Recently we mentioned the importance of security companies checking to make sure that websites they are being contacted about cleaning are in fact hacked. The reason for that is often problems unrelated to a hack are believed to beloved to be caused one, leading to people looking for unnecessary cleanups.
In one reason situation the person who contacted us was sure that their WordPress website was hacked due to rules (or code) in the web.config, which is a configuration for websites being hosted on IIS web servers, for the website that actually were there to protect the website.
As an example of what was at issue, the following rule would restrict accessing .php files in the WordPress uploads directory, which would prevent a hacker from running code if they could upload .php files through some vulnerability:
<rule name="Deny scripts from wp-content/uploads for WordPress instance #6" enabled="true" stopProcessing="true"> <match url="^wp-content/uploads/.+\.php" /> <conditions /> <serverVariables /> <action type="CustomResponse" statusCode="403" statusReason="Forbidden" statusDescription="Forbidden" /> </rule> |
The rules may have been generated by the Plesk control panel.
Here are all the rules in question in case someone else is searching for information on this:
<rule name="Block wp-config.php for WordPress instances" enabled="true" stopProcessing="true"> <match url="wp-config.php" /> <conditions /> <serverVariables /> <action type="CustomResponse" statusCode="403" statusReason="Forbidden" statusDescription="Forbidden" /> </rule> <rule name="Deny scripts from wp-includes for WordPress instance #6" enabled="true" stopProcessing="true"> <match url="^wp-includes/.+\.php" /> <conditions> <add input="{REQUEST_URI}" pattern="^/wp-includes/js/tinymce/wp-tinymce\.php$" ignoreCase="false" negate="true" /> </conditions> <serverVariables /> <action type="CustomResponse" statusCode="403" statusReason="Forbidden" statusDescription="Forbidden" /> </rule> <rule name="Deny scripts from wp-content/uploads for WordPress instance #6" enabled="true" stopProcessing="true"> <match url="^wp-content/uploads/.+\.php" /> <conditions /> <serverVariables /> <action type="CustomResponse" statusCode="403" statusReason="Forbidden" statusDescription="Forbidden" /> </rule> |