Question WPToolkit Block access to potentially sensitive files

[Dmytro]

Server operating system version

CloudLinux 8.8

Plesk version and microupdate number

18.0.61 #5

Hi. WPToolkit has this option here:

Once it is enabled, nginx vhost configuration file be appended with this rule:

# "Block access to potentially sensitive files"
    # To remove this rule, revert this security measure on each WordPress installation on this domain
    location ~* ".*\.(?:psd|log|cmd|exe|bat|csh|ini|sh)$" {
        return 403;
    }

In this case it blocks even local requests to .user.ini files that is could be used for different purposes , for example this file used by WordFence firewall

 

[Kaspar@Plesk]

It blocks direct access to these files for remote requests. But it does not prohibits the usage of these files. The WordFence firewall should still function if this rule is enabled.

 

[Dmytro]

I thought it's wordfence because of this log entry (get request from server ip where site is hosted)

 

[Bitpalast]

.user.ini should not be a requirement by Wordfence. If specific webspace configurations are required, these can also be set in the panel's GUI.

 

[Kaspar@Plesk]

@Dmytro the errors shown on the log of your screenshot are not caused by the "Block access to potentially sensitive files" option from the WP toolkit. (Because in that case the errors would get logged in the Nginx logs.) Instead these errors are (most likely) caused by the .htaccess configuration from WordFence, which blocks access the .user.ini file too. When the WordFence firewall scan runs, it checks if this file is file isn't accessible. That's why it shows up in your logs with the IP from the server.

 

[Dmytro]

@Dmytro the errors shown on the log of your screenshot are not caused by the "Block access to potentially sensitive files" option from the WP toolkit. (Because in that case the errors would get logged in the Nginx logs.) Instead these errors are (most likely) caused by the .htaccess configuration from WordFence, which blocks access the .user.ini file too. When the WordFence firewall scan runs, it checks if this file is file isn't accessible. That's why it shows up in your logs with the IP from the server.

thanks, looks like it's best answer!