sec(core): implementasi modul security headers, cloaking versi wp, sanitasi ketat settings api, dan direct access guard

2026-09-16 00:37:59 +07:00
parent ada95fdea3
commit 0f4a8511ca
16 changed files with 163 additions and 34 deletions
@@ -0,0 +1,73 @@
+<?php
+/**
+ * Modul Pengamanan Native Tema EduKarsa
+ * Mencegah XSS, SQLi, Clickjacking, User Harvesting, dan Information Leakage
+ */
+
+defined( 'ABSPATH' ) || exit;
+
+// 1. INJEKSI NATIVE HTTP SECURITY HEADERS
+function edukarsa_security_headers() {
+    if ( ! is_admin() ) {
+        header( 'X-Content-Type-Options: nosniff' );
+        header( 'X-Frame-Options: SAMEORIGIN' );
+        header( 'X-XSS-Protection: 1; mode=block' );
+        header( 'Referrer-Policy: strict-origin-when-cross-origin' );
+    }
+}
+add_action( 'send_headers', 'edukarsa_security_headers' );
+
+// 2. INFORMATION DISCLOSURE CLOAKING (SEMBUNYIKAN GENERATOR VERSI CMS)
+function edukarsa_clean_header_fingerprints() {
+    remove_action( 'wp_head', 'wp_generator' );
+    remove_action( 'wp_head', 'wlwmanifest_link' );
+    remove_action( 'wp_head', 'rsd_link' );
+    remove_action( 'wp_head', 'wp_shortlink_wp_head' );
+    remove_action( 'wp_head', 'adjacent_posts_rel_link_wp_head', 10 );
+}
+add_action( 'init', 'edukarsa_clean_header_fingerprints' );
+
+// Hapus query string versi WordPress dari aset agar tidak terbaca bot scanner
+function edukarsa_hide_wp_version_from_assets( $src ) {
+    global $wp_version;
+    parse_str( (string) wp_parse_url( $src, PHP_URL_QUERY ), $query );
+    if ( ! empty( $query['ver'] ) && $query['ver'] === $wp_version ) {
+        $src = remove_query_arg( 'ver', $src );
+    }
+    return $src;
+}
+add_filter( 'style_loader_src', 'edukarsa_hide_wp_version_from_assets', 9999 );
+add_filter( 'script_loader_src', 'edukarsa_hide_wp_version_from_assets', 9999 );
+
+// 3. BLOKIR PROBING USERNAME / ENUMERASI AUTHOR (?author=N)
+function edukarsa_block_author_enumeration() {
+    if ( ! is_admin() && isset( $_REQUEST['author'] ) ) {
+        wp_safe_redirect( home_url( '/' ), 301 );
+        exit;
+    }
+}
+add_action( 'template_redirect', 'edukarsa_block_author_enumeration' );
+
+// 4. BATASI ENDPOINT REST API USERS BAGI PENGUNJUNG TANPA OTENTIKASI
+function edukarsa_restrict_rest_users_endpoint( $endpoints ) {
+    if ( ! is_user_logged_in() ) {
+        if ( isset( $endpoints['/wp/v2/users'] ) ) {
+            unset( $endpoints['/wp/v2/users'] );
+        }
+        if ( isset( $endpoints['/wp/v2/users/(?P<id>[\d]+)'] ) ) {
+            unset( $endpoints['/wp/v2/users/(?P<id>[\d]+)'] );
+        }
+    }
+    return $endpoints;
+}
+add_filter( 'rest_endpoints', 'edukarsa_restrict_rest_users_endpoint' );
+
+// 5. SANITASI INPUT PENCARIAN (ANTI-REFLECTED XSS)
+function edukarsa_sanitize_search_query( $query ) {
+    if ( ! is_admin() && $query->is_main_query() && $query->is_search() ) {
+        $s = $query->get( 's' );
+        $query->set( 's', sanitize_text_field( $s ) );
+    }
+    return $query;
+}
+add_action( 'pre_get_posts', 'edukarsa_sanitize_search_query' );