WordPressのセキュリティ対策として管理画面にアクセス制限を設定

# cd /etc/httpd/conf
# cp -p httpd.conf httpd.conf.bkup2

# vi httpd.conf

#
# Relax access to content within /var/www.
#
<Directory "/home/www/html">
AllowOverride None
# Allow open access:
Require all granted

<Directory "/home/www/html/wp-admin">
# Allow acces to wp-admin/admin-ajax.php

Order allow,deny
Allow from all
Satisfy any

order deny,allow
deny from all
allow from 111.8.21.167 <=実際のIPアドレスに変更する。

#
# Relax access to content within /var/www.
#
<Directory "/home/www/html">
AllowOverride None
# Allow open access:
Require all granted

<Directory "/home/www/html/wp-admin">
# Allow acces to wp-admin/admin-ajax.php

Order allow,deny
Allow from all
Satisfy any

order deny,allow
deny from all
allow from 111.8.21.167

# httpd -t
Syntax OK

# systemctl restart httpd

$ systemctl status httpd
● httpd.service - The Apache HTTP Server
Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled; vendor preset: disabled)
Active: active (running) since 火 2018-04-03 10:55:49 JST; 10s ago
Docs: man:httpd(8)
man:Apachectl(8)
Process: 1656 ExecStop=/bin/kill -WINCH ${MAINPID} (code=exited, status=0/SUCCESS)
Main PID: 1660 (httpd)
Status: "Total requests: 0; Current requests/sec: 0; Current traffic: 0 B/sec"
CGroup: /system.slice/httpd.service
tq1660 /usr/sbin/httpd -DFOREGROUND
tq1662 /usr/sbin/httpd -DFOREGROUND
tq1663 /usr/sbin/httpd -DFOREGROUND
tq1664 /usr/sbin/httpd -DFOREGROUND
tq1665 /usr/sbin/httpd -DFOREGROUND
mq1666 /usr/sbin/httpd -DFOREGROUND

4月 03 10:55:49 www systemd[1]: Starting The Apache HTTP Server...
4月 03 10:55:49 www systemd[1]: Started The Apache HTTP Server

# cp -p /etc/nginx/sites-available/www.testdom.com.conf /etc/nginx/sites-available/www.testdom.com.conf.org5

$ ls /etc/nginx/sites-available/
default.conf www.testdom.com.conf www.testdom.com.conf.org www.testdom.com.conf.org2 www.testdom.com.conf.org3 www.testdom.com.conf.org4 www.testdom.com.conf.org5

server {
listen 80;
server_name testdom.com www.testdom.com;
rewrite ^ https://$server_name$request_uri? permanent;
}

server {
listen 443 ssl;
server_name testdom.com www.testdom.com;
access_log /var/log/nginx/www.testdom.com-access.log main;
error_log /var/log/nginx/www.testdom.com-error.log;
root /home/www/www.testdom.com;

ssl_certificate /etc/letsencrypt/live/www.testdom.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/www.testdom.com/privkey.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_session_tickets on;
ssl_dhparam /etc/nginx/ssl/dhparam.pem;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;

location / {
index index.html index.htm index.php;
try_files $uri $uri/ /index.php?$args;
}

location ~ \.php$ {
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
set $do_not_cache 0;

if ($request_method = POST) {
set $do_not_cache 1;
}
if ($query_string != "") {
set $do_not_cache 1;
}
if ($http_cookie ~* "comment_author|WordPress_[a-f0-9]+|wp-postpass|WordPress_no_cache|WordPress_logged_in") {
set $do_not_cache 1;
}
if ($request_uri ~* "(/wp-admin/|/xmlrpc.php|/wp-(app|cron|login|register|mail).php|wp-.*.php|/feed/|index.php|wp-comments-popup.php|wp-links-opml.php|wp-locations.php|sitemap(_index)?.xml|[a-z0-9_-]+-sitemap([0-9]+)?.xml)") {
set $do_not_cache 1;
}
fastcgi_cache testdom;
fastcgi_cache_valid 200 60m;
fastcgi_no_cache $do_not_cache;
fastcgi_cache_bypass $do_not_cache;
add_header X-F-Cache $upstream_cache_status;
}
}

location ~ \.php$ {

location ~* /wp-login\.php|/wp-admin/((?!admin-ajax\.php).)*$ {
allow 111.8.21.167;
allow 127.0.0.1;
deny all;
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
}

server {
listen 80;
server_name testdom.com www.testdom.com;
rewrite ^ https://$server_name$request_uri? permanent;
}

server {
client_max_body_size 20M;
listen 443 ssl http2;
server_name testdom.com www.testdom.com;
access_log /var/log/nginx/www.testdom.com-access.log main;
error_log /var/log/nginx/www.testdom.com-error.log;
root /home/www/html;

ssl_certificate /etc/letsencrypt/live/www.testdom.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/www.testdom.com/privkey.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_session_tickets on;
ssl_dhparam /etc/nginx/ssl/dhparam.pem;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;

location / {
index index.php index.html index.htm;
try_files $uri $uri/ /index.php?$args;
}

location ~* /wp-login\.php|/wp-admin/((?!admin-ajax\.php).)*$ {
allow 111.8.21.167;
allow 127.0.0.1;
deny all;
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
}

location ~ \.php$ {
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
set $do_not_cache 0;

if ($request_method = POST) {
set $do_not_cache 1;
}
if ($query_string != "") {
set $do_not_cache 1;
}
if ($http_cookie ~* "comment_author|WordPress_[a-f0-9]+|wp-postpass|WordPress_no_cache|WordPress_logged_in") {
set $do_not_cache 1;
}
if ($request_uri ~* "(/wp-admin/|/xmlrpc.php|/wp-(app|cron|login|register|mail).php|wp-.*.php|/feed/|index.php|wp-comments-popup.php|wp-links-opml.php|wp-locations.php|sitemap(_index)?.xml|[a-z0-9_-]+-sitemap([0-9]+)?.xml)") {
set $do_not_cache 1;
}
fastcgi_cache testdom;
fastcgi_cache_valid 200 60m;
fastcgi_no_cache $do_not_cache;
fastcgi_cache_bypass $do_not_cache;
add_header X-F-Cache $upstream_cache_status;
}
}

# nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

# systemctl restart nginx