how to block these php code using mod_security

[kevinchong]

Hello,

I have problem to create mod_security rules. I want to block people from upload or access these php codes in my server.

- Removed -

Can anyone help me?

 

[cPanelMichael]

Hello

You can find some rule-sets discussed on the following thread:

Mod_Security Rules

Thank you.

 

[quizknows]

ModSecurity cannot block requests based on the content of the file that is being requested unless you use response body filtering.

The main thing is to prevent compromise in the first place with a good rule set and your users keeping their CMS software updated. I know compromises will always happen some percentage of the time especially if you host a lot of sites, but trying to prevent access to the php shells after the fact is kind of a moot point; you need to determine the method of hack (bad/weak/compromised password, old vulnerable plugin, etc), then restore a known good backup, and patch the initial issue (update it, new passwords, etc.).