###################################################################
###            Nginx locations for WordPress websites           ###
###################################################################
# These locations add some basic protection against common mistakes
# (like exposing a .env file). These rules are in no way complete.
# You can include them in the {,free}nginx server block. Hope it is
# useful to someone :)
# -h3artbl33d
###

###
# Regarding the robots, you can also choose to serve a static version, like:
# location = /robots.txt {
#	access_log off;
#	add_header Content-Type text/plain;
# 	return 200 "User-agent: *\nDisallow: /wp-admin/\nAllow: /wp-admin/admin-ajax.php\n\nSitemap: /sitemap_index.xml\n\nUser-agent: YandexBot\nDisallow: /\n\nUser-agent: ClaudeBot\nDisallow: /\n\nUser-agent: 360Spider\nDisallow: /\n\nUser-agent: AhrefsBot\nDisallow: /\n\nUser-agent: Baiduspider\nDisallow: /\n\nUser-agent: BLEXBot\nDisallow: /\n\nUser-agent: DotBot\nDisallow: /\n\nUser-agent: Exabot\nDisallow: /\n\nUser-agent: MJ12bot\nDisallow: /\n\nUser-agent: PetalBot\nDisallow: /\n\nUser-agent: SEOkicks-Robot\nDisallow: /\n\nUser-agent: SemrushBot\nDisallow: /\n\nUser-agent: SiteExplorer\nDisallow: /\n\nUser-agent: Sogou\nDisallow: /\n\nUser-agent: spbot\nDisallow: /\n\nUser-agent: YandexImages\nDisallow: /\n\nUser-agent: Yeti\nDisallow: /\n\nUser-agent: YisouSpider\nDisallow: /\n";
# }
###
location = /robots.txt {
	allow all;
	log_not_found off;
	access_log off;
	try_files $uri /index.php?$args;
}
location = /favicon.ico {
	try_files /favicon.ico @empty;
	access_log off;
	log_not_found off;
	expires max;
}
location @empty {
	empty_gif;
}
location ~ ^/wp-content/uploads/sucuri {
	deny all;
}
location ~ ^/wp-content/updraft {
	deny all;
}
location ~* .(pl|cgi|py|sh|lua|asp)$ {
	return 444;
}
location ~* /(wp-config.php|readme.html|license.txt|nginx.conf) {
	deny all;
}
location /wp-content/uploads/ {
	location ~ \.php$ {
		deny all;
	}
}
location /xmlrpc.php {
	deny all;
	access_log off;
	log_not_found off;
	return 444;
}
location ^~ /wp-admin/install.php {
	deny all;
	error_page 403 =404 /;
}
location ~* /(?:uploads|files)/.*\.php$ {
	deny all;
}
location ~* ^/(wp-content)/(.*?)\.(zip|gz|tar|bzip2|7z)\$ {
	deny all;
}
location ~* ^/wp-content/plugins/.+\.(txt|log|md)$ {
	deny all;
	error_page 403 =404 /;
}
location ~* ^/wp-content/themes/.+\.(txt|log|md)$ {
	deny all;
	error_page 403 =404 /;
}
location ~* ^/wp-content/uploads/.*.(html|htm|shtml|php|js|swf)$ {
	deny all;
}
location ~* ^/(license.txt|wp-includes/(.*)/.+\.(js|css)|wp-admin/(.*)/.+\.(js|css))$ {
	sub_filter_types text/css text/javascript text/plain;
	sub_filter_once on;
	sub_filter ';' '; /* $msec */ ';
}
location ~* /(?:uploads|files|wp-content|wp-includes|akismet)/.*.php$ {
	deny all;
	access_log off;
	log_not_found off;
}
location ~ /\.(svn|git)/* {
	deny all;
	access_log off;
	log_not_found off;
}
location ~ /\.ht {
	deny all;
	access_log off;
	log_not_found off;
}
location ~ /\.user.ini {
	deny all;
	access_log off;
	log_not_found off;
}
location ~* ^.+\.(bak|log|old|orig|original|php#|php~|php_bak|save|swo|swp|sql)$ {
	deny all;
	access_log off;
	log_not_found off;
}
location ~ \.user\.ini$ {
	deny all;
}
location ~* ^/(?:wp-content|wp-includes)/.*\.php$ {
	deny all;
}
location ~* ^/(?:xmlrpc\.php|wp-links-opml\.php|wp-config\.php|wp-config-sample\.php|wp-comments-post\.php|readme\.html|license\.txt)$ {
	deny all;
}
location ~ /\. {
	deny all;
}
location ~* "\.(old|orig|original|php#|php~|php_bak|save|swo|aspx?|tpl|sh|bash|bak?|cfg|cgi|dll|exe|git|hg|ini|jsp|log|mdb|out|sql|svn|swp|tar|rdf)$" {
	deny all;
}
location ~* "(eval\()" {
	deny all;
}
location ~* "(127\.0\.0\.1)" {
	deny all;
}
location ~* "([a-z0-9]{2000})" {
	deny all;
}
location ~* "(javascript\:)(.*)(\;)" {
	deny all;
}
location ~* "(base64_encode)(.*)(\()" {
	deny all;
}
location ~* "(GLOBALS|REQUEST)(=|\[|%)" {
	deny all;
}
location ~* "(<|%3C).*script.*(>|%3)" {
	deny all;
}
location ~ "(\\|\.\.\.|\.\./|~|`|<|>|\|)" {
	deny all;
}
location ~* "(boot\.ini|etc/passwd|self/environ)" {
	deny all;
}
location ~* "(thumbs?(_editor|open)?|tim(thumb)?)\.php" {
	deny all;
}
location ~* "(\'|\")(.*)(drop|insert|md5|select|union)" {
	deny all;
}
location ~* "(https?|ftp|php):/" {
	deny all;
}
location ~* "(=\\\'|=\\%27|/\\\'/?)\." {
	deny all;
}
location ~ "(\{0\}|\(/\(|\.\.\.|\+\+\+|\\\"\\\")" {
	deny all;
}
location ~ "(~|`|<|>|:|;|%|\\|\s|\{|\}|\[|\]|\|)" {
	deny all;
}
location ~* "/(=|\$&|_mm|(wp-)?config\.|cgi-|etc/passwd|muieblack)" {
	deny all;
}
location ~* "(&pws=0|_vti_|\(null\)|\{\$itemURL\}|echo(.*)kae|etc/passwd|eval\(|self/environ)" {
	deny all;
}
location ~* "/(^$|mobiquo|phpinfo|shell|sqlpatch|thumb|thumb_editor|thumbopen|timthumb|webshell|config|settings|configuration)\.php" {
	deny all;
}
