I have noticed our website, which is Wordpress based, gets frequent daily requests from other sites where the user agent is Wordpress and the other site is obviously an already hacked Wordpress installation.
In these entries I have replaced our own domain with example.com
and purpleplumm.co.za
is one of those compromised sites.
105.233.38.37 - - [05/Dec/2019:12:14:44 +0000] "HEAD /services/ HTTP/1.1" 200 6102 "https://www.example.com/services/" "WordPress/4.9.12; http://www.purpleplumm.co.za"
105.233.38.37 - - [05/Dec/2019:12:14:45 +0000] "GET /services/ HTTP/1.1" 200 7136 "https://www.example.com/services/" "WordPress/4.9.12; http://www.purpleplumm.co.za"
I assume these are a sort of malicious worm trying to propagate through unsecured Wordpress installations?
I was going to block these requests by checking the user agent with a regex in Apache.
RewriteCond %{HTTP_USER_AGENT} ^Wordpress/\d
RewriteRule .* - [F]
I have two questions:
- Is my method sufficient to block them?
- Does anybody have any further insight into what they are trying to achieve with these requests? The requested resources don't seem to be common access points on a Wordpress installation (e.g. login/admin pages) or anything like that, just random pages of the site.
Edit: I forgot to add that I have lots of other security measures already in place; this is just something extra I was going to add.