claude-plugins/wordpress/skills/wp-hardening/SKILL.md

name, description, layer

name	description	layer
wp-hardening	Aplicar hardening de seguranca standard a sites WordPress via SSH. Desactiva XML-RPC, file editing, directory listing, esconde versao WP, verifica permissoes e security headers.	wiki

/wp-hardening - Hardening WordPress

Aplica medidas de hardening standard a sites WordPress no servidor CWP (176.9.3.158).

Nota: Esta skill APLICA alteracoes. Para auditar sem alterar, usar /security-check.

Contexto NotebookLM

ANTES de executar, consultar notebook para contexto:

Notebook	ID	Consultar quando
WordPress e Elementor	5be0d1a6	Sempre

mcp__notebooklm__notebook_query({
  notebook_id: "5be0d1a6-00f2-4cd9-b835-978cb7721601",
  query: "wordpress security hardening best practices"
})

---

Uso

/wp-hardening descomplicar.pt
/wp-hardening all                    # todos os 16 sites
/wp-hardening descomplicar.pt --dry  # apenas verificar, sem aplicar

Argumento: dominio do site (ver tabela de sites em /wp-update) ou all. Flag --dry: apenas verifica estado actual sem aplicar alteracoes.

---

Sites WordPress no servidor

Conta	Site	Path
carstuff	carstuff.pt	/home/carstuff/public_html
ealmeida	descomplicar.pt	/home/ealmeida/public_html
ealmeida	emanuelalmeida.pt	/home/ealmeida/emanuelalmeida.pt
ealmeida	ecommerce.descomplicar.pt	/home/ealmeida/ecommerce.descomplicar.pt
ealmeida	ecommerce-demo.descomplicar.pt	/home/ealmeida/ecommerce-demo.descomplicar.pt
ealmeida	starter.descomplicar.pt	/home/ealmeida/starter.descomplicar.pt
ealmeida	care.descomplicar.pt	/home/ealmeida/care.descomplicar.pt
ealmeida	e-commerce.descomplicar.pt	/home/ealmeida/e-commerce.descomplicar.pt
espiral	espiralsenior.pt	/home/espiral/public_html
espiral	dev.espiralsenior.pt	/home/espiral/dev.espiralsenior.pt
familycl	familyclinic.pt	/home/familycl/public_html
ignition	ignitionvortex.pt	/home/ignition/public_html
karate	karateclubedegaia.com	/home/karate/karateclubedegaia.com
sintri	sintricare.com.pt	/home/sintri/public_html
solarfv	solarfvengenharia.com	/home/solarfv/public_html
wtc	watercontrol.pt	/home/wtc/public_html

---

Execucao

Passo 0: Identificar site e path

Mapear o dominio fornecido para o path e conta do servidor usando a tabela acima.

SITE="dominio.pt"
WP_PATH="/home/USER/public_html"
WP_USER="user"

Passo 1: Verificar estado actual (antes)

Executar via mcp__ssh-unified__ssh_execute no servidor cwp:

# 1. XML-RPC activo?
curl -s -o /dev/null -w "%{http_code}" -X POST "${SITE}/xmlrpc.php" -d '<?xml version="1.0"?><methodCall><methodName>system.listMethods</methodName></methodCall>'

# 2. DISALLOW_FILE_EDIT definido?
grep -c "DISALLOW_FILE_EDIT" ${WP_PATH}/wp-config.php

# 3. Permissoes directórios (esperado: 755)
find ${WP_PATH} -type d -not -perm 755 | head -10

# 4. Permissoes ficheiros (esperado: 644)
find ${WP_PATH} -type f -not -perm 644 -not -name "wp-config.php" | head -10

# 5. Versao WP exposta no HTML?
curl -s ${SITE} | grep -o 'content="WordPress [0-9.]*"' | head -1

# 6. Versao WP exposta no feed?
curl -s ${SITE}/feed/ | grep -o '<generator>.*</generator>' | head -1

# 7. Directory listing activo?
curl -s -o /dev/null -w "%{http_code}" ${SITE}/wp-content/uploads/

# 8. wp-config.php permissoes (esperado: 400 ou 440)
stat -c "%a" ${WP_PATH}/wp-config.php

# 9. .htaccess security headers?
grep -c "X-Frame-Options\|X-Content-Type-Options\|X-XSS-Protection\|Referrer-Policy\|Content-Security-Policy\|Strict-Transport-Security" ${WP_PATH}/.htaccess 2>/dev/null

# 10. debug.log exposto?
test -f ${WP_PATH}/wp-content/debug.log && echo "EXPOSTO" || echo "OK"

Registar cada resultado como ANTES.

Passo 2: Aplicar hardening (se nao --dry)

Regra: Fazer backup de cada ficheiro ANTES de alterar.

2.1 Desactivar XML-RPC

# Backup .htaccess
cp ${WP_PATH}/.htaccess ${WP_PATH}/.htaccess.bak.$(date +%Y%m%d)

# Adicionar bloqueio XML-RPC ao .htaccess (antes de # BEGIN WordPress)
sed -i '/# BEGIN WordPress/i \
# BEGIN Block XML-RPC\
<Files xmlrpc.php>\
  Require all denied\
</Files>\
# END Block XML-RPC\
' ${WP_PATH}/.htaccess

Excepcao: Se o site usa JetPack ou aplicacao mobile WP, NAO desactivar XML-RPC. Verificar primeiro:

sudo -u ${WP_USER} wp plugin list --status=active --path=${WP_PATH} | grep -i "jetpack"

2.2 Desactivar file editing (DISALLOW_FILE_EDIT)

# Backup wp-config.php
cp ${WP_PATH}/wp-config.php ${WP_PATH}/wp-config.php.bak.$(date +%Y%m%d)

# Adicionar se nao existir
grep -q "DISALLOW_FILE_EDIT" ${WP_PATH}/wp-config.php || \
  sed -i "/\/\* That's all, stop editing/i define('DISALLOW_FILE_EDIT', true);" ${WP_PATH}/wp-config.php

2.3 Corrigir permissoes

# Directorios: 755
find ${WP_PATH} -type d -exec chmod 755 {} \;

# Ficheiros