# CWP Fleet Security Standard - Security Hardening Rules
# Source: CWP-Hardening-Plan.md
# WordPress and scanner protection

<IfModule mod_security2.c>

# Block xmlrpc.php completely
<FilesMatch "^xmlrpc\.php$">
    Require all denied
</FilesMatch>

# wp-login.php brute force protection (>20 attempts/min = block)
SecRule REQUEST_URI "@rx (?i)^/wp-login\.php$" \
    "id:110002,phase:1,pass,nolog,setvar:ip.wplogin_hits=+1,expirevar:ip.wplogin_hits=60"
SecRule IP:WPLOGIN_HITS "@gt 20" \
    "id:110003,phase:1,deny,status:429,msg:'CWP-Hardening: wp-login.php brute force blocked'"

# xmlrpc.php abuse protection (>5 attempts/min = block)
SecRule REQUEST_URI "@rx (?i)^/xmlrpc\.php$" \
    "id:110004,phase:1,pass,nolog,setvar:ip.xmlrpc_hits=+1,expirevar:ip.xmlrpc_hits=60"
SecRule IP:XMLRPC_HITS "@gt 5" \
    "id:110005,phase:1,deny,status:429,msg:'CWP-Hardening: xmlrpc.php abuse blocked'"

# Scanner/webshell probe blocking
SecRule REQUEST_URI "@rx (?i)(^|/)(\.env($|[/?])|\.git/|aw\.php$|adminfuns\.php$|xmrlpc\.php$|unzipper\.php$|alfa\.php$|alfanew\.php$)" \
    "id:110001,phase:1,deny,status:403,msg:'CWP-Hardening: Scanner/webshell probe blocked'"

# Block PHP execution in uploads directories
<DirectoryMatch "/home/.*/public_html/wp-content/uploads">
    <FilesMatch "\.php$">
        Require all denied
    </FilesMatch>
</DirectoryMatch>

</IfModule>