codeprosai

<p>WordPress does not support SVG uploads natively — and naive SVG plugins are a well-known attack surface. SVG files are XML documents that can carry XSS payloads, XXE attacks, external resource injection, and embedded HTML. <strong>CodePros SVG Secure Support</strong> adds safe, production-ready SVG uploads through a layered defense pipeline.</p>
<h4>Security Pipeline</h4>
<p>Every uploaded SVG passes through five sequential checks before it is accepted:</p>
<ol>
<li><strong>Extension check</strong> — Blocks double-extension filenames (e.g. <code>payload.php.svg</code>) and enforces <code>.svg</code> only.</li>
<li><strong>MIME check</strong> — Verifies actual file bytes return <code>image/svg+xml</code> via <code>finfo</code>; confirms <code><svg</code> or <code><?xml</code> is present in the header bytes.</li>
<li><strong>Size check</strong> — Rejects files exceeding the configured maximum (default 1 MB).</li>
<li><strong>Node-count check</strong> — Parses the XML and counts DOM nodes; rejects files above the threshold (default 5,000 nodes) to prevent node-flood DoS attacks.</li>
<li><strong>Dimension check</strong> — Reads the root <code><svg></code> width/height/viewBox; rejects unreasonably large declared dimensions (default 10,000 px).</li>
</ol>
<p>After validation, the file is sanitized:</p>
<ul>
<li>DOM sanitization via the battle-tested <strong>enshrined/svg-sanitize</strong> library with custom tag and attribute whitelists.</li>
<li>Remote reference stripping — all external URLs are removed.</li>
<li>Final string-level regex scan for <code>javascript:</code>, <code><script</code>, inline event handlers (<code>on*=</code>), and CSS <code>expression()</code> — any match causes the upload to be rejected entirely.</li>
</ul>
<h4>Security Headers</h4>
<p>When SVG attachment pages are served, the plugin adds:</p>
<ul>
<li><code>Content-Security-Policy</code> (configurable, secure default provided)</li>
<li><code>X-Content-Type-Options: nosniff</code></li>
<li><code>X-Frame-Options: SAMEORIGIN</code></li>
</ul>
<h4>Server-Level Hardening (Optional but Recommended)</h4>
<p>The plugin’s PHP layer covers every SVG upload that passes through WordPress. But if someone accesses an uploaded file directly — e.g. by visiting <code>https://example.com/wp-content/uploads/2024/01/logo.svg</code> — WordPress is bypassed entirely, so the PHP security headers are never sent.</p>
<p>The plugin ships two ready-to-use server configuration snippets to close that gap:</p>
<ul>
<li><strong><code>uploads-htaccess.txt</code></strong> — for Apache / LiteSpeed servers</li>
<li><strong><code>uploads-nginx.conf</code></strong> — for Nginx servers</li>
</ul>
<p>Each snippet does three things:</p>
<ol>
<li><strong>Blocks server-side script execution</strong> in <code>wp-content/uploads/</code> — if an attacker somehow uploads a <code>.php</code> file and tries to access it directly, the server returns 403 instead of executing it.</li>
<li><strong>Enforces the correct SVG MIME type</strong> (<code>image/svg+xml</code>) — some server setups serve SVGs as <code>text/plain</code>, which prevents browsers from honouring Content Security Policy rules scoped to that MIME type.</li>
<li><strong>Adds security headers on direct SVG requests</strong> — the same <code>X-Content-Type-Options</code>, <code>X-Frame-Options</code>, and <code>Content-Security-Policy</code> headers that the PHP layer adds on WordPress attachment pages, so direct file links are equally protected.</li>
</ol>
<p>Applying these snippets is the difference between WordPress-mediated access being protected and <em>all</em> access (direct URL, CDN pull, hotlink) being protected.</p>
<h4>Admin UI</h4>
<p>A tabbed settings page under <strong>Settings <span aria-hidden="true" class="wp-exclude-emoji">→</span> SVG Secure Support</strong> provides:</p>
<ul>
<li><strong>Settings tab</strong> — Configure allowed upload roles, file size/node/dimension limits, sanitization options, CSP header value, and logging preferences.</li>
<li><strong>Security Logs tab</strong> — Paginated, filterable log viewer showing every security event (blocked upload, removed tag/attribute, suspicious payload). Includes a log purge action.</li>
</ul>
<h4>Key Features</h4>
<ul>
<li>Role-based upload access — select one or more WordPress roles (default: Administrator) whose members may upload SVG files</li>
<li>Automatic upload-time sanitization — clean SVG replaces the original tmp file before WordPress moves it</li>
<li>Security event logging to the WordPress debug log and a dedicated database table</li>
<li>Configurable log retention with one-click purge</li>
<li>Bundled <code>.htaccess</code> and Nginx config snippets for the uploads directory</li>
</ul>


CodePros SVG Secure Support

Highly secure SVG upload support for WordPress. Validates, sanitizes, and protects SVG files through a multi-layer security pipeline.

Terry L.

<p>WP Shieldon is a WordPress security plugin based on <a href="https://github.com/terrylinooo/shieldon" rel="nofollow ugc">Shieldon</a> library, a Web Application Firewall (WAF) for PHP.</p>
<p>When users or robots try to view many of your web pages within a short period of time, they will be temporarily banned. They can get unbanned by solving a Captcha.</p>
<p>You can visit the plugin author – <a href="https://terryl.in" rel="nofollow ugc">Terry L.</a>‘s blog and try reloading the pages several times to see how this plugin works. You can also try Terry’s login page to find it protected. For more information about Shieldon, please visit <a href="https://shieldon.io/en/" rel="nofollow ugc">shieldon.io</a></p>
<p>Please note that there are three important things you must understand before using WP Shieldon:</p>
<ol>
<li>WP Shieldon is not for beginners.</li>
<li>Turn the <code>Trusted Bot</code> component on to allow search engine crawlers such as Google, Bing, Yahoo, and others to smoothly crawl your website.</li>
</ol>
<h3>Open Source Code</h3>
<p>Plugin:<br />
<a href="https://github.com/terrylinooo/wp-shieldon" rel="nofollow ugc">https://github.com/terrylinooo/wp-shieldon</a></p>
<p>Core library:<br />
<a href="https://github.com/terrylinooo/shieldon" rel="nofollow ugc">https://github.com/terrylinooo/shieldon</a></p>
<h3>Features</h3>
<ul>
<li>Realtime statistics – See who are browsing your website and their status.</li>
<li>Beautiful and detailed statistics and dashboard.</li>
<li>Block bad bots by default – Backlink crawlers, copyright crawlers and WayBack machine bot.</li>
<li>IP manager – Block signle IP or IP range as you want. (IPv6 supported)</li>
<li>Online session control – You can limit just how many visitors browsing your website. Good for webmasters whose blog is hosted on a share hosting.</li>
<li>SEO friendly – You can allow popular search engines such as Google, Bing, Yahoo and others, put them in the whitelist.</li>
<li>XML RPC, Login, Signup page protection.</li>
<li>Multiple data drivers – Redis, SQLite, File system, MySQL.</li>
<li>Multiple CAPTCHA modules – Google reCAPTCHA v2, v3 and Image CAPTCHA.</li>
<li>XSS Protection.</li>
<li>Page authentication.</li>
<li>Many others you can find by yourself.</li>
</ul>
<p>Check out my other WordPress works here:</p>
<ul>
<li><a href="https://wordpress.org/plugins/wp-githuber-md/" rel="ugc">Markdown Editor</a> – WP Githuber MD – an all in one Markdown editor.</li>
<li><a href="https://wordpress.org/plugins/cache-master/" rel="ugc">Cache Master</a> – WordPress cache plugin.</li>
<li><a href="https://wordpress.org/themes/mynote/" rel="ugc">Mynote Theme</a> – Theme for programmers.</li>
</ul>
<h3>Copyright</h3>
<p>WP Shieldon, Copyright 2019 TerryL.in<br />
WP Shieldon is distributed under the terms of the GNU GPL</p>
<p>This program is free software: you can redistribute it and/or modify<br />
it under the terms of the GNU General Public License as published by<br />
the Free Software Foundation, either version 3 of the License, or<br />
(at your option) any later version.</p>
<p>This program is distributed in the hope that it will be useful,<br />
but WITHOUT ANY WARRANTY; without even the implied warranty of<br />
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the<br />
GNU General Public License for more details.</p>


WP Shieldon – WordPress Firewall

WP Shieldon is a WordPress security plugin based on Shieldon library, a Web Application Firewall (WAF) for PHP.

CodePros SVG Secure Support vs WP Shieldon – WordPress Firewall