | .apdisk 48 | -------------------------------------------------------------------------------- /.htpasswd: -------------------------------------------------------------------------------- 1 | example:$apr1$BjHbmZRV$KeIQrMM48EVrwztcvKeOK. 2 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # WP-nginx-config 2 | Basic Nginx + WordPress setup 3 | 4 | It is compiled from our production setup. It is not suitable for Copy&Paste to production use without edits. 5 | 6 | # Main features 7 | - extended configuration via "features includes" 8 | - PHP5/PHP7 support 9 | - SSL confing based on "Mozilla SSL Configuration Generator" recommendations 10 | - Let's Encrypt enabled (OCSP Stapling included) 11 | - clientside static resources caching and serverside open files descriptors caching 12 | - gzip compression 13 | - CloudFlare support 14 | - optional GeoIP blocking 15 | - optional Nginx Microcache settings 16 | - optional basic HTTP auth 17 | - Basic & WordPress Security 18 | - prevent HTTP Poxy 19 | - prevent Slow Loris (optional) 20 | - blocking common hacking tools and uncommon HTTP methods 21 | - usernames harvesting denial 22 | - blocking access to files with sensitive informaion and VCS systems 23 | - blocking PHP in uploads directory 24 | - blocking empty referres into comments, login and ajax 25 | - blocking suspicious queries (based on iThemes Security blacklist) 26 | - adding basic security headers 27 | 28 | # Extra configs 29 | Look at **extras** folder 30 | - mu-plugins - small mu-plugin for WordPress 31 | - **Enhancer** 32 | - enable bcryp hashes for user passwords 33 | - filter out sensitive user info from rest API 34 | - change status code of failed logins to 401 35 | - **Mail Fixer** 36 | - fix Return-Path header 37 | - set SMTP server 38 | - **Team Cookie** 39 | - allow to exclude web related users from analytics via special cookie 40 | - **MO Cache** 41 | - simple file system cache for gettext translations 42 | - fail2ban rules - block many 404, block failed logins 43 | - log rotate - log rotate rule for nginx logs 44 | - php-fpm - basic PHP-FPM pool with open-basedir and disable_functions 45 | 46 | -------------------------------------------------------------------------------- /cert/letsencrypt-root-ca.pem: -------------------------------------------------------------------------------- 1 | -----BEGIN CERTIFICATE----- 2 | MIIDSjCCAjKgAwIBAgIQRK+wgNajJ7qJMDmGLvhAazANBgkqhkiG9w0BAQUFADA/ 3 | MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT 4 | DkRTVCBSb290IENBIFgzMB4XDTAwMDkzMDIxMTIxOVoXDTIxMDkzMDE0MDExNVow 5 | PzEkMCIGA1UEChMbRGlnaXRhbCBTaWduYXR1cmUgVHJ1c3QgQ28uMRcwFQYDVQQD 6 | Ew5EU1QgUm9vdCBDQSBYMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB 7 | AN+v6ZdQCINXtMxiZfaQguzH0yxrMMpb7NnDfcdAwRgUi+DoM3ZJKuM/IUmTrE4O 8 | rz5Iy2Xu/NMhD2XSKtkyj4zl93ewEnu1lcCJo6m67XMuegwGMoOifooUMM0RoOEq 9 | OLl5CjH9UL2AZd+3UWODyOKIYepLYYHsUmu5ouJLGiifSKOeDNoJjj4XLh7dIN9b 10 | xiqKqy69cK3FCxolkHRyxXtqqzTWMIn/5WgTe1QLyNau7Fqckh49ZLOMxt+/yUFw 11 | 7BZy1SbsOFU5Q9D8/RhcQPGX69Wam40dutolucbY38EVAjqr2m7xPi71XAicPNaD 12 | aeQQmxkqtilX4+U9m5/wAl0CAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNV 13 | HQ8BAf8EBAMCAQYwHQYDVR0OBBYEFMSnsaR7LHH62+FLkHX/xBVghYkQMA0GCSqG 14 | SIb3DQEBBQUAA4IBAQCjGiybFwBcqR7uKGY3Or+Dxz9LwwmglSBd49lZRNI+DT69 15 | ikugdB/OEIKcdBodfpga3csTS7MgROSR6cz8faXbauX+5v3gTt23ADq1cEmv8uXr 16 | AvHRAosZy5Q6XkjEGB5YGV8eAlrwDPGxrancWYaLbumR9YbK+rlmM6pZW87ipxZz 17 | R8srzJmwN0jP41ZL9c8PDHIyh8bwRLtTcm1D9SZImlJnt1ir/md2cXjbDaJWFBM5 18 | JDGFoqgCWjBH4d1QB7wCCZAA62RjYJsWvIjJEubSfZGL+T0yjWW06XyxV3bqxbYo 19 | Ob8VZRzI9neWagqNdwvYkQsEjgfbKbYK7p2CNTUQ 20 | -----END CERTIFICATE----- 21 | 22 | -----BEGIN CERTIFICATE----- 23 | MIIEkjCCA3qgAwIBAgIQCgFBQgAAAVOFc2oLheynCDANBgkqhkiG9w0BAQsFADA/ 24 | MSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT 25 | DkRTVCBSb290IENBIFgzMB4XDTE2MDMxNzE2NDA0NloXDTIxMDMxNzE2NDA0Nlow 26 | SjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUxldCdzIEVuY3J5cHQxIzAhBgNVBAMT 27 | GkxldCdzIEVuY3J5cHQgQXV0aG9yaXR5IFgzMIIBIjANBgkqhkiG9w0BAQEFAAOC 28 | AQ8AMIIBCgKCAQEAnNMM8FrlLke3cl03g7NoYzDq1zUmGSXhvb418XCSL7e4S0EF 29 | q6meNQhY7LEqxGiHC6PjdeTm86dicbp5gWAf15Gan/PQeGdxyGkOlZHP/uaZ6WA8 30 | SMx+yk13EiSdRxta67nsHjcAHJyse6cF6s5K671B5TaYucv9bTyWaN8jKkKQDIZ0 31 | Z8h/pZq4UmEUEz9l6YKHy9v6Dlb2honzhT+Xhq+w3Brvaw2VFn3EK6BlspkENnWA 32 | a6xK8xuQSXgvopZPKiAlKQTGdMDQMc2PMTiVFrqoM7hD8bEfwzB/onkxEz0tNvjj 33 | /PIzark5McWvxI0NHWQWM6r6hCm21AvA2H3DkwIDAQABo4IBfTCCAXkwEgYDVR0T 34 | AQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwfwYIKwYBBQUHAQEEczBxMDIG 35 | CCsGAQUFBzABhiZodHRwOi8vaXNyZy50cnVzdGlkLm9jc3AuaWRlbnRydXN0LmNv 36 | bTA7BggrBgEFBQcwAoYvaHR0cDovL2FwcHMuaWRlbnRydXN0LmNvbS9yb290cy9k 37 | c3Ryb290Y2F4My5wN2MwHwYDVR0jBBgwFoAUxKexpHsscfrb4UuQdf/EFWCFiRAw 38 | VAYDVR0gBE0wSzAIBgZngQwBAgEwPwYLKwYBBAGC3xMBAQEwMDAuBggrBgEFBQcC 39 | ARYiaHR0cDovL2Nwcy5yb290LXgxLmxldHNlbmNyeXB0Lm9yZzA8BgNVHR8ENTAz 40 | MDGgL6AthitodHRwOi8vY3JsLmlkZW50cnVzdC5jb20vRFNUUk9PVENBWDNDUkwu 41 | Y3JsMB0GA1UdDgQWBBSoSmpjBH3duubRObemRWXv86jsoTANBgkqhkiG9w0BAQsF 42 | AAOCAQEA3TPXEfNjWDjdGBX7CVW+dla5cEilaUcne8IkCJLxWh9KEik3JHRRHGJo 43 | uM2VcGfl96S8TihRzZvoroed6ti6WqEBmtzw3Wodatg+VyOeph4EYpr/1wXKtx8/ 44 | wApIvJSwtmVi4MFU5aMqrSDE6ea73Mj2tcMyo5jMd6jmeWUHK8so/joWUoHOUgwu 45 | X4Po1QYz+3dszkDqMp4fklxBwXRsW10KXzPMTZ+sOPAveyxindmjkW8lGy+QsRlG 46 | PfZ+G6Z6h7mjem0Y+iWlkYcV4PIWL1iwBi8saCbGS5jN2p8M+X+Q7UNKEkROb3N6 47 | KOqkqm57TH2H3eDJAkSnh6/DNFu0Qg== 48 | -----END CERTIFICATE----- 49 | -------------------------------------------------------------------------------- /cert/ssl-example: -------------------------------------------------------------------------------- 1 | ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; 2 | ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; 3 | ssl_trusted_certificate cert/letsencrypt-root-ca.pem; 4 | 5 | include ssl-config; 6 | -------------------------------------------------------------------------------- /cloudflare: -------------------------------------------------------------------------------- 1 | #https://www.cloudflare.com/ips-v4 2 | set_real_ip_from 103.21.244.0/22; 3 | set_real_ip_from 103.22.200.0/22; 4 | set_real_ip_from 103.31.4.0/22; 5 | set_real_ip_from 104.16.0.0/12; 6 | set_real_ip_from 108.162.192.0/18; 7 | set_real_ip_from 131.0.72.0/22; 8 | set_real_ip_from 141.101.64.0/18; 9 | set_real_ip_from 162.158.0.0/15; 10 | set_real_ip_from 172.64.0.0/13; 11 | set_real_ip_from 173.245.48.0/20; 12 | set_real_ip_from 188.114.96.0/20; 13 | set_real_ip_from 190.93.240.0/20; 14 | set_real_ip_from 197.234.240.0/22; 15 | set_real_ip_from 198.41.128.0/17; 16 | 17 | #https://www.cloudflare.com/ips-v6 18 | set_real_ip_from 2400:cb00::/32; 19 | set_real_ip_from 2405:b500::/32; 20 | set_real_ip_from 2606:4700::/32; 21 | set_real_ip_from 2803:f800::/32; 22 | set_real_ip_from 2c0f:f248::/32; 23 | set_real_ip_from 2a06:98c0::/29; 24 | 25 | real_ip_header CF-Connecting-IP; 26 | -------------------------------------------------------------------------------- /common: -------------------------------------------------------------------------------- 1 | location ~ /\.(?!well-known\/) { 2 | deny all; 3 | } 4 | 5 | location /favicon.ico { 6 | log_not_found off; 7 | auth_basic off; 8 | expires 31d; 9 | add_header Cache-Control private; 10 | } 11 | 12 | location /robots.txt { 13 | log_not_found off; 14 | } 15 | -------------------------------------------------------------------------------- /country-cz: -------------------------------------------------------------------------------- 1 | if ($geoip_country_code !~ "CZ") { 2 | return 403; 3 | } 4 | 5 | include php7.load; 6 | -------------------------------------------------------------------------------- /debug_vars: -------------------------------------------------------------------------------- 1 | location = /debug_vars { 2 | default_type text/plain; 3 | return 200 " 4 | http_host: $http_host 5 | http_user_agent: $http_user_agent 6 | http_referer: $http_referer 7 | http_via: $http_via 8 | http_x_forwarded_for: $http_x_forwarded_for 9 | http_cookie: $http_cookie 10 | content_length: $content_length 11 | content_type: $content_type 12 | host: $host 13 | binary_remote_addr: $binary_remote_addr 14 | remote_addr: $remote_addr 15 | remote_port: $remote_port 16 | proxy_protocol_addr: $proxy_protocol_addr 17 | proxy_protocol_port: $proxy_protocol_port 18 | server_addr: $server_addr 19 | server_port: $server_port 20 | server_protocol: $server_protocol 21 | scheme: $scheme 22 | https: $https 23 | request_uri: $request_uri 24 | uri: $uri 25 | document_uri: $document_uri 26 | request: $request 27 | document_root: $document_root 28 | realpath_root: $realpath_root 29 | query_string: $query_string 30 | args: $args 31 | is_args: $is_args 32 | request_filename: $request_filename 33 | server_name: $server_name 34 | request_method: $request_method 35 | remote_user: $remote_user 36 | bytes_sent: $bytes_sent 37 | body_bytes_sent: $body_bytes_sent 38 | pipe: $pipe 39 | request_completion: $request_completion 40 | request_body: $request_body 41 | request_body_file: $request_body_file 42 | request_length: $request_length 43 | request_time: $request_time 44 | request_id: $request_id 45 | status: $status 46 | sent_http_content_type: $sent_http_content_type 47 | sent_http_content_length: $sent_http_content_length 48 | sent_http_location: $sent_http_location 49 | sent_http_last_modified: $sent_http_last_modified 50 | sent_http_connection: $sent_http_connection 51 | sent_http_keep_alive: $sent_http_keep_alive 52 | sent_http_transfer_encoding: $sent_http_transfer_encoding 53 | sent_http_cache_control: $sent_http_cache_control 54 | sent_http_link: $sent_http_link 55 | limit_rate: $limit_rate 56 | connection: $connection 57 | connection_requests: $connection_requests 58 | nginx_version: $nginx_version 59 | hostname: $hostname 60 | pid: $pid 61 | msec: $msec 62 | time_iso8601: $time_iso8601 63 | time_local: $time_local 64 | tcpinfo_rtt: $tcpinfo_rtt 65 | tcpinfo_rttvar: $tcpinfo_rttvar 66 | tcpinfo_snd_cwnd: $tcpinfo_snd_cwnd 67 | tcpinfo_rcv_space: $tcpinfo_rcv_space 68 | http_: $http_ 69 | sent_http_: $sent_http_ 70 | sent_trailer_: $sent_trailer_ 71 | cookie_: $cookie_ 72 | arg_: $arg_ 73 | "; 74 | } -------------------------------------------------------------------------------- /extras/cron/certbot-renew: -------------------------------------------------------------------------------- 1 | #renew LE certificates every monday at 6:45 2 | 45 6 * * 1 certbot renew --post-hook "systemctl reload nginx" -------------------------------------------------------------------------------- /extras/fail2ban/filter.d/nginx-404.conf: -------------------------------------------------------------------------------- 1 | # 404 scan blocker: /etc/fail2ban/filter.d/nginx-404.conf: 2 | # 3 | # Block IPs generate many 404 4 | # 5 | # Matches e.g. 6 | # ip.ip.ip.ip - - [14/Jul/2015:16:54:53 +0200] "GET /404.php HTTP/1.0" 404 7 | 8 | [Definition] 9 | failregex = ^ .* "(GET|POST|HEAD) /.*" 404 10 | ignoreregex = 11 | -------------------------------------------------------------------------------- /extras/fail2ban/filter.d/wp-auth-failed.conf: -------------------------------------------------------------------------------- 1 | # WordPress brute force auth filter: /etc/fail2ban/filter.d/wp-auth-failed.conf: 2 | # 3 | # Block IPs trying to auth wp wordpress - only failed logins - you need to use mu-plugin 4 | # 5 | # Matches e.g. 6 | # ip.ip.ip.ip - - [16/Oct/2014:11:40:50 +0200] "POST /wp-login.php HTTP/1.0" 401 1531 "-" "-" 7 | # 8 | [Definition] 9 | failregex = ^ .* "POST /wp-login.php.*" 401 10 | ignoreregex = 11 | -------------------------------------------------------------------------------- /extras/fail2ban/filter.d/wp-auth.conf: -------------------------------------------------------------------------------- 1 | # WordPress brute force auth filter: /etc/fail2ban/filter.d/wp-auth.conf: 2 | # 3 | # Block IPs trying to auth wp wordpress 4 | # 5 | # Matches e.g. 6 | # ip.ip.ip.ip - - [16/Oct/2014:11:40:50 +0200] "POST /wp-login.php HTTP/1.0" 200 1531 "-" "-" 7 | # 8 | [Definition] 9 | failregex = ^ .* "POST /wp-login.php 10 | ignoreregex = 11 | -------------------------------------------------------------------------------- /extras/fail2ban/filter.d/wp-strange.conf: -------------------------------------------------------------------------------- 1 | # WordPress strange 40x requests filter: /etc/fail2ban/filter.d/wp-strange.conf: 2 | # 3 | [Definition] 4 | failregex = ^ .* "(GET|POST|HEAD) /.*(adminer|xxxxxx|backup|dump|\.sql|\.tar|~|searchreplacedb2|wallet\.dat|wp-config\.php|download|upload|eval\(|get_data(); 31 | //unset sensitive fields 32 | if(preg_replace('/[\W]+/', '',$data['name']) == preg_replace('/[\W]+/', '',$data['slug'])) $data['name']="Author"; 33 | unset($data['link']); 34 | unset($data['slug']); 35 | unset($data['avatar_urls']); 36 | //set data back 37 | $response->set_data($data); 38 | } 39 | return $response; 40 | } 41 | 42 | // Comment endpoint 43 | function lynt_remove_sensitive_data_from_rest_comment( $response ) { 44 | 45 | if(!current_user_can('list_users')){ 46 | 47 | //get WP_REST_Response 48 | $data = $response->get_data(); 49 | //unset sensitive fields 50 | unset($data['author_avatar_urls']); 51 | //set data back 52 | $response->set_data($data); 53 | } 54 | return $response; 55 | } 56 | 57 | 58 | add_filter( 'rest_prepare_user', 'lynt_remove_sensitive_data_from_rest_user'); 59 | add_filter( 'rest_prepare_comment', 'lynt_remove_sensitive_data_from_rest_comment'); 60 | 61 | // Return 401 code after failed login, useful for fail2ban 62 | function lynt_failed_login_401() { 63 | status_header( 401 ); 64 | } 65 | add_action( 'wp_login_failed', 'lynt_failed_login_401' ); 66 | 67 | 68 | // Beta: Logs users out if they log in from a new IP - protection against leaking auth cookies. 69 | // With this approach, there will be only one user session bound to an IP address. 70 | function new_ip_invalidate_sessions() { 71 | if (is_user_logged_in()) { 72 | $user_id = get_current_user_id(); 73 | $current_ip = $_SERVER['REMOTE_ADDR']; 74 | 75 | $session_tokens = get_user_meta($user_id, 'session_tokens', true); 76 | $sessions = maybe_unserialize($session_tokens); 77 | 78 | if (is_array($sessions)) { 79 | foreach ($sessions as $token => $session) { 80 | if ($session['ip'] !== $current_ip) { 81 | WP_Session_Tokens::get_instance($user_id)->destroy_all(); 82 | break; 83 | } 84 | } 85 | } 86 | } 87 | } 88 | //add_action('init', 'new_ip_invalidate_sessions'); 89 | -------------------------------------------------------------------------------- /extras/mu-plugins/lynt-mailfixer.php: -------------------------------------------------------------------------------- 1 | From = "lynt@example.com"; 20 | //Set custom From Name 21 | //$phpmailer->FromName = 'Vlada Smitka'; 22 | 23 | //Set Sender (Return-Path) to From address 24 | $phpmailer->Sender = $phpmailer->From; 25 | 26 | //Setup your own SMTP server 27 | /* 28 | $phpmailer->Host = 'smpt.server'; 29 | $phpmailer->Port = 465; 30 | $phpmailer->SMTPSecure = 'tls'; 31 | $phpmailer->Username = 'jmeno'; 32 | $phpmailer->Password = 'heslo'; 33 | $phpmailer->SMTPAuth = true; 34 | $phpmailer->IsSMTP(); 35 | */ 36 | } 37 | -------------------------------------------------------------------------------- /extras/mu-plugins/lynt-mo-cache-igb.php: -------------------------------------------------------------------------------- 1 | $data['mtime']) { 40 | if (!$mo->import_from_file($mofile)) return false; 41 | // prepare structure 42 | $data = array( 43 | 'mtime' => $mtime, 44 | 'file' => $mofile, 45 | 'entries' => $mo->entries, 46 | 'headers' => $mo->headers 47 | ); 48 | 49 | // export mo object 50 | file_put_contents($cache_file, igbinary_serialize($data), LOCK_EX); 51 | } else { 52 | $mo->entries = $data['entries']; 53 | $mo->headers = $data['headers']; 54 | } 55 | if (isset($l10n[$domain])) { 56 | $mo->merge_with($l10n[$domain]); 57 | } 58 | $l10n[$domain] = &$mo; 59 | return true; 60 | } 61 | 62 | add_filter('override_load_textdomain', 'lynt_load_textdomain', 0, 3); 63 | 64 | -------------------------------------------------------------------------------- /extras/mu-plugins/lynt-mo-cache.php: -------------------------------------------------------------------------------- 1 | $data['mtime']) { 47 | if (!$mo->import_from_file($mofile)) return false; 48 | // prepare structure 49 | $data = array( 50 | 'mtime' => $mtime, 51 | 'file' => $mofile, 52 | 'entries' => $mo->entries, 53 | 'headers' => $mo->headers 54 | ); 55 | 56 | // export mo object 57 | $val = var_export($data, true); 58 | // replace the original class with reconstruction fake class 59 | $val = str_replace('Translation_Entry::', 'Lynt_Translation_Entry::', $val); 60 | // save to file 61 | file_put_contents($cache_file, 'entries = $data['entries']; 65 | $mo->headers = $data['headers']; 66 | } 67 | if (isset($l10n[$domain])) { 68 | $mo->merge_with($l10n[$domain]); 69 | } 70 | $l10n[$domain] = &$mo; 71 | return true; 72 | } 73 | 74 | add_filter('override_load_textdomain', 'lynt_load_textdomain', 0, 3); 75 | -------------------------------------------------------------------------------- /extras/mu-plugins/lynt-team-cookie.php: -------------------------------------------------------------------------------- 1 | |%3E)") { set $susquery 1; } 64 | if ($args ~* "mosConfig_[a-zA-Z_]{1,21}(=|%3D)") { set $susquery 1; } 65 | if ($args ~* "base64_encode") { set $susquery 1; } 66 | if ($args ~* "eval\(") { set $susquery 1; } 67 | if ($args ~* "file_put_contents") { set $susquery 1; } 68 | if ($args ~* "(%24&x)") { set $susquery 1; } 69 | if ($args ~* "("|'|<|>|\|{|||%24&x)"){ set $susquery 1; } 70 | if ($args ~* "(127.0)") { set $susquery 1; } 71 | if ($args ~* "(globals|encode|localhost|loopback)") { set $susquery 1; } 72 | if ($args ~* "(insert|concat|union|declare)") { set $susquery 1; } 73 | if ($args ~* "^loggedout=true"){ set $susquery 0; } 74 | if ($args ~* "^action=jetpack-sso"){ set $susquery 0; } 75 | if ($args ~* "^action=rp"){ set $susquery 0; } 76 | if ($http_cookie ~* "^.*wordpress_logged_in_.*$"){ set $susquery 0; } 77 | if ($http_referer ~* "^http://maps.googleapis.com(.*)$"){ set $susquery 0; } 78 | if ($susquery = 1) { return 403; } 79 | 80 | ##allow login page only from Czech Republic 81 | #location ~ ^/(wp-login\.php) { 82 | # include country-cz; 83 | #} 84 | 85 | #basic HTTP header for security 86 | add_header X-Frame-Options SAMEORIGIN; 87 | add_header X-XSS-Protection "1; mode=block"; 88 | add_header X-Content-Type-Options nosniff; 89 | --------------------------------------------------------------------------------