已配置IP白名单后，需排查的wp-admin登录页面后门访问途径有哪些？

Great job locking down wp-admin with IP whitelisting in .htaccess—that’s a strong foundational defense! Let’s walk through the key backdoor vectors you should investigate to harden your setup even more:

• Custom Login Endpoints
  Many themes and plugins override the default login URL with custom paths like /login, /admin-login, or theme-specific routes. These bypass your .htaccess rules for wp-admin. Check your theme’s functions.php for uses of the login_url filter, scan plugin code for custom login routes, and test common custom login paths to see if they’re accessible to non-whitelisted IPs.

• XML-RPC Interface
  The xmlrpc.php file is a classic attack vector—attackers can use it to attempt brute-force logins even if wp-admin is blocked. You’ll want to restrict access to this file via .htaccess (allow only your whitelisted IPs), disable it entirely with a plugin, or scan your server logs for repeated requests to xmlrpc.php.

• REST API Vulnerabilities
  Certain REST API endpoints can expose user data (like /wp-json/wp/v2/users) or enable token-based login (e.g., JWT plugin endpoints like /wp-json/jwt-auth/v1/token), letting attackers bypass the wp-admin login page. Audit installed plugins for REST API integrations, restrict unauthenticated access to sensitive API paths, or add .htaccess rules to block these endpoints for non-whitelisted IPs.

• Malicious Theme/Plugin Backdoors
  Compromised themes or plugins often leave hidden PHP files (e.g., admin-backdoor.php, secret-update.php) in wp-content/themes/ or wp-content/plugins/ directories. These files can provide direct admin access or privilege escalation. Use Sucuri’s scanning tools to check for malicious code, and manually audit these directories for unfamiliar files.

• Server-Level Entry Points
  Attackers might exploit server misconfigurations to bypass .htaccess—for example, using scripts in cgi-bin/, or leveraging file upload vulnerabilities to place backdoor scripts elsewhere on the server. Review your server’s access and error logs for unusual request paths, and ensure directory permissions are locked down (avoid 777 permissions for wp-content and subdirectories).

• Cookie-Based Session Hijacking
  While not a traditional backdoor, stolen wordpress_logged_in_* cookies let attackers access wp-admin without logging in. Mitigate this by enforcing HTTPS for admin access and securing cookies:

  // Add to wp-config.php
  define('FORCE_SSL_ADMIN', true);
  define('COOKIE_SECURE', true);
  define('COOKIE_HTTPONLY', true);
  

• Database-Level Tampering
  Attackers may add rogue admin accounts to the wp_users table or modify existing users’ permissions in wp_usermeta (via the wp_capabilities field). Periodically audit these database tables to ensure no unauthorized users or privilege changes exist.

Combining these checks with Sucuri’s monitoring and log analysis will help you stay ahead of potential threats.

内容的提问来源于stack exchange，提问作者gateauboeuf