Безопасность WordPress 2025: защита от современных угроз

php<code><em>// Строгая валидация всех пользовательских вводов</em>
function strict_xss_protection() {
    <em>// Санитизация $_GET и $_POST</em>
    array_walk_recursive($_GET, function(&$value) {
        $value = strip_tags($value);
        $value = htmlspecialchars($value, ENT_QUOTES, 'UTF-8');
    });
    
    array_walk_recursive($_POST, function(&$value) {
        if (!is_array($value)) {
            $value = wp_kses_post($value);
        }
    });
    
    <em>// Блокировка опасных паттернов</em>
    $dangerous_patterns = array(
        '/<script[^>]*>.*?<\/script>/is',
        '/javascript:/i',
        '/on\w+\s*=/i',
        '/<iframe/i'
    );
    
    $input_string = json_encode($_REQUEST);
    
    foreach ($dangerous_patterns as $pattern) {
        if (preg_match($pattern, $input_string)) {
            wp_die('Potential XSS attack detected', 'Security Alert', array('response' => 403));
        }
    }
}
add_action('init', 'strict_xss_protection', 1);
</code>

php<code><em>// Строгая валидация всех пользовательских вводов</em> function strict_xss_protection() {     <em>// Санитизация $_GET и $_POST</em>     array_walk_recursive($_GET, function(&$value) {         $value = strip_tags($value);         $value = htmlspecialchars($value, ENT_QUOTES, 'UTF-8');     });          array_walk_recursive($_POST, function(&$value) {         if (!is_array($value)) {             $value = wp_kses_post($value);         }     });          <em>// Блокировка опасных паттернов</em>     $dangerous_patterns = array(         '/<script[^>]*>.*?<\/script>/is',         '/javascript:/i',         '/on\w+\s*=/i',         '/<iframe/i'     );          $input_string = json_encode($_REQUEST);          foreach ($dangerous_patterns as $pattern) {         if (preg_match($pattern, $input_string)) {             wp_die('Potential XSS attack detected', 'Security Alert', array('response' => 403));         }     } } add_action('init', 'strict_xss_protection', 1); </code>

php<code><em>// Генерация nonce для форм</em>
function generate_secure_nonce($action) {
    $nonce = wp_create_nonce($action);
    
    <em>// Дополнительная проверка User-Agent и IP</em>
    $signature = hash_hmac('sha256', 
        $action . $_SERVER['HTTP_USER_AGENT'] . $_SERVER['REMOTE_ADDR'],
        wp_salt('nonce')
    );
    
    return $nonce . ':' . substr($signature, 0, 16);
}

<em>// Валидация с дополнительными проверками</em>
function verify_secure_nonce($nonce_string, $action) {
    if (empty($nonce_string)) return false;
    
    list($nonce, $signature) = explode(':', $nonce_string);
    
    <em>// Проверка базового nonce</em>
    if (!wp_verify_nonce($nonce, $action)) {
        return false;
    }
    
    <em>// Проверка подписи</em>
    $expected_signature = substr(
        hash_hmac('sha256', 
            $action . $_SERVER['HTTP_USER_AGENT'] . $_SERVER['REMOTE_ADDR'],
            wp_salt('nonce')
        ),
        0, 16
    );
    
    return hash_equals($expected_signature, $signature);
}

<em>// Использование в AJAX</em>
add_action('wp_ajax_sensitive_action', function() {
    $nonce = $_POST['nonce'] ?? '';
    
    if (!verify_secure_nonce($nonce, 'sensitive_action')) {
        wp_send_json_error('Security check failed', 403);
    }
    
    <em>// Безопасное выполнение действия</em>
    wp_send_json_success();
});
</code>

php<code><em>// Генерация nonce для форм</em> function generate_secure_nonce($action) {     $nonce = wp_create_nonce($action);          <em>// Дополнительная проверка User-Agent и IP</em>     $signature = hash_hmac('sha256',          $action . $_SERVER['HTTP_USER_AGENT'] . $_SERVER['REMOTE_ADDR'],         wp_salt('nonce')     );          return $nonce . ':' . substr($signature, 0, 16); }  <em>// Валидация с дополнительными проверками</em> function verify_secure_nonce($nonce_string, $action) {     if (empty($nonce_string)) return false;          list($nonce, $signature) = explode(':', $nonce_string);          <em>// Проверка базового nonce</em>     if (!wp_verify_nonce($nonce, $action)) {         return false;     }          <em>// Проверка подписи</em>     $expected_signature = substr(         hash_hmac('sha256',              $action . $_SERVER['HTTP_USER_AGENT'] . $_SERVER['REMOTE_ADDR'],             wp_salt('nonce')         ),         0, 16     );          return hash_equals($expected_signature, $signature); }  <em>// Использование в AJAX</em> add_action('wp_ajax_sensitive_action', function() {     $nonce = $_POST['nonce'] ?? '';          if (!verify_secure_nonce($nonce, 'sensitive_action')) {         wp_send_json_error('Security check failed', 403);     }          <em>// Безопасное выполнение действия</em>     wp_send_json_success(); }); </code>

php<code>class Advanced_Brute_Force_Protection {
    
    private $max_attempts = 5;
    private $lockout_duration = 1800; <em>// 30 минут</em>
    private $progressive_delay = true;
    
    public function __construct() {
        add_action('wp_login_failed', array($this, 'handle_failed_login'));
        add_filter('authenticate', array($this, 'check_login_attempt'), 30, 3);
        add_action('wp_login', array($this, 'clear_attempts'), 10, 2);
    }
    
    public function handle_failed_login($username) {
        $ip = $_SERVER['REMOTE_ADDR'];
        $attempts_key = 'login_attempts_' . md5($ip . $username);
        $attempts = get_transient($attempts_key) ?: 0;
        $attempts++;
        
        <em>// Прогрессивная задержка</em>
        if ($this->progressive_delay && $attempts > 2) {
            $delay = min(pow(2, $attempts - 2), 60); <em>// Максимум 60 секунд</em>
            sleep($delay);
        }
        
        set_transient($attempts_key, $attempts, $this->lockout_duration);
        
        <em>// Логирование подозрительной активности</em>
        if ($attempts >= 3) {
            $this->log_suspicious_activity($ip, $username, $attempts);
        }
        
        <em>// Блокировка после превышения лимита</em>
        if ($attempts >= $this->max_attempts) {
            $this->block_ip($ip);
        }
    }
    
    public function check_login_attempt($user, $username, $password) {
        if (empty($username) || empty($password)) {
            return $user;
        }
        
        $ip = $_SERVER['REMOTE_ADDR'];
        $attempts_key = 'login_attempts_' . md5($ip . $username);
        $attempts = get_transient($attempts_key) ?: 0;
        
        if ($attempts >= $this->max_attempts) {
            $remaining = $this->lockout_duration - (time() - get_option('lockout_time_' . md5($ip)));
            
            return new WP_Error(
                'too_many_attempts',
                sprintf(
                    __('Too many failed login attempts. Try again in %d minutes.'),
                    ceil($remaining / 60)
                )
            );
        }
        
        return $user;
    }
    
    public function clear_attempts($username, $user) {
        $ip = $_SERVER['REMOTE_ADDR'];
        $attempts_key = 'login_attempts_' . md5($ip . $username);
        delete_transient($attempts_key);
    }
    
    private function block_ip($ip) {
        <em>// Добавление IP в черный список</em>
        $blocked_ips = get_option('blocked_ips', array());
        
        if (!in_array($ip, $blocked_ips)) {
            $blocked_ips[] = $ip;
            update_option('blocked_ips', $blocked_ips);
            
            <em>// Уведомление админа</em>
            wp_mail(
                get_option('admin_email'),
                'IP Blocked: Brute Force Attack Detected',
                "IP $ip has been blocked after multiple failed login attempts."
            );
        }
        
        update_option('lockout_time_' . md5($ip), time());
    }
    
    private function log_suspicious_activity($ip, $username, $attempts) {
        global $wpdb;
        
        $wpdb->insert(
            $wpdb->prefix . 'security_log',
            array(
                'ip_address' => $ip,
                'username' => $username,
                'attempts' => $attempts,
                'timestamp' => current_time('mysql'),
                'user_agent' => $_SERVER['HTTP_USER_AGENT']
            )
        );
    }
}

new Advanced_Brute_Force_Protection();
</code>

php<code>class Advanced_Brute_Force_Protection {          private $max_attempts = 5;     private $lockout_duration = 1800; <em>// 30 минут</em>     private $progressive_delay = true;          public function __construct() {         add_action('wp_login_failed', array($this, 'handle_failed_login'));         add_filter('authenticate', array($this, 'check_login_attempt'), 30, 3);         add_action('wp_login', array($this, 'clear_attempts'), 10, 2);     }          public function handle_failed_login($username) {         $ip = $_SERVER['REMOTE_ADDR'];         $attempts_key = 'login_attempts_' . md5($ip . $username);         $attempts = get_transient($attempts_key) ?: 0;         $attempts++;                  <em>// Прогрессивная задержка</em>         if ($this->progressive_delay && $attempts > 2) {             $delay = min(pow(2, $attempts - 2), 60); <em>// Максимум 60 секунд</em>             sleep($delay);         }                  set_transient($attempts_key, $attempts, $this->lockout_duration);                  <em>// Логирование подозрительной активности</em>         if ($attempts >= 3) {             $this->log_suspicious_activity($ip, $username, $attempts);         }                  <em>// Блокировка после превышения лимита</em>         if ($attempts >= $this->max_attempts) {             $this->block_ip($ip);         }     }          public function check_login_attempt($user, $username, $password) {         if (empty($username) || empty($password)) {             return $user;         }                  $ip = $_SERVER['REMOTE_ADDR'];         $attempts_key = 'login_attempts_' . md5($ip . $username);         $attempts = get_transient($attempts_key) ?: 0;                  if ($attempts >= $this->max_attempts) {             $remaining = $this->lockout_duration - (time() - get_option('lockout_time_' . md5($ip)));                          return new WP_Error(                 'too_many_attempts',                 sprintf(                     __('Too many failed login attempts. Try again in %d minutes.'),                     ceil($remaining / 60)                 )             );         }                  return $user;     }          public function clear_attempts($username, $user) {         $ip = $_SERVER['REMOTE_ADDR'];         $attempts_key = 'login_attempts_' . md5($ip . $username);         delete_transient($attempts_key);     }          private function block_ip($ip) {         <em>// Добавление IP в черный список</em>         $blocked_ips = get_option('blocked_ips', array());                  if (!in_array($ip, $blocked_ips)) {             $blocked_ips[] = $ip;             update_option('blocked_ips', $blocked_ips);                          <em>// Уведомление админа</em>             wp_mail(                 get_option('admin_email'),                 'IP Blocked: Brute Force Attack Detected',                 "IP $ip has been blocked after multiple failed login attempts."             );         }                  update_option('lockout_time_' . md5($ip), time());     }          private function log_suspicious_activity($ip, $username, $attempts) {         global $wpdb;                  $wpdb->insert(             $wpdb->prefix . 'security_log',             array(                 'ip_address' => $ip,                 'username' => $username,                 'attempts' => $attempts,                 'timestamp' => current_time('mysql'),                 'user_agent' => $_SERVER['HTTP_USER_AGENT']             )         );     } }  new Advanced_Brute_Force_Protection(); </code>

php<code><em>// Отслеживание неожиданных обновлений плагинов</em>
function monitor_plugin_updates() {
    $current_plugins = get_plugins();
    $stored_hashes = get_option('plugin_integrity_hashes', array());
    $alerts = array();
    
    foreach ($current_plugins as $plugin_path => $plugin_data) {
        $plugin_file = WP_PLUGIN_DIR . '/' . $plugin_path;
        
        if (!file_exists($plugin_file)) continue;
        
        $current_hash = md5_file($plugin_file);
        $stored_hash = $stored_hashes[$plugin_path] ?? null;
        
        if ($stored_hash && $stored_hash !== $current_hash) {
            <em>// Плагин изменился неожиданно</em>
            $alerts[] = sprintf(
                'Plugin "%s" has been modified unexpectedly. Version: %s',
                $plugin_data['Name'],
                $plugin_data['Version']
            );
            
            <em>// Проверка на известные malware сигнатуры</em>
            $malware_patterns = array(
                '/eval\s*\(\s*base64_decode/i',
                '/system\s*\(/i',
                '/exec\s*\(/i',
                '/shell_exec/i',
                '/\$_REQUEST\[\s*[\'"].*[\'"]\s*\]\s*\(/i'
            );
            
            $content = file_get_contents($plugin_file);
            
            foreach ($malware_patterns as $pattern) {
                if (preg_match($pattern, $content)) {
                    $alerts[] = "⚠️ CRITICAL: Malware signature detected in {$plugin_data['Name']}";
                    
                    <em>// Автоматическая деактивация</em>
                    deactivate_plugins($plugin_path);
                    break;
                }
            }
        }
        
        <em>// Обновление хэша</em>
        $stored_hashes[$plugin_path] = $current_hash;
    }
    
    update_option('plugin_integrity_hashes', $stored_hashes);
    
    if (!empty($alerts)) {
        wp_mail(
            get_option('admin_email'),
            'SECURITY ALERT: Plugin Changes Detected',
            implode("\n\n", $alerts)
        );
    }
}

<em>// Ежечасная проверка</em>
if (!wp_next_scheduled('monitor_plugin_updates_hook')) {
    wp_schedule_event(time(), 'hourly', 'monitor_plugin_updates_hook');
}
add_action('monitor_plugin_updates_hook', 'monitor_plugin_updates');
</code>

php<code><em>// Отслеживание неожиданных обновлений плагинов</em> function monitor_plugin_updates() {     $current_plugins = get_plugins();     $stored_hashes = get_option('plugin_integrity_hashes', array());     $alerts = array();          foreach ($current_plugins as $plugin_path => $plugin_data) {         $plugin_file = WP_PLUGIN_DIR . '/' . $plugin_path;                  if (!file_exists($plugin_file)) continue;                  $current_hash = md5_file($plugin_file);         $stored_hash = $stored_hashes[$plugin_path] ?? null;                  if ($stored_hash && $stored_hash !== $current_hash) {             <em>// Плагин изменился неожиданно</em>             $alerts[] = sprintf(                 'Plugin "%s" has been modified unexpectedly. Version: %s',                 $plugin_data['Name'],                 $plugin_data['Version']             );                          <em>// Проверка на известные malware сигнатуры</em>             $malware_patterns = array(                 '/eval\s*\(\s*base64_decode/i',                 '/system\s*\(/i',                 '/exec\s*\(/i',                 '/shell_exec/i',                 '/\$_REQUEST\[\s*[\'"].*[\'"]\s*\]\s*\(/i'             );                          $content = file_get_contents($plugin_file);                          foreach ($malware_patterns as $pattern) {                 if (preg_match($pattern, $content)) {                     $alerts[] = "⚠️ CRITICAL: Malware signature detected in {$plugin_data['Name']}";                                          <em>// Автоматическая деактивация</em>                     deactivate_plugins($plugin_path);                     break;                 }             }         }                  <em>// Обновление хэша</em>         $stored_hashes[$plugin_path] = $current_hash;     }          update_option('plugin_integrity_hashes', $stored_hashes);          if (!empty($alerts)) {         wp_mail(             get_option('admin_email'),             'SECURITY ALERT: Plugin Changes Detected',             implode("\n\n", $alerts)         );     } }  <em>// Ежечасная проверка</em> if (!wp_next_scheduled('monitor_plugin_updates_hook')) {     wp_schedule_event(time(), 'hourly', 'monitor_plugin_updates_hook'); } add_action('monitor_plugin_updates_hook', 'monitor_plugin_updates'); </code>

text<code># Блокировка доступа к wp-config.php
(http.request.uri.path contains "wp-config.php")

# Блокировка xmlrpc.php (если не используется)
(http.request.uri.path eq "/xmlrpc.php")

# Защита wp-login.php (только из разрешенных стран)
(http.request.uri.path eq "/wp-login.php" and not ip.geoip.country in {"US" "GB" "CA"})

# Блокировка SQL инъекций
(http.request.uri.query contains "union" and http.request.uri.query contains "select")

# Блокировка подозрительных User-Agent
(http.user_agent contains "sqlmap" or http.user_agent contains "nikto")

# Rate limiting для API
(http.request.uri.path contains "/wp-json/" and rate(10m) > 100)
</code>

text<code># Блокировка доступа к wp-config.php (http.request.uri.path contains "wp-config.php")  # Блокировка xmlrpc.php (если не используется) (http.request.uri.path eq "/xmlrpc.php")  # Защита wp-login.php (только из разрешенных стран) (http.request.uri.path eq "/wp-login.php" and not ip.geoip.country in {"US" "GB" "CA"})  # Блокировка SQL инъекций (http.request.uri.query contains "union" and http.request.uri.query contains "select")  # Блокировка подозрительных User-Agent (http.user_agent contains "sqlmap" or http.user_agent contains "nikto")  # Rate limiting для API (http.request.uri.path contains "/wp-json/" and rate(10m) > 100) </code>

text<code># Кэширование статических ресурсов
*.example.com/wp-content/*
- Cache Level: Cache Everything
- Edge Cache TTL: 1 month

# Защита admin панели
example.com/wp-admin/*
- Security Level: High
- Cache Level: Bypass
- Disable Apps
</code>

text<code># Кэширование статических ресурсов *.example.com/wp-content/* - Cache Level: Cache Everything - Edge Cache TTL: 1 month  # Защита admin панели example.com/wp-admin/* - Security Level: High - Cache Level: Bypass - Disable Apps </code>

php<code><em>// Оптимизация Wordfence через wp-config.php</em>
define('WORDFENCE_DISABLE_LIVE_TRAFFIC', true); <em>// Отключить Live Traffic для производительности</em>
define('WFWAF_LOG_PATH', '/var/log/wordfence/'); <em>// Логи в отдельную директорию</em>

<em>// Программная настройка опций</em>
add_filter('wordfence_scan_custom_rules', function($rules) {
    <em>// Добавление кастомных правил сканирования</em>
    $rules[] = array(
        'pattern' => '/wp-content/uploads/**/*.php',
        'action' => 'delete',
        'description' => 'PHP files in uploads directory'
    );
    
    $rules[] = array(
        'pattern' => '/wp-includes/**/*.php',
        'action' => 'alert',
        'description' => 'Modified core files'
    );
    
    return $rules;
});

<em>// Автоматическое обновление Wordfence правил</em>
add_action('init', function() {
    if (class_exists('wfConfig')) {
        wfConfig::set('autoUpdate', true);
        wfConfig::set('alertOn_firstAdminLoginOnly', false);
        wfConfig::set('alertOn_loginLockout', true);
        wfConfig::set('alertOn_breachLogin', true);
    }
});
</code>

php<code><em>// Оптимизация Wordfence через wp-config.php</em> define('WORDFENCE_DISABLE_LIVE_TRAFFIC', true); <em>// Отключить Live Traffic для производительности</em> define('WFWAF_LOG_PATH', '/var/log/wordfence/'); <em>// Логи в отдельную директорию</em>  <em>// Программная настройка опций</em> add_filter('wordfence_scan_custom_rules', function($rules) {     <em>// Добавление кастомных правил сканирования</em>     $rules[] = array(         'pattern' => '/wp-content/uploads/**/*.php',         'action' => 'delete',         'description' => 'PHP files in uploads directory'     );          $rules[] = array(         'pattern' => '/wp-includes/**/*.php',         'action' => 'alert',         'description' => 'Modified core files'     );          return $rules; });  <em>// Автоматическое обновление Wordfence правил</em> add_action('init', function() {     if (class_exists('wfConfig')) {         wfConfig::set('autoUpdate', true);         wfConfig::set('alertOn_firstAdminLoginOnly', false);         wfConfig::set('alertOn_loginLockout', true);         wfConfig::set('alertOn_breachLogin', true);     } }); </code>

php<code><em>// Принудительная активация 2FA для администраторов</em>
add_action('init', function() {
    if (!is_plugin_active('wp-2fa/wp-2fa.php')) {
        return;
    }
    
    <em>// Проверка для администраторов</em>
    $user = wp_get_current_user();
    
    if (in_array('administrator', $user->roles)) {
        $has_2fa = get_user_meta($user->ID, 'wp_2fa_enabled', true);
        
        if (!$has_2fa && !is_admin()) {
            <em>// Редирект на настройку 2FA</em>
            if (!isset($_GET['page']) || $_GET['page'] !== 'wp-2fa-setup') {
                wp_redirect(admin_url('admin.php?page=wp-2fa-setup&force=1'));
                exit;
            }
        }
    }
});

<em>// Кастомная интеграция TOTP для уникальных случаев</em>
class Custom_TOTP_Auth {
    
    private $secret_length = 32;
    
    public function generate_secret() {
        $chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
        $secret = '';
        
        for ($i = 0; $i < $this->secret_length; $i++) {
            $secret .= $chars[random_int(0, strlen($chars) - 1)];
        }
        
        return $secret;
    }
    
    public function verify_token($secret, $token, $window = 2) {
        $timestamp = floor(time() / 30);
        
        <em>// Проверка с окном допуска (±60 секунд)</em>
        for ($i = -$window; $i <= $window; $i++) {
            $calculated_token = $this->calculate_totp($secret, $timestamp + $i);
            
            if (hash_equals($calculated_token, $token)) {
                return true;
            }
        }
        
        return false;
    }
    
    private function calculate_totp($secret, $timestamp) {
        $secret = base32_decode($secret);
        $time = pack('N*', 0) . pack('N*', $timestamp);
        $hash = hash_hmac('sha1', $time, $secret, true);
        $offset = ord($hash[19]) & 0xf;
        
        $code = (
            ((ord($hash[$offset]) & 0x7f) << 24) |
            ((ord($hash[$offset + 1]) & 0xff) << 16) |
            ((ord($hash[$offset + 2]) & 0xff) << 8) |
            (ord($hash[$offset + 3]) & 0xff)
        ) % 1000000;
        
        return str_pad($code, 6, '0', STR_PAD_LEFT);
    }
    
    public function get_qr_code_url($secret, $label, $issuer = 'WordPress') {
        $url = sprintf(
            'otpauth://totp/%s:%s?secret=%s&issuer=%s',
            urlencode($issuer),
            urlencode($label),
            $secret,
            urlencode($issuer)
        );
        
        return 'https://chart.googleapis.com/chart?chs=200x200&cht=qr&chl=' . urlencode($url);
    }
}
</code>

php<code><em>// Принудительная активация 2FA для администраторов</em> add_action('init', function() {     if (!is_plugin_active('wp-2fa/wp-2fa.php')) {         return;     }          <em>// Проверка для администраторов</em>     $user = wp_get_current_user();          if (in_array('administrator', $user->roles)) {         $has_2fa = get_user_meta($user->ID, 'wp_2fa_enabled', true);                  if (!$has_2fa && !is_admin()) {             <em>// Редирект на настройку 2FA</em>             if (!isset($_GET['page']) || $_GET['page'] !== 'wp-2fa-setup') {                 wp_redirect(admin_url('admin.php?page=wp-2fa-setup&force=1'));                 exit;             }         }     } });  <em>// Кастомная интеграция TOTP для уникальных случаев</em> class Custom_TOTP_Auth {          private $secret_length = 32;          public function generate_secret() {         $chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';         $secret = '';                  for ($i = 0; $i < $this->secret_length; $i++) {             $secret .= $chars[random_int(0, strlen($chars) - 1)];         }                  return $secret;     }          public function verify_token($secret, $token, $window = 2) {         $timestamp = floor(time() / 30);                  <em>// Проверка с окном допуска (±60 секунд)</em>         for ($i = -$window; $i <= $window; $i++) {             $calculated_token = $this->calculate_totp($secret, $timestamp + $i);                          if (hash_equals($calculated_token, $token)) {                 return true;             }         }                  return false;     }          private function calculate_totp($secret, $timestamp) {         $secret = base32_decode($secret);         $time = pack('N*', 0) . pack('N*', $timestamp);         $hash = hash_hmac('sha1', $time, $secret, true);         $offset = ord($hash[19]) & 0xf;                  $code = (             ((ord($hash[$offset]) & 0x7f) << 24) |             ((ord($hash[$offset + 1]) & 0xff) << 16) |             ((ord($hash[$offset + 2]) & 0xff) << 8) |             (ord($hash[$offset + 3]) & 0xff)         ) % 1000000;                  return str_pad($code, 6, '0', STR_PAD_LEFT);     }          public function get_qr_code_url($secret, $label, $issuer = 'WordPress') {         $url = sprintf(             'otpauth://totp/%s:%s?secret=%s&issuer=%s',             urlencode($issuer),             urlencode($label),             $secret,             urlencode($issuer)         );                  return 'https://chart.googleapis.com/chart?chs=200x200&cht=qr&chl=' . urlencode($url);     } } </code>

php<code>function generate_backup_codes($user_id, $count = 10) {
    $codes = array();
    
    for ($i = 0; $i < $count; $i++) {
        $codes[] = strtoupper(bin2hex(random_bytes(4)));
    }
    
    <em>// Хранение хэшей, а не plain text</em>
    $hashed_codes = array_map(function($code) {
        return wp_hash_password($code);
    }, $codes);
    
    update_user_meta($user_id, 'backup_codes', $hashed_codes);
    
    return $codes; <em>// Показать пользователю только один раз</em>
}

<em>// Проверка backup кода при входе</em>
add_filter('authenticate', function($user, $username, $password) {
    if (is_wp_error($user)) {
        return $user;
    }
    
    <em>// Если 2FA включена и TOTP не прошел</em>
    $backup_code = $_POST['backup_code'] ?? '';
    
    if (!empty($backup_code)) {
        $stored_codes = get_user_meta($user->ID, 'backup_codes', true);
        
        foreach ($stored_codes as $index => $hashed_code) {
            if (wp_check_password($backup_code, $hashed_code)) {
                <em>// Удаление использованного кода</em>
                unset($stored_codes[$index]);
                update_user_meta($user->ID, 'backup_codes', array_values($stored_codes));
                
                return $user;
            }
        }
        
        return new WP_Error('invalid_backup_code', 'Invalid backup code');
    }
    
    return $user;
}, 30, 3);
</code>

php<code>function generate_backup_codes($user_id, $count = 10) {     $codes = array();          for ($i = 0; $i < $count; $i++) {         $codes[] = strtoupper(bin2hex(random_bytes(4)));     }          <em>// Хранение хэшей, а не plain text</em>     $hashed_codes = array_map(function($code) {         return wp_hash_password($code);     }, $codes);          update_user_meta($user_id, 'backup_codes', $hashed_codes);          return $codes; <em>// Показать пользователю только один раз</em> }  <em>// Проверка backup кода при входе</em> add_filter('authenticate', function($user, $username, $password) {     if (is_wp_error($user)) {         return $user;     }          <em>// Если 2FA включена и TOTP не прошел</em>     $backup_code = $_POST['backup_code'] ?? '';          if (!empty($backup_code)) {         $stored_codes = get_user_meta($user->ID, 'backup_codes', true);                  foreach ($stored_codes as $index => $hashed_code) {             if (wp_check_password($backup_code, $hashed_code)) {                 <em>// Удаление использованного кода</em>                 unset($stored_codes[$index]);                 update_user_meta($user->ID, 'backup_codes', array_values($stored_codes));                                  return $user;             }         }                  return new WP_Error('invalid_backup_code', 'Invalid backup code');     }          return $user; }, 30, 3); </code>

php<code><em>// Кастомная интеграция с Melapress File Monitor</em>
add_action('wsal_file_changes_detected', function($changes) {
    $critical_changes = array();
    
    foreach ($changes as $change) {
        <em>// Фильтрация критичных изменений</em>
        if (
            strpos($change['file'], 'wp-config.php') !== false ||
            strpos($change['file'], '.htaccess') !== false ||
            strpos($change['file'], '/plugins/') !== false && $change['type'] === 'modified'
        ) {
            $critical_changes[] = $change;
        }
    }
    
    if (!empty($critical_changes)) {
        <em>// Немедленное уведомление</em>
        $message = "Critical file changes detected:\n\n";
        
        foreach ($critical_changes as $change) {
            $message .= sprintf(
                "File: %s\nType: %s\nTime: %s\n\n",
                $change['file'],
                $change['type'],
                $change['timestamp']
            );
        }
        
        <em>// Email + Slack/Telegram</em>
        wp_mail(get_option('admin_email'), 'CRITICAL: File Changes Detected', $message);
        send_to_slack($message); <em>// Кастомная функция</em>
    }
});
</code>

php<code><em>// Кастомная интеграция с Melapress File Monitor</em> add_action('wsal_file_changes_detected', function($changes) {     $critical_changes = array();          foreach ($changes as $change) {         <em>// Фильтрация критичных изменений</em>         if (             strpos($change['file'], 'wp-config.php') !== false ||             strpos($change['file'], '.htaccess') !== false ||             strpos($change['file'], '/plugins/') !== false && $change['type'] === 'modified'         ) {             $critical_changes[] = $change;         }     }          if (!empty($critical_changes)) {         <em>// Немедленное уведомление</em>         $message = "Critical file changes detected:\n\n";                  foreach ($critical_changes as $change) {             $message .= sprintf(                 "File: %s\nType: %s\nTime: %s\n\n",                 $change['file'],                 $change['type'],                 $change['timestamp']             );         }                  <em>// Email + Slack/Telegram</em>         wp_mail(get_option('admin_email'), 'CRITICAL: File Changes Detected', $message);         send_to_slack($message); <em>// Кастомная функция</em>     } }); </code>

php<code>class Advanced_File_Integrity_Monitor {
    
    private $monitored_paths = array();
    private $baseline_file = 'file-integrity-baseline.json';
    
    public function __construct() {
        $this->monitored_paths = array(
            ABSPATH . 'wp-admin/',
            ABSPATH . 'wp-includes/',
            WP_PLUGIN_DIR,
            get_template_directory(),
            ABSPATH . 'wp-config.php',
            ABSPATH . '.htaccess'
        );
        
        add_action('wp_loaded', array($this, 'check_integrity'));
    }
    
    public function create_baseline() {
        $baseline = array();
        
        foreach ($this->monitored_paths as $path) {
            if (is_file($path)) {
                $baseline[$path] = $this->get_file_signature($path);
            } elseif (is_dir($path)) {
                $files = $this->get_directory_files($path);
                
                foreach ($files as $file) {
                    $baseline[$file] = $this->get_file_signature($file);
                }
            }
        }
        
        file_put_contents(
            WP_CONTENT_DIR . '/' . $this->baseline_file,
            json_encode($baseline, JSON_PRETTY_PRINT)
        );
        
        return $baseline;
    }
    
    public function check_integrity() {
        $baseline_path = WP_CONTENT_DIR . '/' . $this->baseline_file;
        
        if (!file_exists($baseline_path)) {
            $this->create_baseline();
            return;
        }
        
        $baseline = json_decode(file_get_contents($baseline_path), true);
        $changes = array(
            'modified' => array(),
            'added' => array(),
            'deleted' => array()
        );
        
        $current_files = array();
        
        foreach ($this->monitored_paths as $path) {
            if (is_file($path)) {
                $current_files[$path] = $this->get_file_signature($path);
            } elseif (is_dir($path)) {
                $files = $this->get_directory_files($path);
                
                foreach ($files as $file) {
                    $current_files[$file] = $this->get_file_signature($file);
                }
            }
        }
        
        <em>// Поиск изменений и новых файлов</em>
        foreach ($current_files as $file => $signature) {
            if (!isset($baseline[$file])) {
                $changes['added'][] = $file;
            } elseif ($baseline[$file] !== $signature) {
                $changes['modified'][] = $file;
            }
        }
        
        <em>// Поиск удаленных файлов</em>
        foreach ($baseline as $file => $signature) {
            if (!isset($current_files[$file])) {
                $changes['deleted'][] = $file;
            }
        }
        
        <em>// Обработка изменений</em>
        if (!empty($changes['modified']) || !empty($changes['added']) || !empty($changes['deleted'])) {
            $this->handle_changes($changes);
        }
    }
    
    private function get_file_signature($file) {
        return array(
            'md5' => md5_file($file),
            'sha256' => hash_file('sha256', $file),
            'size' => filesize($file),
            'modified' => filemtime($file),
            'permissions' => substr(sprintf('%o', fileperms($file)), -4)
        );
    }
    
    private function get_directory_files($dir, $recursive = true) {
        $files = array();
        $iterator = new RecursiveIteratorIterator(
            new RecursiveDirectoryIterator($dir, RecursiveDirectoryIterator::SKIP_DOTS),
            RecursiveIteratorIterator::SELF_FIRST
        );
        
        foreach ($iterator as $file) {
            if ($file->isFile()) {
                $files[] = $file->getPathname();
            }
        }
        
        return $files;
    }
    
    private function handle_changes($changes) {
        global $wpdb;
        
        <em>// Логирование в БД</em>
        foreach ($changes as $type => $files) {
            foreach ($files as $file) {
                $wpdb->insert(
                    $wpdb->prefix . 'file_integrity_log',
                    array(
                        'file_path' => $file,
                        'change_type' => $type,
                        'timestamp' => current_time('mysql'),
                        'user_ip' => $_SERVER['REMOTE_ADDR'] ?? 'CLI'
                    )
                );
            }
        }
        
        <em>// Критические изменения требуют немедленного уведомления</em>
        $critical_files = array('wp-config.php', '.htaccess');
        $critical_changes = false;
        
        foreach ($changes as $type => $files) {
            foreach ($files as $file) {
                $basename = basename($file);
                
                if (in_array($basename, $critical_files)) {
                    $critical_changes = true;
                    break 2;
                }
            }
        }
        
        if ($critical_changes) {
            $this->send_critical_alert($changes);
        } else {
            <em>// Обычный дайджест раз в день</em>
            $this->queue_daily_report($changes);
        }
    }
    
    private function send_critical_alert($changes) {
        $message = "⚠️ CRITICAL FILE CHANGES DETECTED\n\n";
        
        foreach ($changes as $type => $files) {
            if (!empty($files)) {
                $message .= strtoupper($type) . ":\n";
                
                foreach ($files as $file) {
                    $message .= "- $file\n";
                }
                
                $message .= "\n";
            }
        }
        
        <em>// Множественные каналы уведомлений</em>
        wp_mail(get_option('admin_email'), 'CRITICAL: File Integrity Alert', $message);
        
        <em>// SMS через Twilio (опционально)</em>
        if (function_exists('send_sms_alert')) {
            send_sms_alert($message);
        }
    }
    
    private function queue_daily_report($changes) {
        $existing_changes = get_option('pending_file_changes', array());
        $existing_changes[] = array(
            'timestamp' => time(),
            'changes' => $changes
        );
        
        update_option('pending_file_changes', $existing_changes);
    }
}

new Advanced_File_Integrity_Monitor();
</code>

php<code>class Advanced_File_Integrity_Monitor {          private $monitored_paths = array();     private $baseline_file = 'file-integrity-baseline.json';          public function __construct() {         $this->monitored_paths = array(             ABSPATH . 'wp-admin/',             ABSPATH . 'wp-includes/',             WP_PLUGIN_DIR,             get_template_directory(),             ABSPATH . 'wp-config.php',             ABSPATH . '.htaccess'         );                  add_action('wp_loaded', array($this, 'check_integrity'));     }          public function create_baseline() {         $baseline = array();                  foreach ($this->monitored_paths as $path) {             if (is_file($path)) {                 $baseline[$path] = $this->get_file_signature($path);             } elseif (is_dir($path)) {                 $files = $this->get_directory_files($path);                                  foreach ($files as $file) {                     $baseline[$file] = $this->get_file_signature($file);                 }             }         }                  file_put_contents(             WP_CONTENT_DIR . '/' . $this->baseline_file,             json_encode($baseline, JSON_PRETTY_PRINT)         );                  return $baseline;     }          public function check_integrity() {         $baseline_path = WP_CONTENT_DIR . '/' . $this->baseline_file;                  if (!file_exists($baseline_path)) {             $this->create_baseline();             return;         }                  $baseline = json_decode(file_get_contents($baseline_path), true);         $changes = array(             'modified' => array(),             'added' => array(),             'deleted' => array()         );                  $current_files = array();                  foreach ($this->monitored_paths as $path) {             if (is_file($path)) {                 $current_files[$path] = $this->get_file_signature($path);             } elseif (is_dir($path)) {                 $files = $this->get_directory_files($path);                                  foreach ($files as $file) {                     $current_files[$file] = $this->get_file_signature($file);                 }             }         }                  <em>// Поиск изменений и новых файлов</em>         foreach ($current_files as $file => $signature) {             if (!isset($baseline[$file])) {                 $changes['added'][] = $file;             } elseif ($baseline[$file] !== $signature) {                 $changes['modified'][] = $file;             }         }                  <em>// Поиск удаленных файлов</em>         foreach ($baseline as $file => $signature) {             if (!isset($current_files[$file])) {                 $changes['deleted'][] = $file;             }         }                  <em>// Обработка изменений</em>         if (!empty($changes['modified']) || !empty($changes['added']) || !empty($changes['deleted'])) {             $this->handle_changes($changes);         }     }          private function get_file_signature($file) {         return array(             'md5' => md5_file($file),             'sha256' => hash_file('sha256', $file),             'size' => filesize($file),             'modified' => filemtime($file),             'permissions' => substr(sprintf('%o', fileperms($file)), -4)         );     }          private function get_directory_files($dir, $recursive = true) {         $files = array();         $iterator = new RecursiveIteratorIterator(             new RecursiveDirectoryIterator($dir, RecursiveDirectoryIterator::SKIP_DOTS),             RecursiveIteratorIterator::SELF_FIRST         );                  foreach ($iterator as $file) {             if ($file->isFile()) {                 $files[] = $file->getPathname();             }         }                  return $files;     }          private function handle_changes($changes) {         global $wpdb;                  <em>// Логирование в БД</em>         foreach ($changes as $type => $files) {             foreach ($files as $file) {                 $wpdb->insert(                     $wpdb->prefix . 'file_integrity_log',                     array(                         'file_path' => $file,                         'change_type' => $type,                         'timestamp' => current_time('mysql'),                         'user_ip' => $_SERVER['REMOTE_ADDR'] ?? 'CLI'                     )                 );             }         }                  <em>// Критические изменения требуют немедленного уведомления</em>         $critical_files = array('wp-config.php', '.htaccess');         $critical_changes = false;                  foreach ($changes as $type => $files) {             foreach ($files as $file) {                 $basename = basename($file);                                  if (in_array($basename, $critical_files)) {                     $critical_changes = true;                     break 2;                 }             }         }                  if ($critical_changes) {             $this->send_critical_alert($changes);         } else {             <em>// Обычный дайджест раз в день</em>             $this->queue_daily_report($changes);         }     }          private function send_critical_alert($changes) {         $message = "⚠️ CRITICAL FILE CHANGES DETECTED\n\n";                  foreach ($changes as $type => $files) {             if (!empty($files)) {                 $message .= strtoupper($type) . ":\n";                                  foreach ($files as $file) {                     $message .= "- $file\n";                 }                                  $message .= "\n";             }         }                  <em>// Множественные каналы уведомлений</em>         wp_mail(get_option('admin_email'), 'CRITICAL: File Integrity Alert', $message);                  <em>// SMS через Twilio (опционально)</em>         if (function_exists('send_sms_alert')) {             send_sms_alert($message);         }     }          private function queue_daily_report($changes) {         $existing_changes = get_option('pending_file_changes', array());         $existing_changes[] = array(             'timestamp' => time(),             'changes' => $changes         );                  update_option('pending_file_changes', $existing_changes);     } }  new Advanced_File_Integrity_Monitor(); </code>

bash<code>#!/bin/bash
<em># WordPress Security Audit Script</em>

SITE_PATH="/var/www/html"
REPORT_FILE="/var/log/wp-security-audit-$(date +%Y%m%d).txt"

echo "WordPress Security Audit - $(date)" > $REPORT_FILE
echo "======================================" >> $REPORT_FILE

<em># 1. Проверка прав доступа</em>
echo -e "\n[1] File Permissions Check" >> $REPORT_FILE
find $SITE_PATH -type f -perm 0777 >> $REPORT_FILE
find $SITE_PATH -type d -perm 0777 >> $REPORT_FILE

<em># 2. Поиск подозрительных файлов</em>
echo -e "\n[2] Suspicious Files" >> $REPORT_FILE
find $SITE_PATH -name "*.php" -type f -exec grep -l "eval(base64_decode" {} \; >> $REPORT_FILE
find $SITE_PATH -name "*.php" -type f -exec grep -l "system(" {} \; >> $REPORT_FILE
find $SITE_PATH -name "*.php" -type f -exec grep -l "exec(" {} \; >> $REPORT_FILE

<em># 3. PHP файлы в uploads</em>
echo -e "\n[3] PHP Files in Uploads" >> $REPORT_FILE
find $SITE_PATH/wp-content/uploads -name "*.php" >> $REPORT_FILE

<em># 4. Проверка wp-config.php</em>
echo -e "\n[4] wp-config.php Security" >> $REPORT_FILE
grep -i "WP_DEBUG.*true" $SITE_PATH/wp-config.php >> $REPORT_FILE
grep -i "DISALLOW_FILE_EDIT.*false" $SITE_PATH/wp-config.php >> $REPORT_FILE

<em># 5. Неиспользуемые темы и плагины</em>
echo -e "\n[5] Inactive Plugins and Themes" >> $REPORT_FILE
wp plugin list --status=inactive --path=$SITE_PATH >> $REPORT_FILE
wp theme list --status=inactive --path=$SITE_PATH >> $REPORT_FILE

<em># 6. Устаревшие компоненты</em>
echo -e "\n[6] Outdated Components" >> $REPORT_FILE
wp core check-update --path=$SITE_PATH >> $REPORT_FILE
wp plugin list --update=available --path=$SITE_PATH >> $REPORT_FILE

<em># Отправка отчета</em>
mail -s "WordPress Security Audit Report" admin@example.com < $REPORT_FILE
</code>

bash<code>#!/bin/bash <em># WordPress Security Audit Script</em>  SITE_PATH="/var/www/html" REPORT_FILE="/var/log/wp-security-audit-$(date +%Y%m%d).txt"  echo "WordPress Security Audit - $(date)" > $REPORT_FILE echo "======================================" >> $REPORT_FILE  <em># 1. Проверка прав доступа</em> echo -e "\n[1] File Permissions Check" >> $REPORT_FILE find $SITE_PATH -type f -perm 0777 >> $REPORT_FILE find $SITE_PATH -type d -perm 0777 >> $REPORT_FILE  <em># 2. Поиск подозрительных файлов</em> echo -e "\n[2] Suspicious Files" >> $REPORT_FILE find $SITE_PATH -name "*.php" -type f -exec grep -l "eval(base64_decode" {} \; >> $REPORT_FILE find $SITE_PATH -name "*.php" -type f -exec grep -l "system(" {} \; >> $REPORT_FILE find $SITE_PATH -name "*.php" -type f -exec grep -l "exec(" {} \; >> $REPORT_FILE  <em># 3. PHP файлы в uploads</em> echo -e "\n[3] PHP Files in Uploads" >> $REPORT_FILE find $SITE_PATH/wp-content/uploads -name "*.php" >> $REPORT_FILE  <em># 4. Проверка wp-config.php</em> echo -e "\n[4] wp-config.php Security" >> $REPORT_FILE grep -i "WP_DEBUG.*true" $SITE_PATH/wp-config.php >> $REPORT_FILE grep -i "DISALLOW_FILE_EDIT.*false" $SITE_PATH/wp-config.php >> $REPORT_FILE  <em># 5. Неиспользуемые темы и плагины</em> echo -e "\n[5] Inactive Plugins and Themes" >> $REPORT_FILE wp plugin list --status=inactive --path=$SITE_PATH >> $REPORT_FILE wp theme list --status=inactive --path=$SITE_PATH >> $REPORT_FILE  <em># 6. Устаревшие компоненты</em> echo -e "\n[6] Outdated Components" >> $REPORT_FILE wp core check-update --path=$SITE_PATH >> $REPORT_FILE wp plugin list --update=available --path=$SITE_PATH >> $REPORT_FILE  <em># Отправка отчета</em> mail -s "WordPress Security Audit Report" admin@example.com < $REPORT_FILE </code>

php<code>// Создание custom admin страницы с overview безопасности
add_action('admin_menu', function() {
    add_menu_page(
        'Security Dashboard',
        'Security',
        'manage_options',
        'security-dashboard',
        'render_security_dashboard',
        'dashicons-shield',
        3
    );
});

function render_security_dashboard() {
    ?>
    <div class="wrap">
        <h1>Security Dashboard</h1>
        
        <div class="security-metrics">
            <div class="metric-box">
                <h3>Failed Login Attempts (24h)</h3>
                <p class="metric-value"><?php echo get_failed_login_count(); ?></p>
            </div>
            
            <div class="metric-box">
                <h3>Blocked IPs</h3>
                <p class="metric-value"><?php echo count(get_option('blocked_ips', array())); ?></p>
            </div>
            
            <div class="metric-box">
                <h3>File Changes (7d)</h3>
                <p class="metric-value"><?php echo get_file_changes_count(); ?></p>
            </div>
            
            <div class="metric-box">
                <h3>Security Score</h3>
                <p class="metric-value"><?php echo calculate_security_score(); ?>/100</p>
            </div>
        </div>
        
        <h2>Recent Security Events</h2>
        <?php display_recent_security_events(); ?>
        
        <h2>Vulnerabilities</h2>
        <?php display_known_vulnerabilities(); ?>
        
        <h2>Quick Actions</h2>
        <button id="force-password-reset" class="button button-primary">Force Password Reset All Users</button>
        <button id="clear-failed-attempts" class="button">Clear Failed Login Attempts</button>
        <button id="run-malware-scan" class="button">Run Malware Scan</button>
    </div>
    <?php
}

function get_failed_login_count() {
    global $wpdb;
    return $wpdb->get_var(
        "SELECT COUNT(*) FROM {$wpdb->prefix}security_log 
        WHERE event_type = 'failed_login' 
        AND timestamp > DATE_SUB(NOW(), INTERVAL 24 HOUR)"
    );
}

function calculate_security_score() {
    $score = 100;
    
    <em>// Вычитаем баллы за проблемы</em>
    if (!get_option('users_can_register') == 0) $score -= 5;
    if (!defined('DISALLOW_FILE_EDIT') || DISALLOW_FILE_EDIT !== true) $score -= 10;
    if (get_option('blog_public') == 1) $score -= 5;
    
    <em>// Проверка устаревших плагинов</em>
    $outdated_plugins = 0; <em>// Логика проверки</em>
    $score -= ($outdated_plugins * 5);
    
    <em>// Проверка SSL</em>
    if (!is_ssl()) $score -= 15;
    
    return max(0, $score);
}
</code>

php<code>// Создание custom admin страницы с overview безопасности add_action('admin_menu', function() {     add_menu_page(         'Security Dashboard',         'Security',         'manage_options',         'security-dashboard',         'render_security_dashboard',         'dashicons-shield',         3     ); });  function render_security_dashboard() {     ?>     <div class="wrap">         <h1>Security Dashboard</h1>                  <div class="security-metrics">             <div class="metric-box">                 <h3>Failed Login Attempts (24h)</h3>                 <p class="metric-value"><?php echo get_failed_login_count(); ?></p>             </div>                          <div class="metric-box">                 <h3>Blocked IPs</h3>                 <p class="metric-value"><?php echo count(get_option('blocked_ips', array())); ?></p>             </div>                          <div class="metric-box">                 <h3>File Changes (7d)</h3>                 <p class="metric-value"><?php echo get_file_changes_count(); ?></p>             </div>                          <div class="metric-box">                 <h3>Security Score</h3>                 <p class="metric-value"><?php echo calculate_security_score(); ?>/100</p>             </div>         </div>                  <h2>Recent Security Events</h2>         <?php display_recent_security_events(); ?>                  <h2>Vulnerabilities</h2>         <?php display_known_vulnerabilities(); ?>                  <h2>Quick Actions</h2>         <button id="force-password-reset" class="button button-primary">Force Password Reset All Users</button>         <button id="clear-failed-attempts" class="button">Clear Failed Login Attempts</button>         <button id="run-malware-scan" class="button">Run Malware Scan</button>     </div>     <?php }  function get_failed_login_count() {     global $wpdb;     return $wpdb->get_var(         "SELECT COUNT(*) FROM {$wpdb->prefix}security_log          WHERE event_type = 'failed_login'          AND timestamp > DATE_SUB(NOW(), INTERVAL 24 HOUR)"     ); }  function calculate_security_score() {     $score = 100;          <em>// Вычитаем баллы за проблемы</em>     if (!get_option('users_can_register') == 0) $score -= 5;     if (!defined('DISALLOW_FILE_EDIT') || DISALLOW_FILE_EDIT !== true) $score -= 10;     if (get_option('blog_public') == 1) $score -= 5;          <em>// Проверка устаревших плагинов</em>     $outdated_plugins = 0; <em>// Логика проверки</em>     $score -= ($outdated_plugins * 5);          <em>// Проверка SSL</em>     if (!is_ssl()) $score -= 15;          return max(0, $score); } </code>