{"id":1957,"date":"2026-05-14T13:25:36","date_gmt":"2026-05-14T05:25:36","guid":{"rendered":"https:\/\/zaf.web.id\/blog\/?p=1957"},"modified":"2026-11-14T21:43:06","modified_gmt":"2026-11-14T13:43:06","slug":"rekomendasi-keamanan-upload-dir-pada-aplikasi-web","status":"publish","type":"post","link":"https:\/\/zaf.web.id\/blog\/rekomendasi-keamanan-upload-dir-pada-aplikasi-web\/","title":{"rendered":"Rekomendasi Keamanan Upload Dir pada Aplikasi Web"},"content":{"rendered":"<p>Tidak sedikit serangan yang terjadi terhadap website yang mengincar <strong>File Upload Vulnerabilities<\/strong>, khususnya website yang berbasis engine populer seperti WordPress. Polanya hampir selalu sama: penyerang menemukan celah di form upload, plugin, atau theme, lalu mengunggah web shell berekstensi <code>.php<\/code>. Setelah web shell bisa dieksekusi, penyerang bebas menyisipkan malware ke file inti aplikasi.<\/p>\n<p><img data-recalc-dims=\"1\" loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2241\" src=\"https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2026\/11\/keamanan-upload-dir-chattr.jpg?resize=1680%2C944&#038;ssl=1\" alt=\"Ilustrasi folder terkunci dan file PHP yang diblokir\" width=\"1680\" height=\"944\" srcset=\"https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2026\/11\/keamanan-upload-dir-chattr.jpg?w=1680&amp;ssl=1 1680w, https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2026\/11\/keamanan-upload-dir-chattr.jpg?resize=300%2C169&amp;ssl=1 300w, https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2026\/11\/keamanan-upload-dir-chattr.jpg?resize=1024%2C575&amp;ssl=1 1024w, https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2026\/11\/keamanan-upload-dir-chattr.jpg?resize=768%2C432&amp;ssl=1 768w, https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2026\/11\/keamanan-upload-dir-chattr.jpg?resize=1536%2C863&amp;ssl=1 1536w\" sizes=\"auto, (max-width: 1000px) 100vw, 1000px\" \/><\/p>\n<p>Di tulisan <a href=\"https:\/\/zaf.web.id\/blog\/mitigasi-malware-di-web-server-dan-cara-membersihkannya\/\">Mitigasi Malware di Web Server<\/a> saya sempat menyinggung <code>chattr<\/code> sebagai bonus. Kali ini kita bahas lebih lengkap, ditambah satu lapisan lagi: memastikan folder upload tidak bisa mengeksekusi PHP. Dua langkah ini saling melengkapi. Yang pertama menjaga file inti agar tidak bisa diubah, yang kedua membuat file yang berhasil diunggah tidak ada gunanya.<\/p>\n<h2>A Glance of chattr<\/h2>\n<p><code>chattr<\/code> (change attribute) adalah perintah Linux untuk mengatur atribut file di level filesystem. Atribut ini berbeda dengan permission biasa (<code>chmod<\/code>\/<code>chown<\/code>). Atribut yang paling berguna untuk kita adalah <code>i<\/code> atau <em>immutable<\/em>.<\/p>\n<p>File atau direktori yang diberi atribut <code>+i<\/code> tidak bisa diubah, dihapus, diganti nama, atau ditimpa. Ini berlaku untuk semua user, <strong>termasuk root<\/strong>, sampai atributnya dicabut kembali. Jadi walaupun penyerang berhasil menjalankan kode sebagai user web server, file inti aplikasi tetap aman.<\/p>\n<p>Beberapa hal yang perlu diketahui:<\/p>\n<ul>\n<li>Hanya root (atau proses dengan capability <code>CAP_LINUX_IMMUTABLE<\/code>) yang bisa memasang dan mencabut atribut ini. User hosting biasa tidak bisa.<\/li>\n<li>Didukung filesystem umum seperti ext4, XFS, dan Btrfs. Tidak berlaku di NFS dan sebagian filesystem jaringan.<\/li>\n<li>Untuk melihat atribut yang terpasang, gunakan <code>lsattr<\/code>.<\/li>\n<\/ul>\n<h2>Utilize chattr on Dir App<\/h2>\n<p>Prinsipnya sederhana: kunci semua direktori yang berisi script, biarkan hanya direktori upload yang bisa ditulis. Untuk WordPress, contohnya seperti ini:<\/p>\n<div class=\"hcb_wrap\">\n<pre class=\"prism line-numbers lang-bash\" data-lang=\"Bash\"><code>cd \/var\/www\/situs\nchattr -R +i wp-admin wp-includes\nchattr -R +i wp-content\/themes wp-content\/plugins\nchattr +i index.php wp-config.php .htaccess<\/code><\/pre>\n<\/div>\n<p>Periksa hasilnya dengan <code>lsattr<\/code>. Huruf <code>i<\/code> menandakan atribut immutable sudah aktif.<\/p>\n<div class=\"hcb_wrap\">\n<pre class=\"prism line-numbers lang-bash\" data-lang=\"Bash\"><code>lsattr -d wp-includes index.php wp-content\/uploads<\/code><\/pre>\n<\/div>\n<p><img data-recalc-dims=\"1\" loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2242\" src=\"https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2026\/11\/keamanan-upload-dir-lsattr.jpg?resize=1680%2C944&#038;ssl=1\" alt=\"Terminal chattr dan lsattr menolak perubahan file\" width=\"1680\" height=\"944\" srcset=\"https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2026\/11\/keamanan-upload-dir-lsattr.jpg?w=1680&amp;ssl=1 1680w, https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2026\/11\/keamanan-upload-dir-lsattr.jpg?resize=300%2C169&amp;ssl=1 300w, https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2026\/11\/keamanan-upload-dir-lsattr.jpg?resize=1024%2C575&amp;ssl=1 1024w, https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2026\/11\/keamanan-upload-dir-lsattr.jpg?resize=768%2C432&amp;ssl=1 768w, https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2026\/11\/keamanan-upload-dir-lsattr.jpg?resize=1536%2C863&amp;ssl=1 1536w\" sizes=\"auto, (max-width: 1000px) 100vw, 1000px\" \/><\/p>\n<p>Setiap percobaan mengubah atau menghapus file yang dikunci akan berakhir dengan pesan <code>Operation not permitted<\/code>, bahkan jika dijalankan sebagai root.<\/p>\n<h3>Disable chattr saat update<\/h3>\n<p>Konsekuensinya, update core, plugin, dan theme dari dashboard akan gagal selama direktori terkunci. Ini memang yang kita inginkan, karena <a href=\"https:\/\/zaf.web.id\/blog\/supply-chain-attack-plugin-wordpress-2026-cara-audit-backdoor-di-server-linux\/\">update pun bisa menjadi jalur masuk backdoor<\/a>. Update dilakukan secara sadar: buka kunci, update, periksa, lalu kunci kembali.<\/p>\n<p>Supaya tidak repot mengetik ulang, saya memakai script kecil <code>\/root\/wp-lock.sh<\/code>:<\/p>\n<div class=\"hcb_wrap\">\n<pre class=\"prism line-numbers lang-bash\" data-file=\"wp-lock.sh\" data-lang=\"Bash\"><code>#!\/bin\/bash\n# Pemakaian: wp-lock.sh lock|unlock \/var\/www\/situs\n\nMODE=$1; DIR=$2\n[ \"$MODE\" = \"lock\" ] &amp;&amp; FLAG=\"+i\" || FLAG=\"-i\"\n\ncd \"$DIR\" || exit 1\nchattr -R $FLAG wp-admin wp-includes wp-content\/themes wp-content\/plugins\nchattr $FLAG index.php wp-config.php .htaccess wp-content\/uploads\/.htaccess\necho \"$DIR: $MODE\"<\/code><\/pre>\n<\/div>\n<p>Alur update menjadi:<\/p>\n<div class=\"hcb_wrap\">\n<pre class=\"prism line-numbers lang-bash\" data-lang=\"Bash\"><code>\/root\/wp-lock.sh unlock \/var\/www\/situs\nwp core update &amp;&amp; wp plugin update --all\nwp core verify-checksums &amp;&amp; wp plugin verify-checksums --all\n\/root\/wp-lock.sh lock \/var\/www\/situs<\/code><\/pre>\n<\/div>\n<p>Jangan kunci direktori <code>wp-content\/uploads<\/code>, <code>wp-content\/cache<\/code>, atau direktori lain yang memang harus ditulis aplikasi. Kalau dikunci, upload gambar dan plugin cache akan berhenti bekerja.<\/p>\n<h2>Additional Restriction<\/h2>\n<p>Direktori upload harus tetap bisa ditulis, dan di sinilah web shell biasanya diletakkan. Karena tidak bisa dikunci, kita pastikan saja tidak ada file PHP yang bisa dieksekusi dari sana. Folder upload hanya berisi gambar dan dokumen, jadi tidak ada alasan sah untuk menjalankan PHP di dalamnya.<\/p>\n<p><img data-recalc-dims=\"1\" loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-2243\" src=\"https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2026\/11\/keamanan-upload-dir-struktur.jpg?resize=1680%2C944&#038;ssl=1\" alt=\"Struktur direktori WordPress dengan atribut immutable dan folder upload\" width=\"1680\" height=\"944\" srcset=\"https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2026\/11\/keamanan-upload-dir-struktur.jpg?w=1680&amp;ssl=1 1680w, https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2026\/11\/keamanan-upload-dir-struktur.jpg?resize=300%2C169&amp;ssl=1 300w, https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2026\/11\/keamanan-upload-dir-struktur.jpg?resize=1024%2C575&amp;ssl=1 1024w, https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2026\/11\/keamanan-upload-dir-struktur.jpg?resize=768%2C432&amp;ssl=1 768w, https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2026\/11\/keamanan-upload-dir-struktur.jpg?resize=1536%2C863&amp;ssl=1 1536w\" sizes=\"auto, (max-width: 1000px) 100vw, 1000px\" \/><\/p>\n<h3>Apache<\/h3>\n<p>Buat file <code>wp-content\/uploads\/.htaccess<\/code>:<\/p>\n<div class=\"hcb_wrap\">\n<pre class=\"prism line-numbers lang-html\" data-file=\"wp-content\/uploads\/.htaccess\" data-lang=\"Apache\"><code>&lt;FilesMatch \"&#092;.(php|php[0-9]|phtml|phar)$\"&gt;\n    Require all denied\n&lt;\/FilesMatch&gt;<\/code><\/pre>\n<\/div>\n<p>Pastikan <code>AllowOverride<\/code> di virtual host mengizinkan <code>.htaccess<\/code>. Lalu <strong>kunci file .htaccess ini<\/strong> dengan <code>chattr +i<\/code>, karena penyerang yang paham biasanya akan menimpa atau menghapus <code>.htaccess<\/code> terlebih dahulu.<\/p>\n<div class=\"hcb_wrap\">\n<pre class=\"prism line-numbers lang-bash\" data-lang=\"Bash\"><code>chattr +i wp-content\/uploads\/.htaccess<\/code><\/pre>\n<\/div>\n<p>Banyak tutorial menyarankan <code>php_flag engine off<\/code>. Cara ini hanya berlaku jika PHP berjalan sebagai <code>mod_php<\/code>. Di server yang memakai PHP-FPM, baris tersebut tidak berpengaruh, bahkan bisa memicu error 500. <code>FilesMatch<\/code> lebih aman karena bekerja di level Apache.<\/p>\n<h3>Nginx<\/h3>\n<p>Nginx tidak membaca <code>.htaccess<\/code>, jadi aturannya ditulis di konfigurasi server block. Letakkan <strong>sebelum<\/strong> blok <code>location ~ &#092;.php$<\/code>, karena Nginx memakai regex location pertama yang cocok.<\/p>\n<div class=\"hcb_wrap\">\n<pre class=\"prism line-numbers lang-plain\" data-lang=\"Nginx\"><code>location ~* ^\/wp-content\/uploads\/.*&#092;.(php|php[0-9]|phtml|phar)$ {\n    deny all;\n}<\/code><\/pre>\n<\/div>\n<p>Uji dengan membuat file PHP dummy di folder upload lalu mengaksesnya dari browser. Hasil yang benar adalah <code>403 Forbidden<\/code>, bukan halaman kosong dan bukan output PHP.<\/p>\n<div class=\"hcb_wrap\">\n<pre class=\"prism line-numbers lang-bash\" data-lang=\"Bash\"><code>echo '&lt;?php echo \"jalan\";' &gt; wp-content\/uploads\/test.php\ncurl -I https:\/\/situs-anda.ac.id\/wp-content\/uploads\/test.php\nrm wp-content\/uploads\/test.php<\/code><\/pre>\n<\/div>\n<h3>Bagaimana dengan OJS?<\/h3>\n<p>Prinsipnya sama. Pastikan <code>files_dir<\/code> di <code>config.inc.php<\/code> berada <strong>di luar<\/strong> <code>public_html<\/code>, sehingga file naskah yang diunggah penulis tidak bisa diakses langsung lewat URL. Direktori <code>public\/<\/code> yang memang harus bisa diakses publik diberi aturan blokir PHP seperti di atas. Untuk direktori script OJS seperti <code>lib<\/code>, <code>classes<\/code>, dan <code>plugins<\/code>, gunakan <code>chattr +i<\/code> dengan alur update yang sama.<\/p>\n<h2>Penutup<\/h2>\n<p>Tidak ada satu cara yang membuat website kebal. Tetapi dua langkah ini mengubah situasi secara signifikan: celah upload yang dulu berarti server diambil alih, sekarang paling jauh hanya menghasilkan file sampah di folder upload. Tetap rutin periksa folder tersebut, misalnya dengan:<\/p>\n<div class=\"hcb_wrap\">\n<pre class=\"prism line-numbers lang-bash\" data-lang=\"Bash\"><code>find wp-content\/uploads -type f -name \"*.php\"<\/code><\/pre>\n<\/div>\n<p>Kalau perintah di atas mengembalikan hasil, saatnya mulai <a href=\"https:\/\/zaf.web.id\/blog\/berburu-malware-di-server-linux\/\">berburu malware<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Tidak sedikit serangan yang terjadi terhadap website yang mengincar File Upload Vulnerabilities, khususnya website yang&hellip;<\/p>\n","protected":false},"author":1,"featured_media":2241,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_hide_featured_image":false,"_jetpack_featured_image_duplicate_dismissed":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[272,58,7],"tags":[251,303,358,360,304,359],"class_list":["post-1957","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","category-server","category-wordpress","tag-apache","tag-chattr","tag-file-upload-vulnerability","tag-nginx","tag-upload-security","tag-web-shell"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.8 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Rekomendasi Keamanan Upload Dir pada Aplikasi Web - Ahmad Zafrullah<\/title>\n<meta name=\"description\" content=\"Cegah web shell lewat celah upload: kunci script inti dengan chattr +i dan blokir eksekusi PHP di folder upload pada Apache dan Nginx.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/zaf.web.id\/blog\/rekomendasi-keamanan-upload-dir-pada-aplikasi-web\/\" \/>\n<meta property=\"og:locale\" content=\"id_ID\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Rekomendasi Keamanan Upload Dir pada Aplikasi Web - Ahmad Zafrullah\" \/>\n<meta property=\"og:description\" content=\"Cegah web shell lewat celah upload: kunci script inti dengan chattr +i dan blokir eksekusi PHP di folder upload pada Apache dan Nginx.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/zaf.web.id\/blog\/rekomendasi-keamanan-upload-dir-pada-aplikasi-web\/\" \/>\n<meta property=\"og:site_name\" content=\"Ahmad Zafrullah\" \/>\n<meta property=\"article:publisher\" content=\"http:\/\/www.facebook.com\/23Pstars\" \/>\n<meta property=\"article:author\" content=\"http:\/\/www.facebook.com\/23Pstars\" \/>\n<meta property=\"article:published_time\" content=\"2026-05-14T05:25:36+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-11-14T13:43:06+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2026\/11\/keamanan-upload-dir-chattr.jpg?fit=1680%2C944&ssl=1\" \/>\n\t<meta property=\"og:image:width\" content=\"1680\" \/>\n\t<meta property=\"og:image:height\" content=\"944\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Zaf\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@23Pstars\" \/>\n<meta name=\"twitter:site\" content=\"@23Pstars\" \/>\n<meta name=\"twitter:label1\" content=\"Ditulis oleh\" \/>\n\t<meta name=\"twitter:data1\" content=\"Zaf\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimasi waktu membaca\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 menit\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/zaf.web.id\\\/blog\\\/rekomendasi-keamanan-upload-dir-pada-aplikasi-web\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/zaf.web.id\\\/blog\\\/rekomendasi-keamanan-upload-dir-pada-aplikasi-web\\\/\"},\"author\":{\"name\":\"Zaf\",\"@id\":\"https:\\\/\\\/zaf.web.id\\\/blog\\\/#\\\/schema\\\/person\\\/ba4e955d59a1e6a8284857e74b14e5ed\"},\"headline\":\"Rekomendasi Keamanan Upload Dir pada Aplikasi Web\",\"datePublished\":\"2026-05-14T05:25:36+00:00\",\"dateModified\":\"2026-11-14T13:43:06+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/zaf.web.id\\\/blog\\\/rekomendasi-keamanan-upload-dir-pada-aplikasi-web\\\/\"},\"wordCount\":602,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/zaf.web.id\\\/blog\\\/#\\\/schema\\\/person\\\/ba4e955d59a1e6a8284857e74b14e5ed\"},\"image\":{\"@id\":\"https:\\\/\\\/zaf.web.id\\\/blog\\\/rekomendasi-keamanan-upload-dir-pada-aplikasi-web\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i0.wp.com\\\/zaf.web.id\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/keamanan-upload-dir-chattr.jpg?fit=1680%2C944&ssl=1\",\"keywords\":[\"apache\",\"chattr\",\"file upload vulnerability\",\"nginx\",\"upload security\",\"web shell\"],\"articleSection\":[\"Security\",\"Server\",\"WordPress\"],\"inLanguage\":\"id\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/zaf.web.id\\\/blog\\\/rekomendasi-keamanan-upload-dir-pada-aplikasi-web\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/zaf.web.id\\\/blog\\\/rekomendasi-keamanan-upload-dir-pada-aplikasi-web\\\/\",\"url\":\"https:\\\/\\\/zaf.web.id\\\/blog\\\/rekomendasi-keamanan-upload-dir-pada-aplikasi-web\\\/\",\"name\":\"Rekomendasi Keamanan Upload Dir pada Aplikasi Web - Ahmad Zafrullah\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/zaf.web.id\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/zaf.web.id\\\/blog\\\/rekomendasi-keamanan-upload-dir-pada-aplikasi-web\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/zaf.web.id\\\/blog\\\/rekomendasi-keamanan-upload-dir-pada-aplikasi-web\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i0.wp.com\\\/zaf.web.id\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/keamanan-upload-dir-chattr.jpg?fit=1680%2C944&ssl=1\",\"datePublished\":\"2026-05-14T05:25:36+00:00\",\"dateModified\":\"2026-11-14T13:43:06+00:00\",\"description\":\"Cegah web shell lewat celah upload: kunci script inti dengan chattr +i dan blokir eksekusi PHP di folder upload pada Apache dan Nginx.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/zaf.web.id\\\/blog\\\/rekomendasi-keamanan-upload-dir-pada-aplikasi-web\\\/#breadcrumb\"},\"inLanguage\":\"id\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/zaf.web.id\\\/blog\\\/rekomendasi-keamanan-upload-dir-pada-aplikasi-web\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"id\",\"@id\":\"https:\\\/\\\/zaf.web.id\\\/blog\\\/rekomendasi-keamanan-upload-dir-pada-aplikasi-web\\\/#primaryimage\",\"url\":\"https:\\\/\\\/i0.wp.com\\\/zaf.web.id\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/keamanan-upload-dir-chattr.jpg?fit=1680%2C944&ssl=1\",\"contentUrl\":\"https:\\\/\\\/i0.wp.com\\\/zaf.web.id\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/keamanan-upload-dir-chattr.jpg?fit=1680%2C944&ssl=1\",\"width\":1680,\"height\":944,\"caption\":\"Kunci script inti, jinakkan folder upload.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/zaf.web.id\\\/blog\\\/rekomendasi-keamanan-upload-dir-pada-aplikasi-web\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/zaf.web.id\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Rekomendasi Keamanan Upload Dir pada Aplikasi Web\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/zaf.web.id\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/zaf.web.id\\\/blog\\\/\",\"name\":\"Ahmad Zafrullah\",\"description\":\"Work to Learn is better than Learn how to Work\",\"publisher\":{\"@id\":\"https:\\\/\\\/zaf.web.id\\\/blog\\\/#\\\/schema\\\/person\\\/ba4e955d59a1e6a8284857e74b14e5ed\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/zaf.web.id\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"id\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/zaf.web.id\\\/blog\\\/#\\\/schema\\\/person\\\/ba4e955d59a1e6a8284857e74b14e5ed\",\"name\":\"Zaf\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"id\",\"@id\":\"https:\\\/\\\/i0.wp.com\\\/zaf.web.id\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/09\\\/zaf_auto_x2.jpeg?fit=300%2C300&ssl=1\",\"url\":\"https:\\\/\\\/i0.wp.com\\\/zaf.web.id\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/09\\\/zaf_auto_x2.jpeg?fit=300%2C300&ssl=1\",\"contentUrl\":\"https:\\\/\\\/i0.wp.com\\\/zaf.web.id\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/09\\\/zaf_auto_x2.jpeg?fit=300%2C300&ssl=1\",\"width\":300,\"height\":300,\"caption\":\"Zaf\"},\"logo\":{\"@id\":\"https:\\\/\\\/i0.wp.com\\\/zaf.web.id\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/09\\\/zaf_auto_x2.jpeg?fit=300%2C300&ssl=1\"},\"sameAs\":[\"http:\\\/\\\/zaf.web.id\",\"http:\\\/\\\/www.facebook.com\\\/23Pstars\",\"https:\\\/\\\/x.com\\\/23Pstars\"],\"url\":\"https:\\\/\\\/zaf.web.id\\\/blog\\\/author\\\/zaf\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Rekomendasi Keamanan Upload Dir pada Aplikasi Web - Ahmad Zafrullah","description":"Cegah web shell lewat celah upload: kunci script inti dengan chattr +i dan blokir eksekusi PHP di folder upload pada Apache dan Nginx.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/zaf.web.id\/blog\/rekomendasi-keamanan-upload-dir-pada-aplikasi-web\/","og_locale":"id_ID","og_type":"article","og_title":"Rekomendasi Keamanan Upload Dir pada Aplikasi Web - Ahmad Zafrullah","og_description":"Cegah web shell lewat celah upload: kunci script inti dengan chattr +i dan blokir eksekusi PHP di folder upload pada Apache dan Nginx.","og_url":"https:\/\/zaf.web.id\/blog\/rekomendasi-keamanan-upload-dir-pada-aplikasi-web\/","og_site_name":"Ahmad Zafrullah","article_publisher":"http:\/\/www.facebook.com\/23Pstars","article_author":"http:\/\/www.facebook.com\/23Pstars","article_published_time":"2026-05-14T05:25:36+00:00","article_modified_time":"2026-11-14T13:43:06+00:00","og_image":[{"width":1680,"height":944,"url":"https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2026\/11\/keamanan-upload-dir-chattr.jpg?fit=1680%2C944&ssl=1","type":"image\/jpeg"}],"author":"Zaf","twitter_card":"summary_large_image","twitter_creator":"@23Pstars","twitter_site":"@23Pstars","twitter_misc":{"Ditulis oleh":"Zaf","Estimasi waktu membaca":"5 menit"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/zaf.web.id\/blog\/rekomendasi-keamanan-upload-dir-pada-aplikasi-web\/#article","isPartOf":{"@id":"https:\/\/zaf.web.id\/blog\/rekomendasi-keamanan-upload-dir-pada-aplikasi-web\/"},"author":{"name":"Zaf","@id":"https:\/\/zaf.web.id\/blog\/#\/schema\/person\/ba4e955d59a1e6a8284857e74b14e5ed"},"headline":"Rekomendasi Keamanan Upload Dir pada Aplikasi Web","datePublished":"2026-05-14T05:25:36+00:00","dateModified":"2026-11-14T13:43:06+00:00","mainEntityOfPage":{"@id":"https:\/\/zaf.web.id\/blog\/rekomendasi-keamanan-upload-dir-pada-aplikasi-web\/"},"wordCount":602,"commentCount":0,"publisher":{"@id":"https:\/\/zaf.web.id\/blog\/#\/schema\/person\/ba4e955d59a1e6a8284857e74b14e5ed"},"image":{"@id":"https:\/\/zaf.web.id\/blog\/rekomendasi-keamanan-upload-dir-pada-aplikasi-web\/#primaryimage"},"thumbnailUrl":"https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2026\/11\/keamanan-upload-dir-chattr.jpg?fit=1680%2C944&ssl=1","keywords":["apache","chattr","file upload vulnerability","nginx","upload security","web shell"],"articleSection":["Security","Server","WordPress"],"inLanguage":"id","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/zaf.web.id\/blog\/rekomendasi-keamanan-upload-dir-pada-aplikasi-web\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/zaf.web.id\/blog\/rekomendasi-keamanan-upload-dir-pada-aplikasi-web\/","url":"https:\/\/zaf.web.id\/blog\/rekomendasi-keamanan-upload-dir-pada-aplikasi-web\/","name":"Rekomendasi Keamanan Upload Dir pada Aplikasi Web - Ahmad Zafrullah","isPartOf":{"@id":"https:\/\/zaf.web.id\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/zaf.web.id\/blog\/rekomendasi-keamanan-upload-dir-pada-aplikasi-web\/#primaryimage"},"image":{"@id":"https:\/\/zaf.web.id\/blog\/rekomendasi-keamanan-upload-dir-pada-aplikasi-web\/#primaryimage"},"thumbnailUrl":"https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2026\/11\/keamanan-upload-dir-chattr.jpg?fit=1680%2C944&ssl=1","datePublished":"2026-05-14T05:25:36+00:00","dateModified":"2026-11-14T13:43:06+00:00","description":"Cegah web shell lewat celah upload: kunci script inti dengan chattr +i dan blokir eksekusi PHP di folder upload pada Apache dan Nginx.","breadcrumb":{"@id":"https:\/\/zaf.web.id\/blog\/rekomendasi-keamanan-upload-dir-pada-aplikasi-web\/#breadcrumb"},"inLanguage":"id","potentialAction":[{"@type":"ReadAction","target":["https:\/\/zaf.web.id\/blog\/rekomendasi-keamanan-upload-dir-pada-aplikasi-web\/"]}]},{"@type":"ImageObject","inLanguage":"id","@id":"https:\/\/zaf.web.id\/blog\/rekomendasi-keamanan-upload-dir-pada-aplikasi-web\/#primaryimage","url":"https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2026\/11\/keamanan-upload-dir-chattr.jpg?fit=1680%2C944&ssl=1","contentUrl":"https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2026\/11\/keamanan-upload-dir-chattr.jpg?fit=1680%2C944&ssl=1","width":1680,"height":944,"caption":"Kunci script inti, jinakkan folder upload."},{"@type":"BreadcrumbList","@id":"https:\/\/zaf.web.id\/blog\/rekomendasi-keamanan-upload-dir-pada-aplikasi-web\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/zaf.web.id\/blog\/"},{"@type":"ListItem","position":2,"name":"Rekomendasi Keamanan Upload Dir pada Aplikasi Web"}]},{"@type":"WebSite","@id":"https:\/\/zaf.web.id\/blog\/#website","url":"https:\/\/zaf.web.id\/blog\/","name":"Ahmad Zafrullah","description":"Work to Learn is better than Learn how to Work","publisher":{"@id":"https:\/\/zaf.web.id\/blog\/#\/schema\/person\/ba4e955d59a1e6a8284857e74b14e5ed"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/zaf.web.id\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"id"},{"@type":["Person","Organization"],"@id":"https:\/\/zaf.web.id\/blog\/#\/schema\/person\/ba4e955d59a1e6a8284857e74b14e5ed","name":"Zaf","image":{"@type":"ImageObject","inLanguage":"id","@id":"https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2024\/09\/zaf_auto_x2.jpeg?fit=300%2C300&ssl=1","url":"https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2024\/09\/zaf_auto_x2.jpeg?fit=300%2C300&ssl=1","contentUrl":"https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2024\/09\/zaf_auto_x2.jpeg?fit=300%2C300&ssl=1","width":300,"height":300,"caption":"Zaf"},"logo":{"@id":"https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2024\/09\/zaf_auto_x2.jpeg?fit=300%2C300&ssl=1"},"sameAs":["http:\/\/zaf.web.id","http:\/\/www.facebook.com\/23Pstars","https:\/\/x.com\/23Pstars"],"url":"https:\/\/zaf.web.id\/blog\/author\/zaf\/"}]}},"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":1954,"url":"https:\/\/zaf.web.id\/blog\/mitigasi-malware-di-web-server-dan-cara-membersihkannya\/","url_meta":{"origin":1957,"position":0},"title":"Mitigasi Malware di Web Server dan Cara Membersihkannya","author":"Zaf","date":"November 23, 2022","format":false,"excerpt":"Malware selalu menjadi hal yang merepotkan. Umumnya pembuat malware tidak membuat malware untuk sekedar ajang pamer layaknya defacement. Malware dibuat demi tujuan yang lebih besar dan masif, dan biasanya tidak berjalan secara sendiri-sendiri melainkan menjadi sebuah network atau perkumpulan. Discovery Disuatu pagi tiba-tiba salah satu website yang kami kelola menunjukkan\u2026","rel":"","context":"dalam &quot;Security&quot;","block_context":{"text":"Security","link":"https:\/\/zaf.web.id\/blog\/category\/security\/"},"img":{"alt_text":"Mencari induk malware","src":"https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2022\/11\/6.-cari-dan-hapus-file-ico.png?fit=795%2C241&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2022\/11\/6.-cari-dan-hapus-file-ico.png?fit=795%2C241&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2022\/11\/6.-cari-dan-hapus-file-ico.png?fit=795%2C241&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2022\/11\/6.-cari-dan-hapus-file-ico.png?fit=795%2C241&ssl=1&resize=700%2C400 2x"},"classes":[]},{"id":981,"url":"https:\/\/zaf.web.id\/blog\/serangan-adware-via-htaccess\/","url_meta":{"origin":1957,"position":1},"title":"Serangan Adware via .htaccess","author":"Zaf","date":"Desember 17, 2016","format":false,"excerpt":"Bukan pertama kalinya beberapa server kami mendapatkan serangan dengan teknik yang berbagai macam jenis, bentuk, dan dampaknya. Pagi ini\u00a0sempat kaget karena semua website yang ada dalam server Gili Air\u00a0kami diarahkan ke situs iklan ketika diakses dari perangkat mobile. Saat ditelusuri ternyata semua file .htaccess nya telah disusupi semua, untuk mendeteksi\u2026","rel":"","context":"dalam &quot;Server&quot;","block_context":{"text":"Server","link":"https:\/\/zaf.web.id\/blog\/category\/server\/"},"img":{"alt_text":".htaccess malware inject","src":"https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2016\/12\/Screen-Shot-2016-12-15-at-5.34.42-PM-1024x680.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2016\/12\/Screen-Shot-2016-12-15-at-5.34.42-PM-1024x680.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2016\/12\/Screen-Shot-2016-12-15-at-5.34.42-PM-1024x680.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":1501,"url":"https:\/\/zaf.web.id\/blog\/upload-file-sederhana-ke-aws-s3-dengan-php\/","url_meta":{"origin":1957,"position":2},"title":"Upload File Sederhana ke AWS S3 dengan PHP","author":"Zaf","date":"Agustus 9, 2020","format":false,"excerpt":"AWS telah menyediakan SDK untuk memudahkan transaksi terhadap beberapa servicenya secara program, salah satu yang disediakan adalah untuk PHP. Namun terkadang kebutuhan tidak sesuai dengan usaha yang harus dikeluarkan. Untuk sekedar upload file ke S3 milik AWS kita perlu load\/download paket lengkap dari SDK nya, rasanya agak berlebihan. Setelah googling\u2026","rel":"","context":"dalam &quot;Programming&quot;","block_context":{"text":"Programming","link":"https:\/\/zaf.web.id\/blog\/category\/programming\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2020\/08\/Screenshot-2024-09-06-at-00.22.03.png?fit=1200%2C813&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2020\/08\/Screenshot-2024-09-06-at-00.22.03.png?fit=1200%2C813&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2020\/08\/Screenshot-2024-09-06-at-00.22.03.png?fit=1200%2C813&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2020\/08\/Screenshot-2024-09-06-at-00.22.03.png?fit=1200%2C813&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2020\/08\/Screenshot-2024-09-06-at-00.22.03.png?fit=1200%2C813&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":484,"url":"https:\/\/zaf.web.id\/blog\/serangan-campaign-malware\/","url_meta":{"origin":1957,"position":3},"title":"Serangan Campaign Malware","author":"Zaf","date":"Desember 18, 2014","format":false,"excerpt":"Hari ini dipenghujung tahun 2014 ini adalah hari paling merepotkan selama mengelola salah satu Cloud milik LRsoft. Pasalnya server mendapat kado natal istimewa berupa malware yang menginfeksi 60 lebih website yang ada didalamnya, sehingga ketika domain web tersebut diakses via browser akan muncul peringatan block halaman dari layanan Google seperti\u2026","rel":"","context":"dalam &quot;Server&quot;","block_context":{"text":"Server","link":"https:\/\/zaf.web.id\/blog\/category\/server\/"},"img":{"alt_text":"Block dari Google","src":"https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2014\/12\/malware-frommshead.php_.png?resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2014\/12\/malware-frommshead.php_.png?resize=350%2C200 1x, https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2014\/12\/malware-frommshead.php_.png?resize=525%2C300 1.5x"},"classes":[]},{"id":791,"url":"https:\/\/zaf.web.id\/blog\/update-source-otomatis-dari-bitbucket-dan-github\/","url_meta":{"origin":1957,"position":4},"title":"Update Source otomatis dari Bitbucket dan GitHub","author":"Zaf","date":"Mei 22, 2016","format":false,"excerpt":"Siapa yang tidak kenal kedua GIT repository tersebut, dengan semua fasilitas yang\u00a0disediakan oleh Bitbucket dan GitHub membuat para developer nyaman untuk menitipkan source project mereka disana. Saya\u00a0menggunakan Bitbucket cukup lama, hanya baru-baru ini mulai menggunakan GitHub. Mengingat\u00a0kebijakan pricing yang diterapkan kedua layanan tersebut sedikit berbeda, untuk versi free Bitbucket memungkinkan\u2026","rel":"","context":"dalam &quot;Coretan&quot;","block_context":{"text":"Coretan","link":"https:\/\/zaf.web.id\/blog\/category\/coretan\/"},"img":{"alt_text":"Bitbucket and GitHub","src":"https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2015\/12\/github-bitbucket-300x172.png?resize=350%2C200","width":350,"height":200},"classes":[]},{"id":2228,"url":"https:\/\/zaf.web.id\/blog\/ai-untuk-incident-response-malware\/","url_meta":{"origin":1957,"position":5},"title":"Memakai AI untuk Incident Response Malware (dengan Batasan yang Aman)","author":"Zaf","date":"November 7, 2026","format":false,"excerpt":"Tulisan saya sebelumnya tentang tips keamanan siber disusun dengan bantuan AI. Kali ini saya ingin lebih teknis: bagaimana AI membantu ketika server benar-benar terinfeksi, dan di mana saya sengaja tidak menyerahkan kendali. Prinsip dasar AI saya perlakukan sebagai analis junior yang cepat membaca, bukan operator yang memegang root. Artinya, AI\u2026","rel":"","context":"dalam &quot;Security&quot;","block_context":{"text":"Security","link":"https:\/\/zaf.web.id\/blog\/category\/security\/"},"img":{"alt_text":"Ilustrasi manusia dan AI menganalisis log server bersama","src":"https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2026\/11\/Kolaborasi-manusia-dan-AI.jpg?fit=840%2C472&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2026\/11\/Kolaborasi-manusia-dan-AI.jpg?fit=840%2C472&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2026\/11\/Kolaborasi-manusia-dan-AI.jpg?fit=840%2C472&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2026\/11\/Kolaborasi-manusia-dan-AI.jpg?fit=840%2C472&ssl=1&resize=700%2C400 2x"},"classes":[]}],"jetpack_likes_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p4zLnS-vz","jetpack_featured_media_url":"https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2026\/11\/keamanan-upload-dir-chattr.jpg?fit=1680%2C944&ssl=1","_links":{"self":[{"href":"https:\/\/zaf.web.id\/blog\/wp-json\/wp\/v2\/posts\/1957","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zaf.web.id\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zaf.web.id\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zaf.web.id\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zaf.web.id\/blog\/wp-json\/wp\/v2\/comments?post=1957"}],"version-history":[{"count":9,"href":"https:\/\/zaf.web.id\/blog\/wp-json\/wp\/v2\/posts\/1957\/revisions"}],"predecessor-version":[{"id":2257,"href":"https:\/\/zaf.web.id\/blog\/wp-json\/wp\/v2\/posts\/1957\/revisions\/2257"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/zaf.web.id\/blog\/wp-json\/wp\/v2\/media\/2241"}],"wp:attachment":[{"href":"https:\/\/zaf.web.id\/blog\/wp-json\/wp\/v2\/media?parent=1957"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zaf.web.id\/blog\/wp-json\/wp\/v2\/categories?post=1957"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zaf.web.id\/blog\/wp-json\/wp\/v2\/tags?post=1957"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}