Harden WordPress sites proxied through WafX — blocks common exploits, scanners, and brute-force attacks

—

WordPress Version

—

WP Installation

—

Nginx Rules

—

XML-RPC

Disabled

Plugin Status

General Settings

WordPress Document Root Path to the directory containing wp-config.php

Target Domain (optional — leave blank for all)

Security Rules

Block XML-RPC

Deny all access to /xmlrpc.php — exploited for DDoS amplification and brute-force

Block Author Enumeration

Return 403 for /?author=N — prevents username harvesting

Block Scanner User Agents

Deny requests from WPScan, sqlmap, nikto, nmap, masscan, ZmEu, w3af, dirbuster, nuclei

Protect Upload Directory

Block PHP execution inside wp-content/uploads/ — prevents webshell upload exploitation

Protect Sensitive Files

Block access to wp-config.php, .env, .htaccess, .git

Hide WordPress Version

Strip X-Powered-By header and remove ?ver= query strings from assets

Rate-Limit Login Page

Limit requests to /wp-login.php per IP per minute to prevent brute-force

Remind: Disable File Editor

Flag if DISALLOW_FILE_EDIT is not set in wp-config.php

Custom nginx Rules

No custom rules

Proxy Pass HIGH RISK

⚠️ Misconfigured proxy_pass can lead to: IP spoofing (real client IP not forwarded to WafX / rate-limiter), HTTPS redirect loop (WordPress unaware of SSL termination), Host header injection (password-reset link poisoning), and header leakage (backend stack info exposed to clients).

Backend URL REQUIRED Upstream WordPress URL. Ensure the backend is only reachable through WafX (bind to 127.0.0.1 or restrict with a firewall).

Forward Real Client IP HIGH

Inject X-Real-IP & X-Forwarded-For. Without this, login rate-limiting is ineffective — all requests appear to originate from the WafX IP.

Forward HTTPS Scheme HIGH

Inject X-Forwarded-Proto: $scheme. Without this, WordPress treats the connection as HTTP → redirect loop, missing cookie Secure flag, mixed content.

Pass Correct Host Header HIGH

Set proxy_set_header Host $host. Without this, the site is vulnerable to Host Header Injection — attackers can poison password-reset links and emails.

Hide Backend Server Headers MEDIUM

Strip Server, X-Powered-By, X-Generator, X-WP-Nonce from responses — prevents backend stack fingerprinting.

Block Dangerous HTTP Methods MEDIUM

Return 405 for TRACE and CONNECT. TRACE can expose session cookies via XST (Cross-Site Tracing).

Enable Proxy Buffering

Enable proxy_buffering on. Improves performance — disable if the backend requires streaming responses (SSE / ndjson).

Connect Timeout (s)

Send Timeout (s)

Read Timeout (s)

Required wp-config.php additions when running behind a reverse proxy:
define('FORCE_SSL_ADMIN', true);

if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https') { $_SERVER['HTTPS'] = 'on'; }

Apply

"Apply to nginx" writes /etc/nginx/conf.d/wafx_wp_*.conf and reloads nginx. Disable the plugin to remove the snippet.

Security Checklist

nginx Snippet Preview

# Configure and click "Apply to nginx" to generate the snippet.