---
name: wp-hardening
description: Aplicar hardening de seguranca standard a sites WordPress via SSH. Desactiva XML-RPC, file editing, directory listing, esconde versao WP, verifica permissoes e security headers.
layer: wiki
---

# /wp-hardening - Hardening WordPress

Aplica medidas de hardening standard a sites WordPress no servidor CWP (176.9.3.158).

> **Nota:** Esta skill APLICA alteracoes. Para auditar sem alterar, usar `/security-check`.

## Contexto NotebookLM

ANTES de executar, consultar notebook para contexto:

| Notebook | ID | Consultar quando |
|----------|-----|-----------------|
| WordPress e Elementor | 5be0d1a6 | Sempre |

```
mcp__notebooklm__notebook_query({
  notebook_id: "5be0d1a6-00f2-4cd9-b835-978cb7721601",
  query: "wordpress security hardening best practices"
})
```

---

## Uso

```
/wp-hardening descomplicar.pt
/wp-hardening all                    # todos os 16 sites
/wp-hardening descomplicar.pt --dry  # apenas verificar, sem aplicar
```

**Argumento:** dominio do site (ver tabela de sites em /wp-update) ou `all`.
**Flag `--dry`:** apenas verifica estado actual sem aplicar alteracoes.

---

## Sites WordPress no servidor

| Conta | Site | Path |
|-------|------|------|
| carstuff | carstuff.pt | /home/carstuff/public_html |
| ealmeida | descomplicar.pt | /home/ealmeida/public_html |
| ealmeida | emanuelalmeida.pt | /home/ealmeida/emanuelalmeida.pt |
| ealmeida | ecommerce.descomplicar.pt | /home/ealmeida/ecommerce.descomplicar.pt |
| ealmeida | ecommerce-demo.descomplicar.pt | /home/ealmeida/ecommerce-demo.descomplicar.pt |
| ealmeida | starter.descomplicar.pt | /home/ealmeida/starter.descomplicar.pt |
| ealmeida | care.descomplicar.pt | /home/ealmeida/care.descomplicar.pt |
| ealmeida | e-commerce.descomplicar.pt | /home/ealmeida/e-commerce.descomplicar.pt |
| espiral | espiralsenior.pt | /home/espiral/public_html |
| espiral | dev.espiralsenior.pt | /home/espiral/dev.espiralsenior.pt |
| familycl | familyclinic.pt | /home/familycl/public_html |
| ignition | ignitionvortex.pt | /home/ignition/public_html |
| karate | karateclubedegaia.com | /home/karate/karateclubedegaia.com |
| sintri | sintricare.com.pt | /home/sintri/public_html |
| solarfv | solarfvengenharia.com | /home/solarfv/public_html |
| wtc | watercontrol.pt | /home/wtc/public_html |

---

## Execucao

### Passo 0: Identificar site e path

Mapear o dominio fornecido para o path e conta do servidor usando a tabela acima.

```bash
SITE="dominio.pt"
WP_PATH="/home/USER/public_html"
WP_USER="user"
```

### Passo 1: Verificar estado actual (antes)

Executar via `mcp__ssh-unified__ssh_execute` no servidor `cwp`:

```bash
# 1. XML-RPC activo?
curl -s -o /dev/null -w "%{http_code}" -X POST "${SITE}/xmlrpc.php" -d '<?xml version="1.0"?><methodCall><methodName>system.listMethods</methodName></methodCall>'

# 2. DISALLOW_FILE_EDIT definido?
grep -c "DISALLOW_FILE_EDIT" ${WP_PATH}/wp-config.php

# 3. Permissoes directórios (esperado: 755)
find ${WP_PATH} -type d -not -perm 755 | head -10

# 4. Permissoes ficheiros (esperado: 644)
find ${WP_PATH} -type f -not -perm 644 -not -name "wp-config.php" | head -10

# 5. Versao WP exposta no HTML?
curl -s ${SITE} | grep -o 'content="WordPress [0-9.]*"' | head -1

# 6. Versao WP exposta no feed?
curl -s ${SITE}/feed/ | grep -o '<generator>.*</generator>' | head -1

# 7. Directory listing activo?
curl -s -o /dev/null -w "%{http_code}" ${SITE}/wp-content/uploads/

# 8. wp-config.php permissoes (esperado: 400 ou 440)
stat -c "%a" ${WP_PATH}/wp-config.php

# 9. .htaccess security headers?
grep -c "X-Frame-Options\|X-Content-Type-Options\|X-XSS-Protection\|Referrer-Policy\|Content-Security-Policy\|Strict-Transport-Security" ${WP_PATH}/.htaccess 2>/dev/null

# 10. debug.log exposto?
test -f ${WP_PATH}/wp-content/debug.log && echo "EXPOSTO" || echo "OK"
```

Registar cada resultado como ANTES.

### Passo 2: Aplicar hardening (se nao --dry)

> **Regra:** Fazer backup de cada ficheiro ANTES de alterar.

#### 2.1 Desactivar XML-RPC

```bash
# Backup .htaccess
cp ${WP_PATH}/.htaccess ${WP_PATH}/.htaccess.bak.$(date +%Y%m%d)

# Adicionar bloqueio XML-RPC ao .htaccess (antes de # BEGIN WordPress)
sed -i '/# BEGIN WordPress/i \
# BEGIN Block XML-RPC\
<Files xmlrpc.php>\
  Require all denied\
</Files>\
# END Block XML-RPC\
' ${WP_PATH}/.htaccess
```

**Excepcao:** Se o site usa JetPack ou aplicacao mobile WP, NAO desactivar XML-RPC. Verificar primeiro:
```bash
sudo -u ${WP_USER} wp plugin list --status=active --path=${WP_PATH} | grep -i "jetpack"
```

#### 2.2 Desactivar file editing (DISALLOW_FILE_EDIT)

```bash
# Backup wp-config.php
cp ${WP_PATH}/wp-config.php ${WP_PATH}/wp-config.php.bak.$(date +%Y%m%d)

# Adicionar se nao existir
grep -q "DISALLOW_FILE_EDIT" ${WP_PATH}/wp-config.php || \
  sed -i "/\/\* That's all, stop editing/i define('DISALLOW_FILE_EDIT', true);" ${WP_PATH}/wp-config.php
```

#### 2.3 Corrigir permissoes

```bash
# Directorios: 755
find ${WP_PATH} -type d -exec chmod 755 {} \;

# Ficheiros