Warm tip: This article is reproduced from serverfault.com, please click

其他-Nginx Wordpress锁定WP-Admin和Admin dashboard

(Nginx Wordpress Locking Down WP-Admin and Admin Dashboard)

发布于 2021-03-19 08:18:11

我正在尝试使用以下代码关闭对wp-admin的访问。

是的,如果我转到example.com/wp-admin,它会起作用,但我将被阻止。但是,如果我以admin身份登录并且键入example.com/wp-admin/index.php,我仍然可以进入并使用 dashboard 。

或者,我只需键入example.com/wp-admin/index.php并仍然可以从那里登录。

我该如何纠正这个问题,以使根本无法在* / wp-admin /(任何)上进行访问?除了ajax。

或者,是否有任何方法可以关闭管理 dashboard (例如,从wp设置等)?

非常感谢你的时间

# Deny brute force access to wp-login.php
location = /wp-login\.php {
    limit_req zone=one burst=1 nodelay;
    fastcgi_pass unix:/var/run/php7.3-fpm.sock;     
}

# Add trailing slash to */wp-admin requests.
rewrite /wp-admin$ $scheme://$host$uri/ permanent;

# Don't cache uris containing the following segments
if ($request_uri ~* "/wp-admin/|/wp-json/|/xmlrpc.php|wp-.*.php|/feed/|index.php|sitemap(_index)?.xml") {
    set $skip_cache 1;
}

# Block wp-admin by IP
location ~* ^/wp-(admin\.php|login\.php|admin/*$|admin/.*\.php) {
    deny all;
    error_page 403 = @wp_admin_ban;
}

location @wp_admin_ban {
    rewrite ^(.*) https://example.com permanent;
}

location /wp-admin/admin-ajax.php {
    allow all;
}
Questioner
Call Me Hi Hi
Viewed
0
Brennen Smith 2019-01-26 05:51:55

你应该能够调整你的正则表达式:

# Block wp-admin by IP
location ~* ^\/wp-(admin\.php|login\.php|admin\/.*|includes\/.*) {
    allow 127.0.0.1; # and other IP's...
    include common/acl.conf; # a method to share code between locations for blocking by IP. 
    deny all;
    error_page 403 = @wp_admin_ban;
}

修复了前导斜杠以及admin / *和include / *下的通配符。