Update Nginx config

etc/nginx/includes/rules_security.conf

@@ -2,113 +2,145 @@
 # Designed to be included in any server{} block.
 
 # Add Security Headers.
-add_header X-Content-Type-Options "nosniff" always;
 add_header X-Frame-Options "SAMEORIGIN" always;
+add_header X-Content-Type-Options "nosniff" always;
 add_header X-XSS-Protection "1; mode=block" always;
 
-# Limit request
+# Limit request.
 limit_req_status 444;
 
 if ($args ~ CtrlFunc_*) { return 444; }
 
 set $my_var 0;
 set $the_var 2;
+
 if ($request_method = POST) { set $my_var 1; }
 if ($args = /) { set $the_var 1; }
 if ($my_var = $the_var) { return 444; }
 
-## Block Injections attacks
-# Ref: http://www.howtoforge.com/nginx-how-to-block-exploits-sql-injections-file-injections-spam-user-agents-etc
-
 # Block SQL injections.
 set $block_sql_injections 0;
+
 if ($query_string ~* "union.*select.*\(") {
 	set $block_sql_injections 1;
 }
+
 if ($query_string ~* "union.*all.*select.*") {
 	set $block_sql_injections 1;
 }
+
 if ($query_string ~* "concat.*\(") {
 	set $block_sql_injections 1;
 }
+
 if ($block_sql_injections = 1) {
 	return 403;
 }
 
 # Block file injections.
 set $block_file_injections 0;
+
 if ($query_string ~ "[a-zA-Z0-9_]=http://") {
 	set $block_file_injections 1;
 }
+
 if ($query_string ~ "[a-zA-Z0-9_]=(\.\.//?)+") {
 	set $block_file_injections 1;
 }
+
 if ($query_string ~ "[a-zA-Z0-9_]=/([a-z0-9_.]//?)+") {
 	set $block_file_injections 1;
 }
+
 if ($block_file_injections = 1) {
 	return 403;
 }
 
 # Block common exploits.
 set $block_common_exploits 0;
+
 if ($query_string ~ "(<|%3C).*script.*(>|%3E)") {
 	set $block_common_exploits 1;
 }
+
 if ($query_string ~ "GLOBALS(=|\[|\%[0-9A-Z]{0,2})") {
 	set $block_common_exploits 1;
 }
+
 if ($query_string ~ "_REQUEST(=|\[|\%[0-9A-Z]{0,2})") {
 	set $block_common_exploits 1;
 }
+
 if ($query_string ~ "proc/self/environ") {
 	set $block_common_exploits 1;
 }
+
 if ($query_string ~ "mosConfig_[a-zA-Z_]{1,21}(=|\%3D)") {
 	set $block_common_exploits 1;
 }
+
 if ($query_string ~ "base64_(en|de)code\(.*\)") {
 	set $block_common_exploits 1;
 }
+
 if ($block_common_exploits = 1) {
 	return 403;
 }
 
 # Block spammy comment.
 set $block_spam 0;
+
 if ($query_string ~* "\b(ultram|unicauca|valium|viagra|vicodin|xanax|ypxaieo)\b") {
 	set $block_spam 1;
 }
+
 if ($query_string ~* "\b(condom|erections|hoodia|huronriveracres|impotence|levitra|libido)\b") {
 	set $block_spam 1;
 }
+
 if ($query_string ~* "\b(ambien|blue\spill|cialis|cocaine|ejaculation|erectile)\b") {
 	set $block_spam 1;
 }
+
 if ($query_string ~* "\b(lipitor|phentermin|pro[sz]ac|sandyauer|tramadol|troyhamby)\b") {
 	set $block_spam 1;
 }
-if ($query_string ~* "\b(kontol|peli|kimpet|kimcil|bispak|bisyar|memek|pecun|ngentot|bokep|judi|togel|bet)\b") {
+
+if ($query_string ~* "\b(kontol|peli|kimpet|kimcil|bispak|bisyar|memek|pecun|ngentot|bokep)\b") {
 	set $block_spam 1;
 }
+
+if ($query_string ~* "\b(judi|judol|togel|bet)\b") {
+	set $block_spam 1;
+}
+
 if ($block_spam = 1) {
 	return 403;
 }
 
 ## Block suspicious user agents.
 set $block_user_agents 0;
+
 # Don't disable wget if you need it to run cron jobs!
 #if ($http_user_agent ~ "Wget") {
 #	set $block_user_agents 1;
 #}
+
 # Disable Akeeba Remote Control 2.5 and earlier.
 if ($http_user_agent ~* "Indy Library") {
 	set $block_user_agents 1;
 }
+
 # Common bandwidth hoggers and hacking tools.
 if ($http_user_agent ~* "(libwww-perl|GetRight|GetWeb!|Go!Zilla|Download Demon|Go-Ahead-Got-It|TurnitinBot|GrabNet)") {
 	set $block_user_agents 1;
 }
+
+# Known Bot AI (ai.robots.txt).
+if ($http_user_agent ~* "(AI2Bot|Ai2Bot-Dolma|Amazonbot|anthropic-ai|Applebot|Applebot-Extended|Bytespider|CCBot|ChatGPT-User|Claude-Web|ClaudeBot|cohere-ai|Diffbot|FacebookBot|facebookexternalhit|FriendlyCrawler|Google-Extended|GoogleOther|GoogleOther-Image|GoogleOther-Video|GPTBot|iaskspider/2.0|ICC-Crawler|ImagesiftBot|img2dataset|ISSCyberRiskCrawler|Kangaroo Bot|Meta-ExternalAgent|Meta-ExternalFetcher|OAI-SearchBot|omgili|omgilibot|PerplexityBot|PetalBot|Scrapy|Sidetrade indexer bot|Timpibot|VelenPublicWebCrawler|Webzio-Extended|YouBot)") {
+	set $block_user_agents 1;
+}
+
 if ($block_user_agents = 1) {
 	return 403;
 }