# BEGIN HMWP_RULES if (!-e $request_filename) { rewrite ^/([_0-9a-zA-Z-]+/)?core/modules/121457d304/(.*) /wp-content/plugins/query-monitor/$2 last; rewrite ^/([_0-9a-zA-Z-]+/)?core/modules/d0f4711431/(.*) /wp-content/plugins/hide-my-wp/$2 last; rewrite ^/([_0-9a-zA-Z-]+/)?core/modules/934d581a4a/(.*) /wp-content/plugins/gravityforms/$2 last; rewrite ^/([_0-9a-zA-Z-]+/)?core/modules/9a7da1ae4d/(.*) /wp-content/plugins/advanced-custom-fields-pro/$2 last; rewrite ^/([_0-9a-zA-Z-]+/)?core/modules/2ee5e7156a/(.*) /wp-content/plugins/affiliate-wp/$2 last; rewrite ^/([_0-9a-zA-Z-]+/)?core/modules/80a37b3ef0/(.*) /wp-content/plugins/affiliatewp-affiliate-portal/$2 last; rewrite ^/([_0-9a-zA-Z-]+/)?core/modules/9dd6cf765c/(.*) /wp-content/plugins/capability-manager-enhanced/$2 last; rewrite ^/([_0-9a-zA-Z-]+/)?core/modules/5186ba8c66/(.*) /wp-content/plugins/code-snippets/$2 last; rewrite ^/([_0-9a-zA-Z-]+/)?core/modules/913ca51c2d/(.*) /wp-content/plugins/dynamic-content-for-elementor/$2 last; rewrite ^/([_0-9a-zA-Z-]+/)?core/modules/e40d8e980a/(.*) /wp-content/plugins/dynamic-shortcodes/$2 last; rewrite ^/([_0-9a-zA-Z-]+/)?core/modules/f0ffe776ee/(.*) /wp-content/plugins/edit-author-slug/$2 last; rewrite ^/([_0-9a-zA-Z-]+/)?core/modules/ccc473c329/(.*) /wp-content/plugins/elementor-pro/$2 last; rewrite ^/([_0-9a-zA-Z-]+/)?core/modules/f65f29574d/(.*) /wp-content/plugins/elementor/$2 last; rewrite ^/([_0-9a-zA-Z-]+/)?core/modules/485c463dd9/(.*) /wp-content/plugins/ewww-image-optimizer/$2 last; rewrite ^/([_0-9a-zA-Z-]+/)?core/modules/2cf0af4652/(.*) /wp-content/plugins/gp-file-upload-pro/$2 last; rewrite ^/([_0-9a-zA-Z-]+/)?core/modules/0330acb2b1/(.*) /wp-content/plugins/gp-media-library/$2 last; rewrite ^/([_0-9a-zA-Z-]+/)?core/modules/b421b02346/(.*) /wp-content/plugins/gp-populate-anything/$2 last; rewrite ^/([_0-9a-zA-Z-]+/)?core/modules/1c78073b69/(.*) /wp-content/plugins/gravityformsadvancedpostcreation/$2 last; rewrite ^/([_0-9a-zA-Z-]+/)?core/modules/7273edb58d/(.*) /wp-content/plugins/media-file-renamer-pro/$2 last; rewrite ^/([_0-9a-zA-Z-]+/)?core/modules/65278b981c/(.*) /wp-content/plugins/premium-addons-for-elementor/$2 last; rewrite ^/([_0-9a-zA-Z-]+/)?core/modules/683e57003e/(.*) /wp-content/plugins/premium-addons-pro/$2 last; rewrite ^/([_0-9a-zA-Z-]+/)?core/modules/7d390da9b5/(.*) /wp-content/plugins/spellbook/$2 last; rewrite ^/([_0-9a-zA-Z-]+/)?core/modules/35acb6ef1d/(.*) /wp-content/plugins/wc-frontend-manager/$2 last; rewrite ^/([_0-9a-zA-Z-]+/)?core/modules/9d2a2b9ec9/(.*) /wp-content/plugins/wc-multivendor-marketplace/$2 last; rewrite ^/([_0-9a-zA-Z-]+/)?core/modules/a3b48fe788/(.*) /wp-content/plugins/wc-multivendor-membership/$2 last; rewrite ^/([_0-9a-zA-Z-]+/)?core/modules/39d10ee62c/(.*) /wp-content/plugins/woocommerce/$2 last; rewrite ^/([_0-9a-zA-Z-]+/)?core/modules/25ca6d0a23/(.*) /wp-content/plugins/wp-seopress-pro/$2 last; rewrite ^/([_0-9a-zA-Z-]+/)?core/modules/a5b0b36c35/(.*) /wp-content/plugins/wp-seopress/$2 last; rewrite ^/([_0-9a-zA-Z-]+/)?core/modules/(.*) /wp-content/plugins/$2 last; rewrite ^/([_0-9a-zA-Z-]+/)?core/views/7a3fccae50/design.css$ /wp-content/themes/hello-elementor/style.css; rewrite ^/([_0-9a-zA-Z-]+/)?core/views/7a3fccae50/(.*) /wp-content/themes/hello-elementor/$2 last; rewrite ^/([_0-9a-zA-Z-]+/)?core/views/(.*) /wp-content/themes/$2 last; rewrite ^/([_0-9a-zA-Z-]+/)?storage/(.*) /wp-content/uploads/$2 last; rewrite ^/([_0-9a-zA-Z-]+/)?core/(.*) /wp-content/$2 last; rewrite ^/([_0-9a-zA-Z-]+/)?lib/(.*) /wp-includes/$2 last; rewrite ^/([_0-9a-zA-Z-]+/)?comments/(.*) /wp-comments-post.php$2 last; } # END HMWP_RULES # BEGIN HMWP_VULNERABILITY set $cond ""; if ($http_cookie !~* "wordpress_logged_in_|hmwp_logged_in_") { set $cond cookie; } if ($request_uri ~* author=\d+$) { set $cond "${cond}+author_uri"; } if ($cond = "cookie+author_uri") { return 404; } add_header Strict-Transport-Security "max-age=15768000;includeSubdomains"; add_header Content-Security-Policy "object-src 'none'"; add_header X-XSS-Protection "1; mode=block"; if ( $remote_addr = "35.214.130.87" ) { return 404; } if ( $remote_addr = "192.185.4.40" ) { return 404; } if ( $remote_addr = "15.235.50.223" ) { return 404; } if ( $remote_addr = "172.105.48.130" ) { return 404; } if ( $remote_addr = "167.99.233.123" ) { return 404; } if ( $http_user_agent ~ "wpthemedetector" ) { return 404; } if ( $http_referer ~ "wpthemedetector" ) { return 404; } if ( $http_user_agent ~ "builtwith" ) { return 404; } if ( $http_user_agent ~ "isitwp" ) { return 404; } if ( $http_user_agent ~ "wapalyzer" ) { return 404; } if ( $http_referer ~ "mShots" ) { return 404; } if ( $http_referer ~ "WhatCMS" ) { return 404; } set $cond ""; if ($remote_addr = "141.193.213.10" ) { set $cond "whitelist"; } if ($remote_addr = "141.193.213.11" ) { set $cond "whitelist"; } if ($remote_addr = "204.48.29.92" ) { set $cond "whitelist"; } if ($remote_addr = "193.138.6.5" ) { set $cond "whitelist"; } if ($remote_addr = "172.66.43.54" ) { set $cond "whitelist"; } if ($remote_addr = "172.66.40.202" ) { set $cond "whitelist"; } if ($remote_addr = "72.65.248.110" ) { set $cond "whitelist"; } if ($remote_addr = "2600:4041:3ef:bd00:c0ad:7ba4:230a:2949" ) { set $cond "whitelist"; } if ($remote_addr = "178.62.81.205" ) { set $cond "whitelist"; } if ($remote_addr = "46.101.77.196" ) { set $cond "whitelist"; } if ($remote_addr = "178.62.71.222" ) { set $cond "whitelist"; } if ($remote_addr = "159.65.180.53" ) { set $cond "whitelist"; } if ($http_cookie !~* "wordpress_logged_in_|hmwp_logged_in_") { set $cond "${cond}cookie"; } if ($request_uri ~* ^/wp-content/?$) { set $cond "${cond}+deny_uri"; } if ($request_uri ~* ^/wp-content/[^\.]+/?$) { set $cond "${cond}+deny_uri"; } if ($request_uri ~* ^/wp-includes/?$) { set $cond "${cond}+deny_uri"; } if ($request_uri ~* ^/wp-content/plugins/[^\.]+(\.php|\.htm|\.html|\.rtf|\.rtx|\.txt|\.lock)) { set $cond "${cond}+deny_uri"; } if ($request_uri ~* ^/wp-content/themes/[^\.]+(\.php|\.htm|\.html|\.rtf|\.rtx|\.txt|\.lock)) { set $cond "${cond}+deny_uri"; } if ($request_uri ~* ^/wp-content/uploads/[^\.]+(\.php|\.htm|\.html|\.rtf|\.rtx|\.txt|\.lock)) { set $cond "${cond}+deny_uri"; } if ($request_uri ~* ^/wp-includes/[^\.]+(\.php|\.htm|\.html|\.rtf|\.rtx|\.txt|\.lock)) { set $cond "${cond}+deny_uri"; } if ($request_uri ~* ^/wp-admin/(install.php|upgrade.php)) { set $cond "${cond}+deny_uri"; } if ($cond = "cookie+deny_uri") { return 404; } location ~ ^/(wp-config-sample.php|readme.html|readme.txt|install.php|license.txt|php.ini|bb-config.php|error_log|debug.log) { deny all; } # END HMWP_VULNERABILITY