\u672c\u4ee3\u7801\u4f7f\u7528Trae-solo\u81ea\u52a8\u751f\u6210\u3002\u8bf7\u6ce8\u610f\u6587\u672b\u5efa\u8bae\u90e8\u7f72\u76ee\u5f55\uff0c\u4ee5\u4fbf\u81ea\u52a8\u52a0\u8f7d \u8fd0\u884c\u3002mu stand for-must use plugin<\/p>\n\n\n\n
toolName: view_files<\/p>\n\n\n\n
status: success<\/p>\n\n\n\n
filePath: C:\/Users\/czliu\/Downloads\/access.log<\/p>\n\n\n\n
toolName: Write<\/p>\n\n\n\n
status: success<\/p>\n\n\n\n
filePath: d:\/phpstudy\/WWW\/wordpress\/wp-content\/plugins\/mu-pluge\/wp-security-mu-plugin.php<\/p>\n\n\n\n
changes: undefined<\/p>\n\n\n\n
PHP \u9632\u62a4\u4ee3\u7801\u5df2\u91cd\u65b0\u751f\u6210\u5e76\u66f4\u65b0\u5230\u60a8\u7684 WordPress \u76ee\u5f55\uff1a<\/p>\n\n\n\n
\u88ab\u62e6\u622a\u7684\u8bf7\u6c42\u4f1a\u8bb0\u5f55\u5230 toolName: view_files<\/p>\n\n\n\n status: success<\/p>\n\n\n\n filePath: d:\/phpstudy\/WWW\/wordpress\/wp-content\/mu-plugins\/wp-security-mu-plugin.php<\/p>\n\n\n\n \u8fd9\u4e2a\u63d2\u4ef6\u53ef\u4ee5\u81ea\u52a8\u8fd0\u884c\u5e76\u53d1\u6325\u4f5c\u7528<\/strong>\u3002\u539f\u56e0\u5982\u4e0b\uff1a<\/p>\n\n\n\n \u6587\u4ef6\u653e\u5728 \u6587\u4ef6\u6700\u540e\u4e00\u884c\uff1a<\/p>\n\n\n\n \u5f53 WordPress \u52a0\u8f7d\u8fd9\u4e2a\u6587\u4ef6\u65f6\uff0c\u8fd9\u884c\u4ee3\u7801\u4f1a\u7acb\u5373\u6267\u884c<\/strong>\uff0c\u521b\u5efa \u5728\u6784\u9020\u51fd\u6570\u4e2d\uff08\u7b2c 45-48 \u884c\uff09\uff1a<\/p>\n\n\n\n \u4f7f\u7528 WordPress \u7684 \u60a8\u53ef\u4ee5\u901a\u8fc7\u4ee5\u4e0b\u65b9\u5f0f\u9a8c\u8bc1\u63d2\u4ef6\u662f\u5426\u751f\u6548\uff1a<\/p>\n\n\n\n \u6240\u4ee5\u60a8\u65e0\u9700\u505a\u4efb\u4f55\u989d\u5916\u64cd\u4f5c\uff0c\u63d2\u4ef6\u5df2\u7ecf\u5728\u81ea\u52a8\u8fd0\u884c\u5e76\u4fdd\u62a4\u60a8\u7684\u7f51\u7ad9\u4e86\uff01<\/p>\n\n\n\n \u6587\u4ef6\u540d\uff1awp-security-mu-plugin.php<\/p>\n\n\n\nd:\/phpstudy\/WWW\/wordpress\/wp-content\/plugins\/mu-pluge\/wp-security-mu-plugin.php<\/code><\/p>\n\n\n\n\u65b0\u589e\/\u6539\u8fdb\u7684\u9632\u62a4\u529f\u80fd<\/h2>\n\n\n\n
\u9632\u62a4\u7c7b\u578b<\/th> \u8bf4\u660e<\/th><\/tr><\/thead> \u4e8c\u8fdb\u5236\/TLS \u653b\u51fb<\/strong><\/td> \u68c0\u6d4b \\x16\\x03<\/code> \u6a21\u5f0f\u7684 TLS \u63e1\u624b\u6570\u636e\uff0c\u4ee5\u53ca\u7a7a\u5b57\u8282\u548c\u975e ASCII \u5b57\u7b26\u5f00\u5934\u7684\u8bf7\u6c42<\/td><\/tr>\u6076\u610f User-Agent<\/strong><\/td> \u65b0\u589e\u62e6\u622a masscan\u3001nmap\u3001nikto\u3001sqlmap\u3001dirbuster\u3001burp\u3001zap\u3001wpscan \u7b49\u626b\u63cf\u5de5\u5177<\/td><\/tr> \u7a7a User-Agent<\/strong><\/td> \u62e6\u622a\u65e0 UA \u7684\u8bf7\u6c42\uff08\u6392\u9664 favicon.ico \u548c robots.txt\uff09<\/td><\/tr> \u6076\u610f\u8def\u5f84<\/strong><\/td> \u65b0\u589e\u62e6\u622a \/wp-config.php<\/code>\u3001\/.env<\/code>\u3001\/.git<\/code>\u3001\/config.php<\/code>\u3001\u5b89\u88c5\/\u5347\u7ea7\u811a\u672c<\/td><\/tr>\u8def\u5f84\u904d\u5386<\/strong><\/td> \u68c0\u6d4b ..\/<\/code> \u6a21\u5f0f\u7684\u76ee\u5f55\u7a7f\u8d8a\u653b\u51fb<\/td><\/tr>SQL \u6ce8\u5165<\/strong><\/td> \u68c0\u6d4b URL \u53c2\u6570\u4e2d\u7684 SQL \u6ce8\u5165\u5173\u952e\u5b57<\/td><\/tr> wp-cron.php \u4fdd\u62a4<\/strong><\/td> \u53ea\u5141\u8bb8 WordPress \u5b98\u65b9 UA\uff0c\u4e14\u5141\u8bb8\u5185\u7f51\u7a7f\u900f\u57df\u540d\uff08ipyingshe.net\u3001uicp.io\u3001wicp.vip\uff09<\/td><\/tr> \u901f\u7387\u9650\u5236<\/strong><\/td> \u5bf9\u5916\u7f51 IP \u6bcf\u5206\u949f 60 \u6b21\u8bf7\u6c42\u9650\u5236<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n \u65e5\u5fd7\u8bb0\u5f55<\/h2>\n\n\n\n
wp-content\/logs\/security-blocked.log<\/code>\uff0c\u683c\u5f0f\uff1a<\/p>\n\n\n\n[2026-07-23 10:00:00] Blocked: Malicious UA: scrapy | IP: 127.0.0.1 | UA: Scrapy\/2.16.0 | URI: \/?p=123 | Referer: -<\/code><\/pre>\n\n\n\n\u6ce8\u610f\u4e8b\u9879<\/h2>\n\n\n\n
\n
wp-content\/plugins\/mu-pluge\/<\/code>\uff0c\u4f46\u6807\u51c6 MU-Plugin \u76ee\u5f55\u662f wp-content\/mu-plugins\/<\/code>\u3002\u5982\u679c\u9700\u8981\u81ea\u52a8\u52a0\u8f7d\uff0c\u5efa\u8bae\u79fb\u52a8\u5230 wp-content\/mu-plugins\/wp-security-mu-plugin.php<\/code><\/li>\n\n\n\n\u5de5\u4f5c\u539f\u7406<\/h2>\n\n\n\n
1. MU-Plugin \u673a\u5236<\/h3>\n\n\n\n
wp-content\/mu-plugins\/<\/code> \u76ee\u5f55\u4e0b\uff0cWordPress \u4f1a\u81ea\u52a8\u626b\u63cf\u5e76\u52a0\u8f7d<\/strong>\u8fd9\u4e2a\u76ee\u5f55\u4e0b\u7684\u6240\u6709 .php<\/code> \u6587\u4ef6\uff0c\u4e0d\u9700\u8981\u5728\u540e\u53f0\u624b\u52a8\u6fc0\u6d3b<\/strong>\u3002<\/p>\n\n\n\n2. \u7c7b\u5b9e\u4f8b\u5316<\/h3>\n\n\n\n
new WP_Security_Shield();<\/code><\/pre>\n\n\n\nWP_Security_Shield<\/code> \u7c7b\u7684\u5b9e\u4f8b\u3002<\/p>\n\n\n\n3. \u6784\u9020\u51fd\u6570\u6ce8\u518c\u94a9\u5b50<\/h3>\n\n\n\n
public function __construct() {\n add_action('init', [$this, 'check_request']);\n add_action('template_redirect', [$this, 'rate_limiting']);\n}<\/code><\/pre>\n\n\n\nadd_action()<\/code> \u51fd\u6570\u6ce8\u518c\u4e86\u4e24\u4e2a\u94a9\u5b50\uff1a<\/p>\n\n\n\n\u94a9\u5b50<\/th> \u89e6\u53d1\u65f6\u673a<\/th> \u8c03\u7528\u65b9\u6cd5<\/th><\/tr><\/thead> init<\/code><\/td>WordPress \u521d\u59cb\u5316\u5b8c\u6210\u540e<\/td> check_request()<\/code> – \u6267\u884c\u6240\u6709\u5b89\u5168\u68c0\u67e5<\/td><\/tr>template_redirect<\/code><\/td>\u51c6\u5907\u52a0\u8f7d\u6a21\u677f\u524d<\/td> rate_limiting()<\/code> – \u6267\u884c\u901f\u7387\u9650\u5236<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n4. \u6267\u884c\u6d41\u7a0b<\/h3>\n\n\n\n
\u7528\u6237\u8bf7\u6c42 \u2192 WordPress \u52a0\u8f7d \u2192 \u81ea\u52a8\u5305\u542b mu-plugins\/*.php \u2192 new WP_Security_Shield() \n\u2192 \u6784\u9020\u51fd\u6570\u6ce8\u518c\u94a9\u5b50 \u2192 init \u94a9\u5b50\u89e6\u53d1 \u2192 check_request() \u6267\u884c\u5b89\u5168\u68c0\u67e5\n\u2192 template_redirect \u94a9\u5b50\u89e6\u53d1 \u2192 rate_limiting() \u6267\u884c\u901f\u7387\u9650\u5236<\/code><\/pre>\n\n\n\n\u9a8c\u8bc1\u65b9\u5f0f<\/h2>\n\n\n\n
\n
http:\/\/your-domain.com\/ip<\/code>\uff0c\u5e94\u8be5\u8fd4\u56de 403 Forbidden<\/code><\/li>\n\n\n\nwp-content\/logs\/security-blocked.log<\/code> \u6587\u4ef6\uff0c\u662f\u5426\u6709\u62e6\u622a\u8bb0\u5f55<\/li>\n\n\n\n\u6ce8\u610f\u4e8b\u9879<\/h2>\n\n\n\n
\n
.php<\/code> \u7ed3\u5c3e<\/li>\n\n\n\nmu-plugins<\/code> \u76ee\u5f55\u9700\u8981\u6709\u8bfb\u53d6\u6743\u9650\uff08\u901a\u5e38 755<\/code>\uff09<\/li>\n\n\n\n\u5b8c\u6574\u4ee3\u7801<\/h2>\n\n\n\n
<?php\n\ndefined('ABSPATH') || exit;\n\nclass WP_Security_Shield {\n\n private $blocked_user_agents = [\n 'scrapy',\n 'semrushbot',\n 'dotbot',\n 'go-http-client',\n 'bytespider',\n 'petalbot',\n 'dalvik',\n 'masscan',\n 'nmap',\n 'nikto',\n 'sqlmap',\n 'dirbuster',\n 'burp',\n 'zap',\n 'wpscan',\n ];\n\n private $allowed_cron_domains = [\n 'ipyingshe.net',\n 'uicp.io',\n 'wicp.vip',\n ];\n\n private $blocked_paths = [\n '\/dasfwefawfadsfdsg',\n '\/ip',\n '\/wp_scrape_key',\n '\/wp-admin\/install.php',\n '\/wp-admin\/upgrade.php',\n '\/wp-config.php',\n '\/.env',\n '\/.git',\n '\/config.php',\n ];\n\n private $rate_limit = 60;\n private $rate_limit_window = 60;\n\n public function __construct() {\n add_action('init', [$this, 'check_request']);\n add_action('template_redirect', [$this, 'rate_limiting']);\n }\n\n public function check_request() {\n $this->block_binary_requests();\n $this->block_malicious_user_agents();\n $this->block_empty_user_agent();\n $this->block_malicious_paths();\n $this->protect_wp_cron();\n }\n\n private function block_binary_requests() {\n $request_method = isset($_SERVER['REQUEST_METHOD']) ? $_SERVER['REQUEST_METHOD'] : '';\n $request_uri = isset($_SERVER['REQUEST_URI']) ? $_SERVER['REQUEST_URI'] : '';\n\n if (strlen($request_uri) > 0) {\n $first_byte = ord($request_uri[0]);\n if ($first_byte === 0x16 || $first_byte === 0x15 || $first_byte === 0x00 || $first_byte > 127) {\n $this->block_request('Binary\/TLS Handshake Attack');\n }\n }\n\n $content_length = isset($_SERVER['CONTENT_LENGTH']) ? (int)$_SERVER['CONTENT_LENGTH'] : 0;\n if ($content_length > 0) {\n $raw_data = file_get_contents('php:\/\/input');\n if ($raw_data && strlen($raw_data) >= 3) {\n $bytes = unpack('C*', substr($raw_data, 0, 3));\n if (isset($bytes[1]) && $bytes[1] === 0x16 && $bytes[2] === 0x03) {\n $this->block_request('TLS Handshake Attack');\n }\n }\n }\n }\n\n private function block_malicious_user_agents() {\n $user_agent = isset($_SERVER['HTTP_USER_AGENT']) ? strtolower($_SERVER['HTTP_USER_AGENT']) : '';\n\n foreach ($this->blocked_user_agents as $agent) {\n if (strpos($user_agent, strtolower($agent)) !== false) {\n $this->block_request('Malicious UA: ' . $agent);\n }\n }\n }\n\n private function block_empty_user_agent() {\n $user_agent = isset($_SERVER['HTTP_USER_AGENT']) ? trim($_SERVER['HTTP_USER_AGENT']) : '';\n $request_uri = isset($_SERVER['REQUEST_URI']) ? $_SERVER['REQUEST_URI'] : '';\n\n if (empty($user_agent) && !in_array($request_uri, ['\/favicon.ico', '\/robots.txt'])) {\n if (strpos($request_uri, 'wp-cron.php') === false) {\n $this->block_request('Empty User-Agent');\n }\n }\n }\n\n private function block_malicious_paths() {\n $request_uri = isset($_SERVER['REQUEST_URI']) ? strtolower($_SERVER['REQUEST_URI']) : '';\n\n foreach ($this->blocked_paths as $path) {\n if (strpos($request_uri, strtolower($path)) !== false) {\n $this->block_request('Malicious Path: ' . $path);\n }\n }\n\n if (preg_match('\/\\\/[a-zA-Z0-9]{15,}(\\\/|$)\/', $request_uri)) {\n $this->block_request('Random Path Scan');\n }\n\n if (preg_match('\/\\.\\.(\\\\\/|\\\\\\\\)\/', $request_uri)) {\n $this->block_request('Path Traversal Attack');\n }\n\n if (preg_match('\/\\?(.*?)=.*?(\\'|\"|--|union|select|insert|update|delete)\/i', $request_uri)) {\n $this->block_request('SQL Injection Attempt');\n }\n }\n\n private function protect_wp_cron() {\n if (strpos($_SERVER['REQUEST_URI'], 'wp-cron.php') !== false) {\n $user_agent = isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : '';\n\n if (!preg_match('\/WordPress\\\/[\\d.]+\/', $user_agent)) {\n $this->block_request('wp-cron.php Invalid UA');\n }\n\n foreach ($this->allowed_cron_domains as $domain) {\n if (strpos($user_agent, $domain) !== false) {\n return;\n }\n }\n }\n }\n\n public function rate_limiting() {\n $client_ip = $this->get_client_ip();\n\n if ($this->is_internal_ip($client_ip)) {\n return;\n }\n\n $cache_key = 'wp_sec_rate_' . md5($client_ip);\n\n $transient = get_transient($cache_key);\n $count = $transient ? $transient : 0;\n\n if ($count >= $this->rate_limit) {\n $this->block_request('Rate Limit Exceeded');\n }\n\n set_transient($cache_key, $count + 1, $this->rate_limit_window);\n }\n\n private function is_internal_ip($ip) {\n if (empty($ip)) {\n return false;\n }\n\n $internal_patterns = [\n '\/^127\\.\/',\n '\/^10\\.\/',\n '\/^172\\.(1[6-9]|2[0-9]|3[0-1])\\.\/',\n '\/^192\\.168\\.\/',\n '\/^::1$\/',\n '\/^fe80:\/',\n ];\n\n foreach ($internal_patterns as $pattern) {\n if (preg_match($pattern, $ip)) {\n return true;\n }\n }\n\n return false;\n }\n\n private function get_client_ip() {\n $ip_keys = [\n 'HTTP_CLIENT_IP',\n 'HTTP_X_FORWARDED_FOR',\n 'HTTP_X_FORWARDED',\n 'HTTP_X_CLUSTER_CLIENT_IP',\n 'HTTP_FORWARDED_FOR',\n 'HTTP_FORWARDED',\n 'REMOTE_ADDR'\n ];\n\n foreach ($ip_keys as $key) {\n if (isset($_SERVER[$key]) && !empty($_SERVER[$key])) {\n $ips = explode(',', $_SERVER[$key]);\n foreach ($ips as $ip) {\n $ip = trim($ip);\n if (filter_var($ip, FILTER_VALIDATE_IP)) {\n return $ip;\n }\n }\n }\n }\n\n return $_SERVER['REMOTE_ADDR'] ?? 'unknown';\n }\n\n private function block_request($reason) {\n $this->log_blocked_request($reason);\n\n status_header(403);\n header('Content-Type: text\/plain');\n echo '403 Forbidden';\n exit;\n }\n\n private function log_blocked_request($reason) {\n $log_dir = WP_CONTENT_DIR . '\/logs';\n if (!file_exists($log_dir)) {\n mkdir($log_dir, 0755, true);\n }\n\n $log_file = $log_dir . '\/security-blocked.log';\n $log_entry = sprintf(\n '[%s] Blocked: %s | IP: %s | UA: %s | URI: %s | Referer: %s' . PHP_EOL,\n date('Y-m-d H:i:s'),\n $reason,\n $this->get_client_ip(),\n isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : '-',\n isset($_SERVER['REQUEST_URI']) ? $_SERVER['REQUEST_URI'] : '-',\n isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : '-'\n );\n\n error_log($log_entry, 3, $log_file);\n }\n}\n\nnew WP_Security_Shield();<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"