Background
Today we will learn to Improving WordPress Security. A few days ago, one of our client’s websites got hacked. They changed the main page to show gambling site. We looked closely at the website’s files and found some backdoors that the attackers put there. These hidden doors let them get into the website whenever they want.
Table of Contents
When we looked at the code of these hidden doors, we saw eval() function. This function is dangerous because it can run any code the attacker wants.
Disabled Function
I remember clearly that I had already put the eval() function into the disabled_functions list in the configuration.
But that eval function could still be run.
Eval isn’t a function
After that, I found an answer that said eval is actually a language construct, not a function. This means it’s a built-in part of PHP itself, like include and require. Because of this, the disabled_functions setting doesn’t affect eval.This makes sense.
How do we disabled this eval ?
Then I thought about how we could disabled this eval. After searching and looking around for alternatives to disabled_functions, I found a security extension for PHP called Snuffleupagus. Here are the rules to disable the eval function using Snuffleupagus:
sp.disable_function.function(eval).drop()Saved on /etc/php/7.4/fpm/default.rules
Then we applied to FPM Config, so it’s look like this
php_admin_value[sp.configuration_file] = /etc/php/7.4/fpm/rules/default.rulesResults
Here is the comparison
Without Snuffleupagus
With Snuffleupagus
As you can see, Snuffleupagus can block that eval function, which disabled_function in the config can’t do. There are many more useful features that can strengthen the security of your PHP code.
Conclusion
So that’s how to Improving WordPress Security, We’ve seen how Snuffleupagus can make PHP code safer. It can block dangerous functions like eval that normal PHP settings can’t.If you’re running PHP websites or apps, it’s worth looking into Snuffleupagus. Check out their documentation to learn more about what it can do.
Remember, good security means always looking for better ways to protect your application.
By using tools like Snuffleupagus, you can make your PHP Project much harder for attackers to break into. It’s an extra step that can make a big difference in keeping your sites and data safe.
