Gecko [ fernandoquevedodop.com ]

Name	Size	Permission
10_modsecurity_crs_10_config.c...	36.14 KB	-rw-r--r--
999_dreamhost_request_limits.c...	5.18 KB	-rw-r--r--
99_dreamhost_rules.conf	14 KB	-rw-r--r--
99_modsec-crs-setup.conf	31.99 KB	-rw-r--r--
REQUEST-00-LOCAL-WHITELIST.con...	8.83 KB	-rw-r--r--
REQUEST-901-INITIALIZATION.con...	14.37 KB	-rw-r--r--
REQUEST-903.9001-DRUPAL-EXCLUS...	13.24 KB	-rw-r--r--
REQUEST-903.9002-WORDPRESS-EXC...	25.21 KB	-rw-r--r--
REQUEST-903.9003-NEXTCLOUD-EXC...	10.39 KB	-rw-r--r--
REQUEST-903.9004-DOKUWIKI-EXCL...	7.64 KB	-rw-r--r--
REQUEST-905-COMMON-EXCEPTIONS....	1.61 KB	-rw-r--r--
REQUEST-911-METHOD-ENFORCEMENT...	2.91 KB	-rw-r--r--
REQUEST-913-SCANNER-DETECTION....	3.54 KB	-rw-r--r--
REQUEST-920-PROTOCOL-ENFORCEME...	62.98 KB	-rw-r--r--
REQUEST-921-PROTOCOL-ATTACK.co...	20.54 KB	-rw-r--r--
REQUEST-930-APPLICATION-ATTACK...	7.94 KB	-rw-r--r--
REQUEST-931-APPLICATION-ATTACK...	8.72 KB	-rw-r--r--
REQUEST-933-APPLICATION-ATTACK...	32.12 KB	-rw-r--r--
REQUEST-934-APPLICATION-ATTACK...	3.83 KB	-rw-r--r--
REQUEST-942-APPLICATION-ATTACK...	94.3 KB	-rw-r--r--
REQUEST-943-APPLICATION-ATTACK...	5.5 KB	-rw-r--r--
REQUEST-944-APPLICATION-ATTACK...	21.99 KB	-rw-r--r--
REQUEST-949-BLOCKING-EVALUATIO...	7.98 KB	-rw-r--r--
RESPONSE-999-EXCLUSION-RULES-A...	4.03 KB	-rw-r--r--
WPtoolUA.data	318 B	-rw-r--r--
cachefly.ips.data	166 B	-rw-r--r--
crawlers-user-agents.data	786 B	-rw-r--r--
dh_whitelist_ip.data	0 B	-rw-r--r--
fastly.ips.data	189 B	-rw-r--r--
incapsula.ips.data	110 B	-rw-r--r--
java-classes.data	1.78 KB	-rw-r--r--
java-code-leakages.data	264 B	-rw-r--r--
java-errors.data	240 B	-rw-r--r--
lfi-os-files.data	11.44 KB	-rw-r--r--
maxcdn.ips.data	623 B	-rw-r--r--
mod_sec.conf	2.03 KB	-rw-r--r--
modsecurity_46_slr_et_joomla.d...	1.69 KB	-rw-r--r--
modsecurity_46_slr_et_wordpres...	1.69 KB	-rw-r--r--
php-config-directives.data	12.43 KB	-rw-r--r--
php-errors.data	74.21 KB	-rw-r--r--
php-function-names-933150.data	3.33 KB	-rw-r--r--
php-function-names-933151.data	37.21 KB	-rw-r--r--
php-variables.data	610 B	-rw-r--r--
restricted-files.data	3.97 KB	-rw-r--r--
restricted-upload.data	2.45 KB	-rw-r--r--
scanners-headers.data	216 B	-rw-r--r--
scanners-urls.data	418 B	-rw-r--r--
scanners-user-agents.data	1.9 KB	-rw-r--r--
scripting-user-agents.data	717 B	-rw-r--r--
sig_inspect.lua	66.56 KB	-rw-r--r--
spam-mailer.data	84 B	-rw-r--r--
sql-errors.data	4.27 KB	-rw-r--r--
staminus.ips.data	228 B	-rw-r--r--
unix-shell.data	7.65 KB	-rw-r--r--
windows-powershell-commands.da...	7.05 KB	-rw-r--r--

Code Editor : REQUEST-903.9002-WORDPRESS-EXCLUSION-RULES.conf

# ------------------------------------------------------------------------
# OWASP ModSecurity Core Rule Set ver.3.3.2
# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
#
# The OWASP ModSecurity Core Rule Set is distributed under
# Apache Software License (ASL) version 2
# Please see the enclosed LICENSE file for full details.
# ------------------------------------------------------------------------

# These exclusions remedy false positives in a default WordPress install.
# The exclusions are only active if crs_exclusions_wordpress=1 is set.
# See rule 900130 in crs-setup.conf.example for instructions.
#
# Note that the WordPress comment field itself is currently NOT excluded
# from checking. The reason is that malicious content is regularly being
# posted to WordPress comment forms, and there have been various cases
# of XSS and even RCE vulnerabilities exploited by WordPress comments.

SecRule &TX:crs_exclusions_wordpress|TX:crs_exclusions_wordpress "@eq 0" \
    "id:9002000,\
    phase:1,\
    pass,\
    t:none,\
    nolog,\
    ver:'OWASP_CRS/3.3.2',\
    skipAfter:END-WORDPRESS"

SecRule &TX:crs_exclusions_wordpress|TX:crs_exclusions_wordpress "@eq 0" \
    "id:9002001,\
    phase:2,\
    pass,\
    t:none,\
    nolog,\
    ver:'OWASP_CRS/3.3.2',\
    skipAfter:END-WORDPRESS"

#
# -=[ WordPress Front-End ]=-
#

#
# [ Login form ]
#

# User login password
SecRule REQUEST_FILENAME "@endsWith /wp-login.php" \
    "id:9002100,\
    phase:2,\
    pass,\
    t:none,\
    nolog,\
    ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pwd,\
    ver:'OWASP_CRS/3.3.2'"

# Reset password
SecRule REQUEST_FILENAME "@endsWith /wp-login.php" \
    "id:9002120,\
    phase:2,\
    pass,\
    t:none,\
    nolog,\
    ver:'OWASP_CRS/3.3.2',\
    chain"
    SecRule ARGS:action "@streq resetpass" \
        "t:none,\
        chain"
        SecRule &ARGS:action "@eq 1" \
            "t:none,\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pass1,\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pass1-text,\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pass2"

#
# [ Comments ]
#

# Post comment
SecRule REQUEST_FILENAME "@endsWith /wp-comments-post.php" \
    "id:9002130,\
    phase:2,\
    pass,\
    t:none,\
    nolog,\
    ctl:ruleRemoveTargetById=931130;ARGS:url,\
    ver:'OWASP_CRS/3.3.2'"

#
# [ Gutenberg Editor ]
# Used when a user (auto)saves a post/page with Gutenberg.
#

# Gutenberg
SecRule REQUEST_FILENAME "@rx /wp-json/wp/v[0-9]+/(?:posts|pages)" \
    "id:9002140,\
    phase:1,\
    pass,\
    t:none,\
    nolog,\
    ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:content,\
    ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:json.content,\
    ver:'OWASP_CRS/3.3.2'"

# Gutenberg via rest_route for sites without pretty permalinks
SecRule REQUEST_FILENAME "@endsWith /index.php" \
    "id:9002141,\
    phase:1,\
    pass,\
    t:none,\
    nolog,\
    ver:'OWASP_CRS/3.3.2',\
    chain"
    SecRule &ARGS:rest_route "@eq 1" \
        "t:none,\
        nolog,\
        chain"
        SecRule ARGS:rest_route "@rx ^/wp/v[0-9]+/(?:posts|pages)" \
            "t:none,\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:content,\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:json.content"

# Gutenberg upload image/media
SecRule REQUEST_FILENAME "@rx /wp-json/wp/v[0-9]+/media" \
    "id:9002142,\
    phase:1,\
    pass,\
    t:none,\
    nolog,\
    ctl:ruleRemoveById=200002,\
    ctl:ruleRemoveById=200003,\
    ver:'OWASP_CRS/3.3.2'"

# Gutenberg upload image/media via rest_route for sites without pretty permalinks
SecRule REQUEST_FILENAME "@endsWith /index.php" \
    "id:9002143,\
    phase:1,\
    pass,\
    t:none,\
    nolog,\
    ver:'OWASP_CRS/3.3.2',\
    chain"
    SecRule &ARGS:rest_route "@eq 1" \
        "t:none,\
        nolog,\
        chain"
        SecRule ARGS:rest_route "@rx ^/wp/v[0-9]+/media" \
            "t:none,\
            ctl:ruleRemoveById=200002,\
            ctl:ruleRemoveById=200003"

#
# [ Live preview ]
# Used when an administrator customizes the site and previews the result
# as a normal user.
#

# Theme select
# Example: wp_customize=on&theme=twentyfifteen&customized=
# {"old_sidebars_widgets_data":{"wp_inactive_widgets":[],
# "sidebar-1":["search-2","recent-posts-2","recent-comments-2",
# "archives-2","categories-2","meta-2"]}}&nonce=XXX&
# customize_messenger_channel=preview-0
SecRule ARGS:wp_customize "@streq on" \
    "id:9002150,\
    phase:2,\
    pass,\
    t:none,\
    nolog,\
    ver:'OWASP_CRS/3.3.2',\
    chain"
    SecRule &ARGS:action "@eq 0" \
        "t:none,\
        ctl:ruleRemoveTargetById=942200;ARGS:customized,\
        ctl:ruleRemoveTargetById=942260;ARGS:customized,\
        ctl:ruleRemoveTargetById=942300;ARGS:customized,\
        ctl:ruleRemoveTargetById=942330;ARGS:customized,\
        ctl:ruleRemoveTargetById=942340;ARGS:customized,\
        ctl:ruleRemoveTargetById=942370;ARGS:customized,\
        ctl:ruleRemoveTargetById=942430;ARGS:customized,\
        ctl:ruleRemoveTargetById=942431;ARGS:customized,\
        ctl:ruleRemoveTargetById=942460;ARGS:customized"

# Appearance -> Widgets -> Live Preview
SecRule ARGS:wp_customize "@streq on" \
    "id:9002160,\
    phase:2,\
    pass,\
    t:none,\
    nolog,\
    ver:'OWASP_CRS/3.3.2',\
    chain"
    SecRule ARGS:action "@rx ^(?:|customize_save|update-widget)$" \
        "t:none,\
        chain"
        SecRule &ARGS:action "@eq 1" \
            "t:none,\
            ctl:ruleRemoveTargetById=942200;ARGS:customized,\
            ctl:ruleRemoveTargetById=942260;ARGS:customized,\
            ctl:ruleRemoveTargetById=942300;ARGS:customized,\
            ctl:ruleRemoveTargetById=942330;ARGS:customized,\
            ctl:ruleRemoveTargetById=942340;ARGS:customized,\
            ctl:ruleRemoveTargetById=942370;ARGS:customized,\
            ctl:ruleRemoveTargetById=942430;ARGS:customized,\
            ctl:ruleRemoveTargetById=942431;ARGS:customized,\
            ctl:ruleRemoveTargetById=942460;ARGS:customized,\
            ctl:ruleRemoveTargetById=920230;ARGS:partials,\
            ctl:ruleRemoveTargetById=941320;ARGS:partials,\
            ctl:ruleRemoveTargetById=942180;ARGS:partials,\
            ctl:ruleRemoveTargetById=942200;ARGS:partials,\
            ctl:ruleRemoveTargetById=942260;ARGS:partials,\
            ctl:ruleRemoveTargetById=942330;ARGS:partials,\
            ctl:ruleRemoveTargetById=942340;ARGS:partials,\
            ctl:ruleRemoveTargetById=942370;ARGS:partials,\
            ctl:ruleRemoveTargetById=942430;ARGS:partials,\
            ctl:ruleRemoveTargetById=942431;ARGS:partials,\
            ctl:ruleRemoveTargetById=942460;ARGS:partials"

# Self calls to wp-cron.php?doing_wp_cron=[timestamp]
# These requests may be missing Accept, Content-Length headers.
# This rule must run in phase:1.
SecRule REQUEST_FILENAME "@endsWith /wp-cron.php" \
    "id:9002200,\
    phase:1,\
    pass,\
    t:none,\
    nolog,\
    ctl:ruleRemoveById=920180,\
    ctl:ruleRemoveById=920300,\
    ver:'OWASP_CRS/3.3.2'"

#
# [ Cookies ]

# WP Session Manager
# Cookie: _wp_session=[hex]||[timestamp]||[timestamp]
# detected SQLi using libinjection with fingerprint 'n&1'
SecRule REQUEST_COOKIES:_wp_session "@rx ^[0-9a-f]+\|\|\d+\|\|\d+$" \
    "id:9002300,\
    phase:1,\
    pass,\
    t:none,\
    nolog,\
    ver:'OWASP_CRS/3.3.2',\
    chain"
    SecRule &REQUEST_COOKIES:_wp_session "@eq 1" \
        "t:none,\
        ctl:ruleRemoveTargetById=942100;REQUEST_COOKIES:_wp_session"

#
# -=[ WordPress Administration Back-End (wp-admin) ]=-
#

# Skip this section for performance unless /wp-admin/ is in filename

SecRule REQUEST_FILENAME "!@contains /wp-admin/" \
    "id:9002400,\
    phase:1,\
    pass,\
    t:none,\
    nolog,\
    ver:'OWASP_CRS/3.3.2',\
    skipAfter:END-WORDPRESS-ADMIN"

SecRule REQUEST_FILENAME "!@contains /wp-admin/" \
    "id:9002401,\
    phase:2,\
    pass,\
    t:none,\
    nolog,\
    ver:'OWASP_CRS/3.3.2',\
    skipAfter:END-WORDPRESS-ADMIN"

#
# [ Installation ]
#

# WordPress installation: exclude database password
SecRule REQUEST_FILENAME "@endsWith /wp-admin/setup-config.php" \
    "id:9002410,\
    phase:2,\
    pass,\
    t:none,\
    nolog,\
    ver:'OWASP_CRS/3.3.2',\
    chain"
    SecRule ARGS:step "@streq 2" \
        "t:none,\
        chain"
        SecRule &ARGS:step "@eq 1" \
            "t:none,\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pwd"

# WordPress installation: exclude admin password
SecRule REQUEST_FILENAME "@endsWith /wp-admin/install.php" \
    "id:9002420,\
    phase:2,\
    pass,\
    t:none,\
    nolog,\
    ver:'OWASP_CRS/3.3.2',\
    chain"
    SecRule ARGS:step "@streq 2" \
        "t:none,\
        chain"
        SecRule &ARGS:step "@eq 1" \
            "t:none,\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:admin_password,\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:admin_password2,\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pass1-text"

#
# [ User management ]
#

# Edit logged-in user
SecRule REQUEST_FILENAME "@endsWith /wp-admin/profile.php" \
    "id:9002520,\
    phase:2,\
    pass,\
    t:none,\
    nolog,\
    ver:'OWASP_CRS/3.3.2',\
    chain"
    SecRule ARGS:action "@streq update" \
        "t:none,\
        chain"
        SecRule &ARGS:action "@eq 1" \
            "t:none,\
            ctl:ruleRemoveTargetById=931130;ARGS:url,\
            ctl:ruleRemoveTargetById=931130;ARGS:facebook,\
            ctl:ruleRemoveTargetById=931130;ARGS:instagram,\
            ctl:ruleRemoveTargetById=931130;ARGS:linkedin,\
            ctl:ruleRemoveTargetById=931130;ARGS:myspace,\
            ctl:ruleRemoveTargetById=931130;ARGS:pinterest,\
            ctl:ruleRemoveTargetById=931130;ARGS:soundcloud,\
            ctl:ruleRemoveTargetById=931130;ARGS:tumblr,\
            ctl:ruleRemoveTargetById=931130;ARGS:youtube,\
            ctl:ruleRemoveTargetById=931130;ARGS:wikipedia,\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pass1,\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pass1-text,\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pass2"

# Edit user
SecRule REQUEST_FILENAME "@endsWith /wp-admin/user-edit.php" \
    "id:9002530,\
    phase:2,\
    pass,\
    t:none,\
    nolog,\
    ver:'OWASP_CRS/3.3.2',\
    chain"
    SecRule ARGS:action "@streq update" \
        "t:none,\
        chain"
        SecRule &ARGS:action "@eq 1" \
            "t:none,\
            ctl:ruleRemoveTargetById=931130;ARGS:url,\
            ctl:ruleRemoveTargetById=931130;ARGS:url,\
            ctl:ruleRemoveTargetById=931130;ARGS:facebook,\
            ctl:ruleRemoveTargetById=931130;ARGS:instagram,\
            ctl:ruleRemoveTargetById=931130;ARGS:linkedin,\
            ctl:ruleRemoveTargetById=931130;ARGS:myspace,\
            ctl:ruleRemoveTargetById=931130;ARGS:pinterest,\
            ctl:ruleRemoveTargetById=931130;ARGS:soundcloud,\
            ctl:ruleRemoveTargetById=931130;ARGS:tumblr,\
            ctl:ruleRemoveTargetById=931130;ARGS:youtube,\
            ctl:ruleRemoveTargetById=931130;ARGS:wikipedia,\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pass1,\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pass1-text,\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pass2"

# Create user
SecRule REQUEST_FILENAME "@endsWith /wp-admin/user-new.php" \
    "id:9002540,\
    phase:2,\
    pass,\
    t:none,\
    nolog,\
    ver:'OWASP_CRS/3.3.2',\
    chain"
    SecRule ARGS:action "@streq createuser" \
        "t:none,\
        chain"
        SecRule &ARGS:action "@eq 1" \
            "t:none,\
            ctl:ruleRemoveTargetById=931130;ARGS:url,\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pass1,\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pass1-text,\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:pass2"

#
# [ General exclusions ]
#

# _wp_http_referer and wp_http_referer are passed on a lot of wp-admin pages
SecAction \
    "id:9002600,\
    phase:2,\
    pass,\
    t:none,\
    nolog,\
    ctl:ruleRemoveTargetById=920230;ARGS:_wp_http_referer,\
    ctl:ruleRemoveTargetById=931130;ARGS:_wp_http_referer,\
    ctl:ruleRemoveTargetById=932150;ARGS:_wp_http_referer,\
    ctl:ruleRemoveTargetById=941100;ARGS:_wp_http_referer,\
    ctl:ruleRemoveTargetById=942130;ARGS:_wp_http_referer,\
    ctl:ruleRemoveTargetById=942200;ARGS:_wp_http_referer,\
    ctl:ruleRemoveTargetById=942260;ARGS:_wp_http_referer,\
    ctl:ruleRemoveTargetById=942431;ARGS:_wp_http_referer,\
    ctl:ruleRemoveTargetById=942440;ARGS:_wp_http_referer,\
    ctl:ruleRemoveTargetById=920230;ARGS:wp_http_referer,\
    ctl:ruleRemoveTargetById=931130;ARGS:wp_http_referer,\
    ctl:ruleRemoveTargetById=932150;ARGS:wp_http_referer,\
    ctl:ruleRemoveTargetById=941100;ARGS:wp_http_referer,\
    ctl:ruleRemoveTargetById=942130;ARGS:wp_http_referer,\
    ctl:ruleRemoveTargetById=942200;ARGS:wp_http_referer,\
    ctl:ruleRemoveTargetById=942260;ARGS:wp_http_referer,\
    ctl:ruleRemoveTargetById=942431;ARGS:wp_http_referer,\
    ver:'OWASP_CRS/3.3.2'"

#
# [ Content editing ]
#

# Edit posts and pages
# /wp-admin/post.php, /wp-admin/post.php?t=[timestamp]
# - Themes do not properly escape post_title in HTML, so beware of XSS
#   and be conservative in excluding this parameter.
# - Parameter _wp_http_referer can appear multiple times.
SecRule REQUEST_FILENAME "@endsWith /wp-admin/post.php" \
    "id:9002700,\
    phase:2,\
    pass,\
    t:none,\
    nolog,\
    ver:'OWASP_CRS/3.3.2',\
    chain"
    SecRule ARGS:action "@rx ^(?:edit|editpost)$" \
        "t:none,\
        chain"
        SecRule &ARGS:action "@eq 1" \
            "t:none,\
            ctl:ruleRemoveTargetByTag=attack-sqli;ARGS:post_title,\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:content,\
            ctl:ruleRemoveById=920272,\
            ctl:ruleRemoveById=921180"

# Autosave posts and pages
# ARGS_NAMES:data[wp-check-locked-posts][] can appear multiple times
SecRule REQUEST_FILENAME "@endsWith /wp-admin/admin-ajax.php" \
    "id:9002710,\
    phase:2,\
    pass,\
    t:none,\
    nolog,\
    ver:'OWASP_CRS/3.3.2',\
    chain"
    SecRule ARGS:action "@streq heartbeat" \
        "t:none,\
        chain"
        SecRule &ARGS:action "@eq 1" \
            "t:none,\
            ctl:ruleRemoveTargetByTag=attack-sqli;ARGS:data[wp_autosave][post_title],\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:data[wp_autosave][content],\
            ctl:ruleRemoveTargetById=942431;ARGS_NAMES:data[wp-refresh-post-lock][post_id],\
            ctl:ruleRemoveTargetById=942431;ARGS_NAMES:data[wp-refresh-post-lock][lock],\
            ctl:ruleRemoveTargetById=942431;ARGS_NAMES:data[wp-check-locked-posts][],\
            ctl:ruleRemoveById=921180,\
            ctl:ruleRemoveById=920272"

# Edit menus
SecRule REQUEST_FILENAME "@endsWith /wp-admin/nav-menus.php" \
    "id:9002720,\
    phase:2,\
    pass,\
    t:none,\
    nolog,\
    ver:'OWASP_CRS/3.3.2',\
    chain"
    SecRule ARGS:action "@streq update" \
        "t:none,\
        chain"
        SecRule &ARGS:action "@eq 1" \
            "t:none,\
            ctl:ruleRemoveTargetById=942460;ARGS:menu-name,\
            ctl:ruleRemoveTargetById=941330;ARGS:nav-menu-data,\
            ctl:ruleRemoveTargetById=941340;ARGS:nav-menu-data,\
            ctl:ruleRemoveTargetById=942200;ARGS:nav-menu-data,\
            ctl:ruleRemoveTargetById=942260;ARGS:nav-menu-data,\
            ctl:ruleRemoveTargetById=942330;ARGS:nav-menu-data,\
            ctl:ruleRemoveTargetById=942340;ARGS:nav-menu-data,\
            ctl:ruleRemoveTargetById=942430;ARGS:nav-menu-data,\
            ctl:ruleRemoveTargetById=942431;ARGS:nav-menu-data,\
            ctl:ruleRemoveTargetById=942460;ARGS:nav-menu-data"

# Edit text widgets (can contain custom HTML)
SecRule REQUEST_FILENAME "@endsWith /wp-admin/admin-ajax.php" \
    "id:9002730,\
    phase:2,\
    pass,\
    t:none,\
    nolog,\
    ver:'OWASP_CRS/3.3.2',\
    chain"
    SecRule ARGS:action "@rx ^(?:save-widget|update-widget)$" \
        "t:none,\
        chain"
        SecRule &ARGS:action "@eq 1" \
            "t:none,\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[0][text],\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[1][text],\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[2][text],\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[3][text],\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[4][text],\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[5][text],\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[6][text],\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[7][text],\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[8][text],\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[9][text],\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[10][text],\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[11][text],\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[12][text],\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[13][text],\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[14][text],\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[15][text],\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[16][text],\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[17][text],\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[18][text],\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[19][text],\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[20][text],\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[21][text],\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[22][text],\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[23][text],\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[24][text],\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[25][text],\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[26][text],\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[27][text],\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[28][text],\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[29][text],\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[30][text],\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[31][text],\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[32][text],\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[33][text],\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[34][text],\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[35][text],\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[36][text],\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[37][text],\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[38][text],\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:widget-text[39][text]"

# Reorder widgets
SecRule REQUEST_FILENAME "@endsWith /wp-admin/admin-ajax.php" \
    "id:9002740,\
    phase:2,\
    pass,\
    t:none,\
    nolog,\
    ver:'OWASP_CRS/3.3.2',\
    chain"
    SecRule ARGS:action "@streq widgets-order" \
        "t:none,\
        chain"
        SecRule &ARGS:action "@eq 1" \
            "t:none,\
            ctl:ruleRemoveTargetById=942430;ARGS:sidebars[sidebar-1],\
            ctl:ruleRemoveTargetById=942431;ARGS:sidebars[sidebar-1],\
            ctl:ruleRemoveTargetById=942430;ARGS:sidebars[sidebar-2],\
            ctl:ruleRemoveTargetById=942431;ARGS:sidebars[sidebar-2],\
            ctl:ruleRemoveTargetById=942430;ARGS:sidebars[sidebar-3],\
            ctl:ruleRemoveTargetById=942431;ARGS:sidebars[sidebar-3],\
            ctl:ruleRemoveTargetById=942430;ARGS:sidebars[sidebar-4],\
            ctl:ruleRemoveTargetById=942431;ARGS:sidebars[sidebar-4],\
            ctl:ruleRemoveTargetById=942430;ARGS:sidebars[sidebar-5],\
            ctl:ruleRemoveTargetById=942431;ARGS:sidebars[sidebar-5],\
            ctl:ruleRemoveTargetById=942430;ARGS:sidebars[sidebar-6],\
            ctl:ruleRemoveTargetById=942431;ARGS:sidebars[sidebar-6],\
            ctl:ruleRemoveTargetById=942430;ARGS:sidebars[sidebar-7],\
            ctl:ruleRemoveTargetById=942431;ARGS:sidebars[sidebar-7]"

# Create permalink sample for new post
SecRule REQUEST_FILENAME "@endsWith /wp-admin/admin-ajax.php" \
    "id:9002750,\
    phase:2,\
    pass,\
    t:none,\
    nolog,\
    ver:'OWASP_CRS/3.3.2',\
    chain"
    SecRule ARGS:action "@streq sample-permalink" \
        "t:none,\
        chain"
        SecRule &ARGS:action "@eq 1" \
            "t:none,\
            ctl:ruleRemoveTargetByTag=attack-sqli;ARGS:new_title"

# Add external link to menu
SecRule REQUEST_FILENAME "@endsWith /wp-admin/admin-ajax.php" \
    "id:9002760,\
    phase:2,\
    pass,\
    t:none,\
    nolog,\
    ver:'OWASP_CRS/3.3.2',\
    chain"
    SecRule ARGS:action "@streq add-menu-item" \
        "t:none,\
        chain"
        SecRule &ARGS:action "@eq 1" \
            "t:none,\
            ctl:ruleRemoveTargetById=931130;ARGS:menu-item[-1][menu-item-url]"

# Editor: Add Media, Insert Media, Insert into page
SecRule REQUEST_FILENAME "@endsWith /wp-admin/admin-ajax.php" \
    "id:9002770,\
    phase:2,\
    pass,\
    t:none,\
    nolog,\
    ver:'OWASP_CRS/3.3.2',\
    chain"
    SecRule ARGS:action "@streq send-attachment-to-editor" \
        "t:none,\
        chain"
        SecRule &ARGS:action "@eq 1" \
            "t:none,\
            ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:html"

#
# [ Options and Settings ]
#

# Change site URL
SecRule REQUEST_FILENAME "@endsWith /wp-admin/options.php" \
    "id:9002800,\
    phase:2,\
    pass,\
    t:none,\
    nolog,\
    ver:'OWASP_CRS/3.3.2',\
    chain"
    SecRule ARGS:option_page "@streq general" \
        "t:none,\
        chain"
        SecRule &ARGS:option_page "@eq 1" \
            "t:none,\
            chain"
            SecRule ARGS:action "@streq update" \
                "t:none,\
                chain"
                SecRule &ARGS:action "@eq 1" \
                    "t:none,\
                    ctl:ruleRemoveTargetById=931130;ARGS:home,\
                    ctl:ruleRemoveTargetById=931130;ARGS:siteurl"

# Permalink settings
# permalink_structure=/index.php/%year%/%monthnum%/%day%/%postname%/
SecRule REQUEST_FILENAME "@endsWith /wp-admin/options-permalink.php" \
    "id:9002810,\
    phase:2,\
    pass,\
    t:none,\
    nolog,\
    ctl:ruleRemoveTargetById=920230;ARGS:selection,\
    ctl:ruleRemoveTargetById=920272;ARGS:selection,\
    ctl:ruleRemoveTargetById=942431;ARGS:selection,\
    ctl:ruleRemoveTargetById=920230;ARGS:permalink_structure,\
    ctl:ruleRemoveTargetById=920272;ARGS:permalink_structure,\
    ctl:ruleRemoveTargetById=942431;ARGS:permalink_structure,\
    ctl:ruleRemoveTargetById=920272;REQUEST_BODY,\
    ver:'OWASP_CRS/3.3.2'"

# Comments blacklist and moderation list
SecRule REQUEST_FILENAME "@endsWith /wp-admin/options.php" \
    "id:9002820,\
    phase:2,\
    pass,\
    t:none,\
    nolog,\
    ver:'OWASP_CRS/3.3.2',\
    chain"
    SecRule ARGS:option_page "@streq discussion" \
        "t:none,\
        chain"
        SecRule &ARGS:option_page "@eq 1" \
            "t:none,\
            chain"
            SecRule ARGS:action "@streq update" \
                "t:none,\
                chain"
                SecRule &ARGS:action "@eq 1" \
                    "t:none,\
                    ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:blacklist_keys,\
                    ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:moderation_keys"

# Posts/pages overview search
SecRule REQUEST_FILENAME "@endsWith /wp-admin/edit.php" \
    "id:9002830,\
    phase:1,\
    pass,\
    t:none,\
    nolog,\
    ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:s,\
    ver:'OWASP_CRS/3.3.2'"

#
# [ Helpers ]
#

# /wp-admin/load-scripts.php?c=0&load%5B%5D=hoverIntent,common,
# admin-bar,wp-ajax-response,jquery-color,wp-lists,quicktags,
# jquery-query,admin-comments,svg-painter,heartbeat,&load%5B%5D=
# wp-auth-check,wp-a11y,wplink,jquery-ui-core,jquery-ui-widget,
# jquery-ui-position,jquery-ui-menu,jquery-ui-autocomplete&ver=4.6.1
#
# /wp-admin/load-styles.php?c=0&dir=ltr&load%5B%5D=dashicons,
# admin-bar,buttons,media-views,common,forms,admin-menu,dashboard,
# list-tables,edit,revisions,media,themes,about,nav-menu&load%5B%5D=
# s,widgets,site-icon,l10n,wp-auth-check&ver=4.6.1
#
# /wp-admin/load-scripts.php?c=0&load%5B%5D=hoverIntent,common,
# admin-bar,jquery-ui-widget,jquery-ui-position,wp-pointer,
# wp-ajax-response,jquery-color,wp-lists,quicktags,
# jqu&load%5B%5D=ery-query,admin-comments,jquery-ui-core,
# jquery-ui-mouse,jquery-ui-sortable,postbox,dashboard,underscore,
# customize-base,customize&load%5B%5D=-loader,thickbox,plugin-install,
# wp-util,wp-a11y,updates,shortcode,media-upload,svg-painter,
# jquery-ui-accordion&ver=3f9999390861a0133beda3ee8acf152e
SecRule REQUEST_FILENAME "@rx /wp-admin/load-(?:scripts|styles)\.php$" \
    "id:9002900,\
    phase:2,\
    pass,\
    t:none,\
    nolog,\
    ctl:ruleRemoveById=921180,\
    ctl:ruleRemoveTargetById=920273;ARGS_NAMES:load[],\
    ctl:ruleRemoveTargetById=942432;ARGS_NAMES:load[],\
    ctl:ruleRemoveTargetById=942360;ARGS:load[],\
    ctl:ruleRemoveTargetById=942430;ARGS:load[],\
    ctl:ruleRemoveTargetById=942431;ARGS:load[],\
    ctl:ruleRemoveTargetById=942432;ARGS:load[],\
    ver:'OWASP_CRS/3.3.2'"

SecMarker "END-WORDPRESS-ADMIN"

SecMarker "END-WORDPRESS"

${this.title}

Code Editor : REQUEST-903.9002-WORDPRESS-EXCLUSION-RULES.conf