Reducir Spam y Asegurar WordPress con .htaccess

Por: Mr. FotoPex Leave a reply »

 

 

Por si no lo sabias "serversignature" es un texto en los mensajes de error que indica la versión de Apache que usamos e incluso el email del administrador.
Esta es la recopilación de unos trucos y para asegurar WordPress desde .htaccess

Texto Plano
PHP:
  1. # Desactivar la firma de servidor
  2. ServerSignature Off
  3.  
  4. # Desactivar el listado de carpetas y archivos
  5. Options All -Indexes
  6.  
  7. # Protegiendo el mismo fichero htaccess
  8. <files .htaccess>
  9. order allow,deny
  10. deny from all
  11. </files>
  12.  
  13. # Protegiendo htaccess de manera extrema
  14. <files ~ "^.*.([Hh][Tt][Aa])">
  15.  order allow,deny
  16.  deny from all
  17.  satisfy all
  18. </files>
  19.  
  20. # Protegiendo wp-admin por IP
  21. AuthUserFile /dev/null
  22. AuthGroupFile /dev/null
  23. AuthName “Access Control”
  24. AuthType Basic
  25. order deny,allow
  26. deny from all
  27. # IP cuando estoy en casa
  28. allow from xx.xxx.xxx.xx
  29. # IP cuando estoy en el trabajo
  30. allow from xx.xxx.xxx.xxx
  31. allow from xxx.xxx.xxx.200
  32. # IP de otro usuario con permisos
  33. allow from xxx.xxx.x.xx
  34.  
  35. # Protegiendo el fichero wpconfig.php
  36. <files wp-config.php>
  37. order allow,deny
  38. deny from all
  39. </files>
  40.  
  41. # Protegiéndonos de los commentarios spam
  42. <IfModule mod_rewrite.c>
  43. RewriteEngine On
  44. RewriteCond %{REQUEST_METHOD} POST
  45. RewriteCond %{REQUEST_URI} .wp-comments-post.php*
  46. RewriteCond %{HTTP_REFERER} !.*tusitio.com* [OR]
  47. RewriteCond %{HTTP_USER_AGENT} ^$
  48. RewriteRule (.*) ^http://%{REMOTE_ADDR}/$ [R=301,L]
  49. </IfModule>
  50.  
  51. # Desactivando el hotlinking con  un mensaje de aviso
  52. <IfModule mod_rewrite.c>
  53. RewriteEngine On
  54. RewriteCond %{HTTP_REFERER} !^$
  55. RewriteCond %{HTTP_REFERER} !^http://www.xyz.com/.*$ [NC]
  56. RewriteCond %{HTTP_REFERER} !^http://www.xyz.com$ [NC]
  57. RewriteCond %{HTTP_REFERER} !^http://xyz.com/.*$ [NC]
  58. RewriteCond %{HTTP_REFERER} !^http://xyz.com$ [NC]
  59. RewriteCond %{HTTP_REFERER} !google. [NC]
  60. RewriteCond %{HTTP_REFERER} !msn. [NC]
  61. RewriteCond %{HTTP_REFERER} !live. [NC]
  62. RewriteCond %{HTTP_REFERER} !yahoo. [NC]
  63. RewriteCond %{HTTP_REFERER} !gravatar. [NC]
  64. RewriteCond %{HTTP_REFERER} !search?q=cache [NC]
  65. RewriteRule .*.(jpg|jpeg|gif|png|bmp)$ - [F,NC]
  66. </IfModule>
  67.  
  68. # Baneo por IP
  69. <Limit GET POST>
  70.  order allow,deny
  71.  deny from xx.xx.xxx.xxx /aquí pones la IP a banear
  72.  allow from all
  73. </Limit>
  74.  
  75. # Baneo por dominio
  76. RewriteEngine On
  77. Options +FollowSymlinks
  78. RewriteCond %{HTTP_REFERER} dominio_a_banear.com [NC]
  79. RewriteRule .* - [F]
  80.  
  81. # Evitar splogs
  82. RewriteEngine On
  83. RewriteCond %{REQUEST_METHOD} POST
  84. RewriteCond %{REQUEST_URI} .wp-signup.php*
  85. RewriteCond %{HTTP_REFERER} !.*tusitio.com.* [OR]
  86. RewriteCond %{HTTP_USER_AGENT} ^$
  87. RewriteRule (.*) http://disney.com/ [R=301,L]

Si quieres especificar un poco más los robots de spam, puedes bloquear directamente las llamadas de estos a través de .htaccess

Texto Plano
PHP:
  1. #Bloquear spambots
  2. RewriteCond %{HTTP:User-Agent} (?:Alexibot|Art-Online|asterias|BackDoorbot|Black.Hole|BlackWidow|BlowFish|botALot|BuiltbotTough|Bullseye|BunnySlippers|Cegbfeieh|Cheesebot|CherryPicker|ChinaClaw|CopyRightCheck|cosmos|Crescent|Custo|DISCo|DittoSpyder|DownloadsDemon|\eCatch|EirGrabber|EmailCollector|EmailSiphon|EmailWolf|EroCrawler|ExpresssWebPictures|ExtractorPro|EyeNetIE|FlashGet|Foobot|FrontPage|GetRight|GetWeb!|Go-Ahead-Got-It|Go!Zilla|GrabNet|Grafula|Harvest|hloader|HMView|httplib|HTTrack|humanlinks|ImagesStripper|ImagesSucker|IndysLibrary|InfonaviRobot|InterGET|Internet\sNinja|Jennybot|JetCar|JOC\sWeb\sSpider|Kenjin.Spider|Keyword.Density|larbin|LeechFTP|Lexibot|libWeb/clsHTTP|LinkextractorPro|LinkScan/8.1a.Unix|LinkWalker|lwptrivial|Mass\sDownloader|Mata.Hari|Microsoft.URL|MIDown\stool|MIIxpc|Mister.PiX|Mister\sPiX|moget|Mozilla/3.Mozilla/2.01|Mozilla.*NEWT|Navroad|NearSite|NetAnts|NetMechanic|NetSpider|Net\sVampire|\NetZIP|NICErsPRO|NPbot|Octopus|Offline.Explorer|Offline\sExplorer|Offline\sNavigator|Openfind|Pagerabber|Papa\sFoto|pavuk|pcBrowser|Program\sShareware\s1|ProPowerbot/2.14|ProWebWalker|ProWebWalker|\psbot/0.1|QueryN.Metasearch|ReGet|RepoMonkey|RMA|SiteSnagger|SlySearch|SmartDownload|Spankbot|spanner|Superbot|SuperHTTP|Surfbot|suzuran|Szukacz/1.4|tAkeOut|Teleport|Teleport\sPro|Telesoft|The.Intraformant|TheNomad|TightTwatbot|Titan|toCrawl/UrlDispatcher|toCrawl/UrlDispatcher|True_Robot|turingos|Turnitinbot/1.5|URLy.Warning|VCI|VoidEYE|WebAuto|WebBandit|WebCopier|WebEMailExtrac.*|WebEnhancer|WebFetch|WebGo\sIS|Web.Image.Collector|Web\sImage\sCollector|WebLeacher|WebmasterWorldForumbot|WebReaper|WebSauger|Website\seXtractor|Website.Quester|Website\sQuester|Webster.Pro|WebStripper|Web\sSucker|WebWhacker|WebZip|Wget|Widow|[Ww]eb[Bb]andit|WWW-Collector-E|WWWOFFLE|Xaldon\sWebSpider|Xenu’s|Zeus) [NC]
  3. RewriteRule .? – [F]

Revisa las lineas antes de hacer copy/paste pues debes reemplazar las lineas de ejemplo como : tusitio.com

Posted in php

Tags:

You can follow any responses to this entry through the RSS 2.0 Feed. You can leave a response , or trackback from your own site.

Advertisement

Leave a Reply

You must be logged in to post a comment.