WordPress Headless Shift Left Security

Headless WordPress Security

WordPress Headless Shift Left Security REST API WPGraphQL JWT CORS Rate Limiting SAST DAST SCA CI/CD WAF Next.js Nuxt.js

API Security Configuration

# === WordPress Headless API Security ===

# wp-config.php Security Headers
# // Disable XML-RPC (not needed for headless)
# define('XMLRPC_DISABLED', true);
#
# // Limit REST API to authenticated users for write operations
# add_filter('rest_authentication_errors', function($result) {
#     if (!is_user_logged_in() && $_SERVER['REQUEST_METHOD'] !== 'GET') {
#         return new WP_Error('rest_forbidden', 'Authentication required', ['status' => 401]);
#     }
#     return $result;
# });
#
# // Disable user enumeration via REST API
# add_filter('rest_endpoints', function($endpoints) {
#     if (isset($endpoints['/wp/v2/users'])) {
#         unset($endpoints['/wp/v2/users']);
#     }
#     return $endpoints;
# });
#
# // CORS Configuration
# add_action('rest_api_init', function() {
#     remove_filter('rest_pre_serve_request', 'rest_send_cors_headers');
#     add_filter('rest_pre_serve_request', function($value) {
#         header('Access-Control-Allow-Origin: https://frontend.example.com');
#         header('Access-Control-Allow-Methods: GET, OPTIONS');
#         header('Access-Control-Allow-Headers: Authorization, Content-Type');
#         return $value;
#     });
# });

from dataclasses import dataclass

@dataclass
class SecurityConfig:
    config: str
    purpose: str
    implementation: str
    impact: str

configs = [
    SecurityConfig("Disable XML-RPC",
        "ปิด XML-RPC ไม่จำเป็นสำหรับ Headless",
        "define('XMLRPC_DISABLED', true) หรือ Plugin",
        "ลด Attack Surface Brute Force Pingback DDoS"),
    SecurityConfig("REST API Auth",
        "บังคับ Auth สำหรับ Write Operations",
        "rest_authentication_errors filter",
        "ป้องกัน Unauthorized Data Modification"),
    SecurityConfig("Disable User Endpoint",
        "ปิด /wp/v2/users ป้องกัน User Enumeration",
        "rest_endpoints filter unset users",
        "ป้องกัน Attacker รู้ Username"),
    SecurityConfig("CORS Strict",
        "อนุญาตเฉพาะ Frontend Domain",
        "Access-Control-Allow-Origin: frontend.example.com",
        "ป้องกัน Cross-origin API Abuse"),
    SecurityConfig("Rate Limiting",
        "จำกัด Request ต่อ IP",
        "Nginx limit_req หรือ Plugin WP Rate Limit",
        "ป้องกัน DDoS API Scraping"),
    SecurityConfig("JWT Authentication",
        "ใช้ JWT แทน Cookie Auth สำหรับ API",
        "WP JWT Auth Plugin + Bearer Token",
        "Stateless Auth เหมาะกับ Headless"),
]

print("=== Security Configs ===")
for c in configs:
    print(f"  [{c.config}] {c.purpose}")
    print(f"    Impl: {c.implementation}")
    print(f"    Impact: {c.impact}")

CI/CD Security Pipeline

# === Shift Left Security Pipeline ===

@dataclass
class PipelineStage:
    stage: str
    tools: str
    checks: str
    gate: str

pipeline = [
    PipelineStage("1. Pre-commit",
        "GitLeaks + Husky",
        "Secret Detection: API Key Password Token ที่ Hardcode",
        "Block Commit ถ้ามี Secret"),
    PipelineStage("2. PR - SAST",
        "Semgrep + SonarQube",
        "Code Vulnerability, SQL Injection, XSS, SSRF Pattern",
        "Block Merge ถ้ามี Critical/High"),
    PipelineStage("3. PR - SCA",
        "WPScan + Snyk + npm audit",
        "WordPress Plugin/Theme CVE, npm Package Vulnerability",
        "Block Merge ถ้ามี Critical"),
    PipelineStage("4. Build - Image Scan",
        "Trivy + Grype",
        "Docker Image Vulnerability, OS Package CVE",
        "Block Deploy ถ้ามี Critical"),
    PipelineStage("5. Staging - DAST",
        "OWASP ZAP + Nuclei + WPScan",
        "API Endpoint Security, Headers, CORS, Auth Bypass",
        "Block Production Deploy ถ้ามี High+"),
    PipelineStage("6. Production - Monitor",
        "WAF + Uptime + Log Analysis",
        "API Abuse, Brute Force, Suspicious Activity",
        "Alert SOC + Auto-block IP"),
]

print("=== Security Pipeline ===")
for p in pipeline:
    print(f"\n  [{p.stage}]")
    print(f"    Tools: {p.tools}")
    print(f"    Checks: {p.checks}")
    print(f"    Gate: {p.gate}")

Production Hardening

# === WordPress Production Hardening ===

@dataclass
class HardeningRule:
    rule: str
    config: str
    risk_mitigated: str

hardening = [
    HardeningRule("Hide wp-admin",
        "ใช้ Plugin WPS Hide Login เปลี่ยน URL + IP Whitelist",
        "Brute Force Attack บน Login Page"),
    HardeningRule("MFA for Admin",
        "บังคับ Two-Factor Authentication ทุก Admin Account",
        "Credential Stuffing Account Takeover"),
    HardeningRule("Security Headers",
        "X-Content-Type-Options X-Frame-Options CSP HSTS",
        "XSS Clickjacking MIME Sniffing"),
    HardeningRule("File Permission",
        "wp-config.php 400, .htaccess 444, uploads 755",
        "File Modification Malware Upload"),
    HardeningRule("Database Prefix",
        "เปลี่ยน wp_ เป็น Custom Prefix",
        "SQL Injection ที่ Target Default Table Name"),
    HardeningRule("Auto Update",
        "เปิด Auto Update สำหรับ Core Minor + Plugin Security",
        "Known Vulnerability ที่มี Patch แล้ว"),
    HardeningRule("Backup Strategy",
        "Daily Backup Database + Files ไป Off-site Storage",
        "Data Loss Ransomware Accidental Delete"),
]

print("=== Hardening Rules ===")
for h in hardening:
    print(f"  [{h.rule}]")
    print(f"    Config: {h.config}")
    print(f"    Mitigates: {h.risk_mitigated}")

เคล็ดลับ

• API Only: เปิดเฉพาะ GET สำหรับ Public ปิด POST/PUT/DELETE
• WPScan: รัน WPScan ทุกสัปดาห์หา Plugin Vulnerability
• CORS: ตั้ง CORS เฉพาะ Frontend Domain ไม่ใช้ *
• MFA: บังคับ MFA ทุก Admin Account ไม่มีข้อยกเว้น
• Monitor: ดู API Access Log หา Suspicious Pattern

Headless WordPress คืออะไร

WordPress Backend CMS REST API WPGraphQL Frontend Next.js Nuxt.js Astro SSR SSG Performance Security ลด Attack Surface CDN Cache

สรุป

WordPress Headless Shift Left Security REST API JWT CORS Rate Limit SAST DAST SCA WPScan CI/CD WAF MFA Hardening Production Monitor