Nginx 기반 워드프레스 7G Firewall로 보안 처리하기

sudo nano /etc/nginx/7g-firewall.conf

# 7G FIREWALL - NGINX VERSION
# @ https://perishablepress.com/7g-firewall/

# 1. BAD QUERY STRINGS (악성 쿼리 스트링 차단)
if ($query_string ~* "([a-z0-9]{2000,})") { return 403; }
if ($query_string ~* "(base64_encode)(.*)(\()") { return 403; }
if ($query_string ~* "(eval\()") { return 403; }
if ($query_string ~* "(GLOBALS)(=|\[|%)") { return 403; }
if ($query_string ~* "(_REQUEST)(=|\[|%)") { return 403; }
if ($query_string ~* "([a-z0-9]{2000,})") { return 403; }
if ($query_string ~* "(<|%3C)(.*)(script)(.*)(>|%3E)") { return 403; }
if ($query_string ~* "(\+|%2B)(concat|delete|get|select|union)(\+|%2B)") { return 403; }
if ($query_string ~* "(union)(.*)(select)(.*)(\()") { return 403; }
if ($query_string ~* "(etc\/passwd)") { return 403; }

# 2. BAD USER AGENTS (악성 봇 차단)
if ($http_user_agent ~* "(binlar|casper|cmsworldmap|comodo|diavol|dotbot|feedfinder|flicky|ia_archiver|jakarta|kmccrew|nutch|planetwork|purebot|pycurl|skygrid|snoopy|turnit|vikspider|zmeu)") { return 403; }
if ($http_user_agent ~* "(havij|libwww-perl|nikto|nmap|sqlmap|w3af|whitehat|zmeu)") { return 403; }

# 3. BAD REQUEST URIs (시스템 파일 및 악성 경로 접근 차단)
if ($request_uri ~* "(\.|%2e)(\.|%2e)(f|%2f)") { return 403; } # Directory Traversal
if ($request_uri ~* "(\/)(etc|var)(\/)(hidden|secret|shadow|passwd|tmp)(.*)$") { return 403; }
if ($request_uri ~* "(\/)(boot|conf|bin|ini|log|mk|mysql|niche|old|sql|sys|temp|test|tmp|local|install)(\/)(.*)$") { return 403; }
if ($request_uri ~* "(\.7z|\.bak|\.bz2|\.conf|\.dist|\.fla|\.git|\.inc|\.ini|\.log|\.old|\.psd|\.rar|\.sql|\.swp|\.tar|\.tgz)$") { return 403; }
if ($request_uri ~* "(=)(\$|%24)(_)") { return 403; } # PHP Variable injection

# 4. BAD REFERRERS (악성 리퍼러 차단)
if ($http_referer ~* "(semalt.com|todaperfeita.com|seoanalyses.com|buttons-for-website.com)") { return 403; }

sudo nano /etc/nginx/sites-available/wordpress

server {
    # 1. GeoIP 차단
    if ($geoip_country_code ~* (CN|RU|UA|KP|NG|RO|IR|BR|VN|IN|MY|ID|DE|ES|SY)) {
        return 444; 
    }

    # [여기에 추가!] 2. Nginx 7G Firewall (악성 요청 차단)
    include /etc/nginx/7g-firewall.conf;

    listen 443 ssl http2;
    # ... (이하 기존 설정 유지) ...

sudo systemctl restart nginx