feat(wordpress): adiciona plugin wordpress (agents, skills, knowledge e metadados do projeto)

2026-10-28 16:09:51 +00:00
parent a32752df8a
commit 63b1d79095
58 changed files with 7380 additions and 0 deletions
@@ -0,0 +1,158 @@
+---
+name: wp-hardening
+description: Aplicar hardening de seguranca standard a sites WordPress via SSH. Desactiva XML-RPC, file editing, directory listing, esconde versao WP, verifica permissoes e security headers.
+layer: wiki
+---
+
+# /wp-hardening - Hardening WordPress
+
+Aplica medidas de hardening standard a sites WordPress no servidor CWP (176.9.3.158).
+
+> **Nota:** Esta skill APLICA alteracoes. Para auditar sem alterar, usar `/security-check`.
+
+## Contexto NotebookLM
+
+ANTES de executar, consultar notebook para contexto:
+
+| Notebook | ID | Consultar quando |
+|----------|-----|-----------------|
+| WordPress e Elementor | 5be0d1a6 | Sempre |
+
+```
+mcp__notebooklm__notebook_query({
+  notebook_id: "5be0d1a6-00f2-4cd9-b835-978cb7721601",
+  query: "wordpress security hardening best practices"
+})
+```
+
+---
+
+## Uso
+
+```
+/wp-hardening descomplicar.pt
+/wp-hardening all                    # todos os 16 sites
+/wp-hardening descomplicar.pt --dry  # apenas verificar, sem aplicar
+```
+
+**Argumento:** dominio do site (ver tabela de sites em /wp-update) ou `all`.
+**Flag `--dry`:** apenas verifica estado actual sem aplicar alteracoes.
+
+---
+
+## Sites WordPress no servidor
+
+| Conta | Site | Path |
+|-------|------|------|
+| carstuff | carstuff.pt | /home/carstuff/public_html |
+| ealmeida | descomplicar.pt | /home/ealmeida/public_html |
+| ealmeida | emanuelalmeida.pt | /home/ealmeida/emanuelalmeida.pt |
+| ealmeida | ecommerce.descomplicar.pt | /home/ealmeida/ecommerce.descomplicar.pt |
+| ealmeida | ecommerce-demo.descomplicar.pt | /home/ealmeida/ecommerce-demo.descomplicar.pt |
+| ealmeida | starter.descomplicar.pt | /home/ealmeida/starter.descomplicar.pt |
+| ealmeida | care.descomplicar.pt | /home/ealmeida/care.descomplicar.pt |
+| ealmeida | e-commerce.descomplicar.pt | /home/ealmeida/e-commerce.descomplicar.pt |
+| espiral | espiralsenior.pt | /home/espiral/public_html |
+| espiral | dev.espiralsenior.pt | /home/espiral/dev.espiralsenior.pt |
+| familycl | familyclinic.pt | /home/familycl/public_html |
+| ignition | ignitionvortex.pt | /home/ignition/public_html |
+| karate | karateclubedegaia.com | /home/karate/karateclubedegaia.com |
+| sintri | sintricare.com.pt | /home/sintri/public_html |
+| solarfv | solarfvengenharia.com | /home/solarfv/public_html |
+| wtc | watercontrol.pt | /home/wtc/public_html |
+
+---
+
+## Execucao
+
+### Passo 0: Identificar site e path
+
+Mapear o dominio fornecido para o path e conta do servidor usando a tabela acima.
+
+```bash
+SITE="dominio.pt"
+WP_PATH="/home/USER/public_html"
+WP_USER="user"
+```
+
+### Passo 1: Verificar estado actual (antes)
+
+Executar via `mcp__ssh-unified__ssh_execute` no servidor `cwp`:
+
+```bash
+# 1. XML-RPC activo?
+curl -s -o /dev/null -w "%{http_code}" -X POST "${SITE}/xmlrpc.php" -d '<?xml version="1.0"?><methodCall><methodName>system.listMethods</methodName></methodCall>'
+
+# 2. DISALLOW_FILE_EDIT definido?
+grep -c "DISALLOW_FILE_EDIT" ${WP_PATH}/wp-config.php
+
+# 3. Permissoes directórios (esperado: 755)
+find ${WP_PATH} -type d -not -perm 755 | head -10
+
+# 4. Permissoes ficheiros (esperado: 644)
+find ${WP_PATH} -type f -not -perm 644 -not -name "wp-config.php" | head -10
+
+# 5. Versao WP exposta no HTML?
+curl -s ${SITE} | grep -o 'content="WordPress [0-9.]*"' | head -1
+
+# 6. Versao WP exposta no feed?
+curl -s ${SITE}/feed/ | grep -o '<generator>.*</generator>' | head -1
+
+# 7. Directory listing activo?
+curl -s -o /dev/null -w "%{http_code}" ${SITE}/wp-content/uploads/
+
+# 8. wp-config.php permissoes (esperado: 400 ou 440)
+stat -c "%a" ${WP_PATH}/wp-config.php
+
+# 9. .htaccess security headers?
+grep -c "X-Frame-Options\|X-Content-Type-Options\|X-XSS-Protection\|Referrer-Policy\|Content-Security-Policy\|Strict-Transport-Security" ${WP_PATH}/.htaccess 2>/dev/null
+
+# 10. debug.log exposto?
+test -f ${WP_PATH}/wp-content/debug.log && echo "EXPOSTO" || echo "OK"
+```
+
+Registar cada resultado como ANTES.
+
+### Passo 2: Aplicar hardening (se nao --dry)
+
+> **Regra:** Fazer backup de cada ficheiro ANTES de alterar.
+
+#### 2.1 Desactivar XML-RPC
+
+```bash
+# Backup .htaccess
+cp ${WP_PATH}/.htaccess ${WP_PATH}/.htaccess.bak.$(date +%Y%m%d)
+
+# Adicionar bloqueio XML-RPC ao .htaccess (antes de # BEGIN WordPress)
+sed -i '/# BEGIN WordPress/i \
+# BEGIN Block XML-RPC\
+<Files xmlrpc.php>\
+  Require all denied\
+</Files>\
+# END Block XML-RPC\
+' ${WP_PATH}/.htaccess
+```
+
+**Excepcao:** Se o site usa JetPack ou aplicacao mobile WP, NAO desactivar XML-RPC. Verificar primeiro:
+```bash
+sudo -u ${WP_USER} wp plugin list --status=active --path=${WP_PATH} | grep -i "jetpack"
+```
+
+#### 2.2 Desactivar file editing (DISALLOW_FILE_EDIT)
+
+```bash
+# Backup wp-config.php
+cp ${WP_PATH}/wp-config.php ${WP_PATH}/wp-config.php.bak.$(date +%Y%m%d)
+
+# Adicionar se nao existir
+grep -q "DISALLOW_FILE_EDIT" ${WP_PATH}/wp-config.php || \
+  sed -i "/\/\* That's all, stop editing/i define('DISALLOW_FILE_EDIT', true);" ${WP_PATH}/wp-config.php
+```
+
+#### 2.3 Corrigir permissoes
+
+```bash
+# Directorios: 755
+find ${WP_PATH} -type d -exec chmod 755 {} \;
+
+# Ficheiros