Server Security

RULE 1
Block suspicious query strings:
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{QUERY_STRING} (\<|%3C|script|base64|eval|union|select|insert|drop) [NC]
RewriteRule ^(.*)$ - [F,L]
</IfModule>

This .htaccess rule acts as a server-level firewall. It scans incoming query strings for signs of injection—like <script> tags

RULE 2
Prevent iframe embedding:
Header always set X-Frame-Options "SAMEORIGIN"

This header is a simple but powerful defense. It tells browsers: ‘Don’t let other sites embed mine in an iframe unless it’s from the same origin.’ That blocks clickjacking and phishing attempts

RULE 3
Disable PHP execution in uploads:

<FilesMatch "\.(php|php5|phtml)$">
  Order Deny,Allow
  Deny from all
</FilesMatch>

After simulating the redirect malware, we hardened the server by disabling PHP execution in folders like /uploads/ and /mu-plugins/. This .htaccess rule blocks any rogue scripts from running—even if they’re uploaded or injected silently.”

“It’s a proactive layer of defense. Even if a plugin fails or a user uploads something unsafe, the server won’t execute it. This is part of Ocean Marketing’s full lifecycle security workflow: attack, detection, recovery, and prevention.”


RULE 4
Block bot-based reconnaissance:
SetEnvIfNoCase User-Agent "curl|wget|python" bad_bot
Order Allow,Deny
Allow from all
Deny from env=bad_bot

This rule blocks automated tools like curl, wget, and Python scripts—often used in reconnaissance or scraping. It checks the User-Agent header and denies access if it matches known bot signatures.”

“We use this in Ocean Marketing’s .htaccess hardening to reduce surface area for attack. It’s lightweight, doesn’t rely on plugins, and protects even if WordPress is compromised.”

“In real-world malware cases—like the ones SEO Guru Atlanta reported—attackers often use curl or Python scripts to inject payloads or test vulnerabilities. This rule stops them before they reach the application layer.