菜单
WordPress IP/geo firewall via .htaccess for any Apache-based host. Block attacker IPs, protect wp-login.php with an allowlist, geo-block countries via Cloudflare CF-IPCountry or mod_geoip. Config-driven, never blocks your trusted CIDRs. Not needed on Nginx/WP Engine/Kinsta (use their WAF).
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Deploy a theme, plugin, or wp-content subset to a WordPress server from a CI/CD pipeline, with automatic pre-deploy backup, post-deploy health check, and automatic rollback on failure. Designed for GitHub Actions, GitLab CI, or any pipeline that can run Python.
Security and integrity audit for WooCommerce stores. Checks REST API key scope, payment gateway exposure, webhook HTTPS enforcement, suspicious $0 orders, exposed wc-logs (PII/payment data), and coupon abuse.
Scaffold and deploy a WordPress child theme via SSH. Generates style.css, functions.php (with correct parent style enqueueing), and index.php. Supports Kadence, Astra, GeneratePress, Hello Elementor, OceanWP, and any custom parent. Can activate the child theme immediately after creation.
Safely switch WordPress themes via SSH with automatic rollback if the site goes down. Records the previous theme for instant rollback. Verifies HTTP 200 before and after the switch.
Security audit of WordPress themes via SSH. Scans for PHP malware patterns, injected scripts, recently modified files, and unexpected file types. Also checks DB for customizer injections and Elementor postmeta payloads. Use after any attack or before going live with a new/inherited theme.
Comprehensive guide to building, maintaining, and recovering Elementor-based WordPress sites. Covers the CSS pipeline, global styles (Kit), common post-attack failures and fixes, Pro vs Free features, and integration with Kadence and Hello Elementor themes.
| name | wp-firewall |
| description | WordPress IP/geo firewall via .htaccess for any Apache-based host. Block attacker IPs, protect wp-login.php with an allowlist, geo-block countries via Cloudflare CF-IPCountry or mod_geoip. Config-driven, never blocks your trusted CIDRs. Not needed on Nginx/WP Engine/Kinsta (use their WAF). |
| metadata | {"type":"security","script":"scripts/hardening/wp-firewall.py","requires":"paramiko"} |
Works on any Apache-based host (shared hosting, cPanel, IONOS, SiteGround, Bluehost, DreamHost, etc.). For Nginx hosts (WP Engine, Kinsta), use their built-in IP block feature or Cloudflare WAF instead.
# Block attacker IPs (--trusted-cidrs prevents accidental self-block)
python scripts/hardening/wp-firewall.py \
--config config/config.yaml \
--block-ip "1.2.3.4,5.6.7.0/24"
# Restrict wp-login.php to your IP only
python scripts/hardening/wp-firewall.py \
--config config/config.yaml \
--allow-admin-ip "YOUR_HOME_IP,YOUR_OFFICE_IP"
# Geo-block countries (Cloudflare or mod_geoip required)
python scripts/hardening/wp-firewall.py \
--config config/config.yaml \
--block-country "CN,RU,KP"
# Show what rules are currently active
python scripts/hardening/wp-firewall.py --config config/config.yaml --show
# Remove all WP-Arsenal rules from .htaccess
python scripts/hardening/wp-firewall.py --config config/config.yaml --clear
In config/config.yaml, list your hosting provider's monitoring IPs and your
own IPs under trusted_cidrs. The script refuses to block any trusted CIDR.
trusted_cidrs:
- "127.0.0.1"
- "::1"
- "82.165." # IONOS monitoring (if on IONOS)
- "203.0.113." # Your office IP range
Rules use # WP-Arsenal-FW-BEGIN:LABEL / # WP-Arsenal-FW-END:LABEL markers,
so re-running updates the block cleanly instead of appending duplicates.
CF-IPCountry headerapt-get install libapache2-mod-geoip