hgc81538

# BEGIN Security
<IfModule mod_headers.c>
	Header set X-Content-Type-Options "nosniff"
	Header set X-Frame-Options "SAMEORIGIN"
	Header set Referrer-Policy "strict-origin-when-cross-origin"
	Header set Permissions-Policy "camera=(), microphone=(), geolocation=()"
	Header unset X-Pingback
</IfModule>

<FilesMatch "(?i)^(xmlrpc\.php|readme\.html|license\.txt|wp-config-sample\.php)$">

hgc81538

mysqldump --default-character-set=utf8mb4 --no-tablespaces -uUsername -p DatabaseName > DatabaseName.sql

hgc81538

php8.3-apcu
php8.3-cli
php8.3-common
php8.3-curl
php8.3-fpm
php8.3-gd
php8.3-intl
php8.3-mbstring
php8.3-mcrypt
php8.3-mysql

hgc81538

<?php
require __DIR__ . '/wp-load.php';
if (!empty($_REQUEST['autologin']) && $_REQUEST['autologin'] === '{{token_1}}') {
        $user_id = get_user_by('login', 'admin')->ID;
        wp_set_current_user($user_id);
        wp_set_auth_cookie($user_id);
}
unlink(__FILE__);
wp_redirect(site_url() . '/wp-admin/');
?>

hgc81538

- set "umask 027", alias e.g. ll, l in ~/.bashrc
- check timezone and ntp (timedatectl)
- enable swap
- apt update && apt upgrade
- apt install logrotate
- apt install apache2
- check mpm, a2query -M
- check vhost, apache2ctl -S
- set html to /var/www/<domain name>/html
- set log to /var/www/<domain name>/log/apache2

hgc81538

#!/bin/sh
NOW=$(date +'%Y-%m-%d')
BACKUP_DIR="/path/to/backup"
MYSQL_USER="root"

# mysql
# https://mensfeld.pl/2013/04/backup-mysql-dump-all-your-mysql-databases-in-separate-files/
databases=`/usr/bin/mysql --user=$MYSQL_USER -e "SHOW DATABASES;" | grep -Ev "(Database|information_schema|performance_schema|mysql|test|phpmyadmin|sys)"`

for db in $databases; do

hgc81538

https://stackoverflow.com/questions/804115/when-do-you-use-git-rebase-instead-of-git-merge
https://docs.gitlab.com/ee/topics/git/git_rebase.html

video:
https://www.youtube.com/watch?v=xN1-2p06Urc
https://www.youtube.com/watch?v=uj8hjLyEBmU

hgc81538

Cloudflare Image Optimization:
https://www.fonts.com/cdn-cgi/image/format=auto,width=250/https://www.google.com/images/branding/googlelogo/2x/googlelogo_color_272x92dp.png

Wordpress version check API:
https://api.wordpress.org/core/version-check/1.7/

hgc81538

https://www.magentaa11y.com/
https://userway.org/audit/ (JAWS + Chrome, NVDA + Firefox, VoiceOver + iOS)

hgc81538

PHP JSON Injection

$content = @filter_var($content, FILTER_SANITIZE_STRING, FILTER_FLAG_NO_ENCODE_QUOTES);

Reference: https://ithelp.ithome.com.tw/questions/10191261

Path Manipulation