Protect Application on Cloud Server With NAXSI

NAXSI is the final step for Nginx setup to protect from XSS and SQL injections. Here is basics to protect application on Cloud Server with Naxsi. You must have noticed that we have avoided Naxsi rules on basic guides on installation of WordPress on Nginx or more advanced guide to tweak nginx.conf.

Protect Application on Cloud Server With NAXSI

There are two commented out lines on /etc/nginx/sites-available/default :

Before making these lines active, you must have Nginx–Naxsi compiled, otherwise naxsi.rules will not work.

NAXSI can check and block GET, POST, HTTP headers and POST-request body by rules. NAXSI core rules are simple, but needs a bit learning. They block dangerous symbols, SQL related keywords and allows whitelist approach configuration creating a web application baseline. Obviously, if you uncomment include /etc/nginx/naxsi.rules and save the file and run nginx -t; if it returns error. Quite nicely written guide can be found on the official Wiki :

Protect Application on Cloud Server With NAXSI : With WordPress

WordPress-NAXSI is quite difficult setup and configuration varies from version to version. This is an example set of rules for WordPress 3.5 :

The context is /etc/nginx/naxsi_core.rules. We can not provide you the result, but you should first run the command netstat -antup and save it as a text file for reference before starting working on WordPress-NAXSI. Basic rule for web app goes like this :