I have recently setup wordpress on a VPS, and it is under continuous attack since. I have taken some measures to protect from some bruteforce attacks, however looking at some of the logs I am not sure if that's enough.
Below is one of the many rough requests I see in my Apache log-
12x.24x.3x.45 - - [30/Oct/2017:20:34:24 +0000] "GET http://4x.9x.23x.250:58204/jsip.php?zl=IP&IP=3x.18x.24x.19x&DK=80&DD=RZLWHADALAHBNPRL HTTP/1.0" 301 395 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.1 (KHTML, like Gecko) Chrome/21.0.1180.92 Safari/537.1 LBBROWSER"
As far as I could understand, attacker is trying to inject and execute PHP code from remote site, and server responded with 301 (permanently moved) and response contained 395 bytes.
How can I protect server from processing such requests?
- .htaccess rule to deny values like that?
- Apache mod rewrite to reject such request?
- Sanitize from application load balancer?
- Is Apache/PHP/Wordpress vulnerable to such requests?
Shouldn't they already have this protection, and I can depend on them and relax? If not, I don't understand how so many Wordpress sites are still up, assuming that many of them probably did not have security experts working for the site.