From dd18d6dd6dda04b9a0b0e7c5bb9a22eb84cefaf8 Mon Sep 17 00:00:00 2001
From: myvesta <38690722+myvesta@users.noreply.github.com>
Date: Fri, 29 Mar 2024 14:51:56 +0100
Subject: [PATCH] Blocking xmlrpc.php and wp-config.php in nginx-rate-limit
 templatre for WP

---
 .../tools/rate-limit-tpl/force-https-firewall-wordpress.stpl    | 2 ++
 .../tools/rate-limit-tpl/hosting-firewall-wordpress.stpl        | 2 ++
 .../tools/rate-limit-tpl/hosting-firewall-wordpress.tpl         | 2 ++
 3 files changed, 6 insertions(+)

diff --git a/src/deb/for-download/tools/rate-limit-tpl/force-https-firewall-wordpress.stpl b/src/deb/for-download/tools/rate-limit-tpl/force-https-firewall-wordpress.stpl
index e8b5b2288..b263d6b50 100644
--- a/src/deb/for-download/tools/rate-limit-tpl/force-https-firewall-wordpress.stpl
+++ b/src/deb/for-download/tools/rate-limit-tpl/force-https-firewall-wordpress.stpl
@@ -79,6 +79,8 @@ server {
         proxy_pass      https://%ip%:%web_ssl_port%;
     }
 
+    location ~ /wp-config.php    {return 404;}
+    location ~ /xmlrpc.php       {return 404;}
     location ~ /\.ht    {return 404;}
     location ~ /\.env   {return 404;}
     location ~ /\.svn/  {return 404;}
diff --git a/src/deb/for-download/tools/rate-limit-tpl/hosting-firewall-wordpress.stpl b/src/deb/for-download/tools/rate-limit-tpl/hosting-firewall-wordpress.stpl
index e8b5b2288..b263d6b50 100644
--- a/src/deb/for-download/tools/rate-limit-tpl/hosting-firewall-wordpress.stpl
+++ b/src/deb/for-download/tools/rate-limit-tpl/hosting-firewall-wordpress.stpl
@@ -79,6 +79,8 @@ server {
         proxy_pass      https://%ip%:%web_ssl_port%;
     }
 
+    location ~ /wp-config.php    {return 404;}
+    location ~ /xmlrpc.php       {return 404;}
     location ~ /\.ht    {return 404;}
     location ~ /\.env   {return 404;}
     location ~ /\.svn/  {return 404;}
diff --git a/src/deb/for-download/tools/rate-limit-tpl/hosting-firewall-wordpress.tpl b/src/deb/for-download/tools/rate-limit-tpl/hosting-firewall-wordpress.tpl
index 49da9387d..7203b88cb 100644
--- a/src/deb/for-download/tools/rate-limit-tpl/hosting-firewall-wordpress.tpl
+++ b/src/deb/for-download/tools/rate-limit-tpl/hosting-firewall-wordpress.tpl
@@ -76,6 +76,8 @@ server {
         proxy_pass      http://%ip%:%web_port%;
     }
 
+    location ~ /wp-config.php    {return 404;}
+    location ~ /xmlrpc.php       {return 404;}
     location ~ /\.ht    {return 404;}
     location ~ /\.env   {return 404;}
     location ~ /\.svn/  {return 404;}