#DDOS dan Malware Protection 
#Posisi ke 3
#Melindungi file sensitif Wordpress dari ancaman exploitasi dan serangan brute force
#Action: Block
#Tambahkan Whitelist folder Plugin setelah baris - (http.request.uri.path contains "/wp-content/plugins/")
#Tidak Mendukung format expression builder (gunakan expression editor kemudian tempel kode)
/------/

(
  (
    http.request.uri.path contains ".php" 
    and not starts_with(http.request.uri.path, "/wp-admin/") 
    and not http.request.uri.path in {"/wp-login.php" "/wp-admin/admin-ajax.php" "/wp-cron.php" "/wp-comments-post.php" "/wp-admin/admin-post.php" "/wp-links-opml.php" "/index.php" "/xmlrpc.php"} 
    and not http.request.uri.path contains "/wp-content/plugins/"
    and not http.request.uri.path contains "graphql"
    and not http.request.uri.query contains "s="
  ) or
  (
    http.request.uri.path contains "/wp-includes/" 
    and not http.request.uri.path in {"/wp-includes/js/comment-reply.min.js" "/wp-includes/js/wp-emoji-release.min.js"}
  ) or
  (
    http.request.uri.path contains "/wp-content/plugins/" 
    and not http.request.uri.path contains "/seriously-simple-podcasting/" 
    and not http.request.uri.path contains "/accelerated-mobile-pages/"
    and not http.request.uri.path contains "/custom-anim-bundle/"
    and not http.request.uri.path contains "/insert-headers-and-footers/"
    and not http.request.uri.path contains "/wp-code-light/"
and not http.request.uri.path contains "/audioigniter/"
and not http.request.uri.path contains "/jquery/"
  ) or
  (
    http.request.uri.path contains "/wp-admin/" 
    and not http.request.uri.path contains "admin-ajax.php"
  ) or
  http.request.uri.path contains "/temp/" or
  http.request.uri.path contains "/ckeditor/" or
  http.request.uri.path in {"/Chitoge.php" "/update/f35.php"} or
  (
    http.request.uri.path contains "/.well-known/" 
    and not http.request.uri.path contains "/acme-challenge/" 
    and not http.request.uri.path contains "/pki-validation/"
  ) or
  (
    http.request.uri.query contains "C=N" 
    and not http.request.uri.query contains "s="
  ) or
  (
    len(http.request.uri.path) eq 5 
    and not http.request.uri.path contains "." 
    and not lower(http.request.uri.path) contains "/amp" 
    and not cf.client.bot
  ) or
  lower(http.request.uri.path) contains "/alfa_data" or
  lower(http.request.uri.path) contains "/brutalshell" or
  lower(http.request.uri.path) contains ".env" or
  lower(http.request.uri.path) contains "wp-config" or
  lower(http.request.uri.path) contains "phpinfo"
) 
and not http.cookie contains "wordpress_logged_in_"