Protect WordPress Against Malicious URL Requests

By Jeff Starr on Tuesday, December 22, 2009 — 85 Responses metadata

Post #732 categorized as WordPress, last updated on Apr 5, 2010
Tagged with blacklist, htaccess, php, plugins, security, url, WordPress

A few months ago, many WordPress sites were attacked with some extremely malicious code. While searching for a good solution, I discovered the following gem of a plugin in the pastebin repository:

<?php /* Plugin Name: Block Bad Queries */

if (strlen($_SERVER['REQUEST_URI']) > 255 || 
	strpos($_SERVER['REQUEST_URI'], "eval(") || 
	strpos($_SERVER['REQUEST_URI'], "base64")) {
		@header("HTTP/1.1 414 Request-URI Too Long");
		@header("Status: 414 Request-URI Too Long");
		@header("Connection: Close");
		@exit;
} ?>

This script checks for excessively long request strings (i.e., greater than 255 characters), as well as the presence of either “eval(” or “base64” in the request URI. These sorts of nefarious requests were implicated in the September 2009 WordPress attacks.

To protect your site using this lightweight script, save the code as a plugin and activate in the WordPress Admin area. Once active, this plugin will silently and effectively close any connections for these sorts of injection-type attacks.

For further protection against malicious code, automated attacks, and other cracker nonsense, check out my 4G Blacklist.

Update to original method

As is often the case, Perishable Press readers have helped to improve this plugin by leaving comments, asking questions, and recommending changes. Here is the new, recommended version of the plugin:

<?php 
/* 
Plugin Name: Block Bad Queries
Plugin URI: http://perishablepress.com/press/2009/12/22/protect-wordpress-against-malicious-url-requests/
Description: Protect WordPress Against Malicious URL Requests
Author URI: http://perishablepress.com/
Author: Perishable Press
Version: 1.0
*/
global $user_ID; if($user_ID) {
	if(!current_user_can('level_10')) {
		if (strlen($_SERVER['REQUEST_URI']) > 255 || 
			stripos($_SERVER['REQUEST_URI'], "eval(") || 
			stripos($_SERVER['REQUEST_URI'], "CONCAT") || 
			stripos($_SERVER['REQUEST_URI'], "UNION+SELECT") || 
			stripos($_SERVER['REQUEST_URI'], "base64")) {
				@header("HTTP/1.1 414 Request-URI Too Long");
				@header("Status: 414 Request-URI Too Long");
				@header("Connection: Close");
				@exit;
		}
	}
} ?>

The changes include, in order, proper plugin declaration (thanks Aldo), exclusion of admin pages, and additional protection against CONCAT and UNION+SELECT requests (thanks John Hoff).

Update [March 5th, 2010]: Block Bad Queries is now available at the Plugin Repository.

Update [April 5th, 2010]: Code changed to use stripos instead of strpos. See this comment for details. Thanks to James Wilkes for the tip :)

Subscribe to Perishable Press

Toggle Post Options 131787 visits

Perishable Press

Protect WordPress Against Malicious URL Requests

Update to original method

Share this..

Related articles

85 Responses

#1 — Alex Denning

#2 — Eric B.

#3 — Indrek

#4 — Rick Beckman

#5 — Aldo

#6 — Lillan

#7 — Thomas Scholz

#8 — Rick Beckman

#9 — Greg

#10 — JP

#11 — tcg

#12 — Sebastian

#13 — Yael K. Miller

#14 — Jeff Starr

#15 — Greg

#16 — John Hoff - WP Blog Host

#17 — Jeff Starr

#18 — John Hoff - WP Blog Host

#19 — Shay Howe

#20 — Jeff Starr

#21 — Jeff Starr

#22 — Shay Howe

#23 — Aldo

#24 — Jeff Starr

#25 — Aldo

#26 — Yael K. Miller

#27 — Jeff Starr

#28 — John Hoff - WP Blog Host

#29 — Jeff Starr

#30 — John Hoff - WP Blog Host

#31 — Rod Homor

#32 — elcidi

#33 — Jauhari

#34 — cubus

#35 — Rick Beckman

#36 — ikram

#37 — r-a-y

#38 — Jeff Starr

#39 — mrkay

#40 — Frank

#41 — Jeff Starr

#42 — james wilkes

#43 — Jeff Starr

#44 — Deepesh Divakaran

#45 — tbdp

#46 — NavaPavan

#47 — Alex

#48 — gogobilo

#49 — Satya Prakash

#50 — Pomy

#51 — _ck_

#52 — Nathan

#53 — Jeff Starr

#54 — _ck_

#55 — Jeff Starr

#56 — Joomla Tutorials

#57 — Jeff Starr

Trackbacks / Pingbacks

Share your thoughts..

Search Perishable Press

Standards-based web design

WordPress, blogging & security

Featured Content

Explore Perishable Press

Join 5406.38+ Subscribers

Perishable Resources

Perishable Projects

Random Friends

© 2010 Perishable Press • Design by Monzilla MediaSite Credits • Site Map • Linkage • Top

© 2010 Perishable Press • Design by Monzilla Media
Site Credits • Site Map • Linkage • Top