WAF & Security Hardening
Web Application Firewall & Hardening
BlitzPress includes multiple layers of security, from the web server to the WordPress application.
7G WAF Rules
Every site’s OLS virtual host includes 7G-derived WAF rules that block:
- SQL Injection — UNION SELECT, CONCAT, DROP, benchmark, sleep
- Path Traversal — ../, /etc/passwd, /self/environ
- Code Injection — base64_encode, eval(), file_get_contents, globals
- Backdoors & Scanners — c99, phpinfo, webshell, r57, common scanner paths
- Sensitive Files — .env, .git/, .htpasswd, wp-config backups, debug.log
- Bad Bots — Acunetix, SQLMap, Nessus, Nikto, MassScanner
- Dangerous Methods — CONNECT, DEBUG, TRACE, TRACK
These rules operate at the web server level, blocking malicious requests before they reach PHP.
Security Headers
Every response includes these security headers:
| Header | Value | Purpose |
|---|---|---|
| Strict-Transport-Security | max-age=63072000; includeSubDomains; preload | Force HTTPS for 2 years |
| X-Frame-Options | SAMEORIGIN | Prevent clickjacking |
| X-Content-Type-Options | nosniff | Prevent MIME sniffing |
| Content-Security-Policy | default-src ‘self’ https: … | Control resource loading |
| Referrer-Policy | strict-origin-when-cross-origin | Limit referrer info leaking |
| Permissions-Policy | geolocation=(), microphone=(), camera=() | Disable browser APIs |
WordPress Hardening (via evo-security.php)
- File editor disabled —
DISALLOW_FILE_EDITprevents editing themes/plugins from wp-admin - Version hidden — WordPress version meta tag removed
- Login error masking — generic error messages prevent username enumeration
- REST API protection — admin usernames hidden from /wp-json/wp/v2/users/
- XML-RPC disabled — prevents brute-force via xmlrpc.php
Immutable mu-plugins
Security plugins are stored outside the webroot in /opt/blitzpress/mu-plugins/ and protected with Linux immutable flags (chattr +i). Site owners cannot modify or remove them, ensuring the security baseline is always maintained.
fail2ban
fail2ban monitors SSH login attempts and automatically bans IPs after repeated failures. It’s configured during installation and runs continuously.