1

I have noticed our website, which is Wordpress based, gets frequent daily requests from other sites where the user agent is Wordpress and the other site is obviously an already hacked Wordpress installation.

In these entries I have replaced our own domain with example.com and purpleplumm.co.za is one of those compromised sites.

105.233.38.37 - - [05/Dec/2019:12:14:44 +0000] "HEAD /services/ HTTP/1.1" 200 6102 "https://www.example.com/services/" "WordPress/4.9.12; http://www.purpleplumm.co.za"
105.233.38.37 - - [05/Dec/2019:12:14:45 +0000] "GET /services/ HTTP/1.1" 200 7136 "https://www.example.com/services/" "WordPress/4.9.12; http://www.purpleplumm.co.za"

I assume these are a sort of malicious worm trying to propagate through unsecured Wordpress installations?

I was going to block these requests by checking the user agent with a regex in Apache.

RewriteCond %{HTTP_USER_AGENT} ^Wordpress/\d
RewriteRule .* - [F]

I have two questions:

  1. Is my method sufficient to block them?
  2. Does anybody have any further insight into what they are trying to achieve with these requests? The requested resources don't seem to be common access points on a Wordpress installation (e.g. login/admin pages) or anything like that, just random pages of the site.

Edit: I forgot to add that I have lots of other security measures already in place; this is just something extra I was going to add.

| improve this question | |
  • 1
    You're likely not really accomplishing much other than reducing noise in your log files. – Steve Sether Dec 6 '19 at 17:40
  • 2
    The user agent header can easily be faked. Deciding based on the user agent is like preventing everybody wearing a hoodie to enter a shop: not everybody wearing is hoodie is dangerous and not every dangerous person wears a hoodie - especially if it is known that your defense is based on this feature only. – Steffen Ullrich Dec 6 '19 at 17:42
  • @SteffenUllrich I forgot to add this is not my only security. I was just wondering about adding this as an extra. I'm pretty sure these are simple bots scouring for common entry points, they're not specifically targeted attacks. I would probably block all of them with this. If anyone is willing to specifically spoof the user agent to bypass this on my site, the other security measures are there to prevent other points of entry. – BadHorsie Dec 6 '19 at 22:36
  • @SteveSether Could you elaborate please? Even reducing noise in my log files seems worth it to me. Would it not be worth it to block even a percentage of these requests? – BadHorsie Dec 6 '19 at 22:37
  • @BadHorsie SteffenUlrich has already conveyed the essence of what I'd say. Reducing noise in logs is indeed often worth it, but you just have to understand that's why you're doing it. – Steve Sether Dec 7 '19 at 0:23
2
  1. Your method is sufficient to deter most automated scanning attempts of this nature
  2. They are most likely probing for weak plugins.

Your best bet is to minimize the use of plugins, and keep everything up-to-date automatically.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.