{"id":2223,"date":"2026-11-02T04:43:45","date_gmt":"2026-11-01T20:43:45","guid":{"rendered":"https:\/\/zaf.web.id\/blog\/?p=2223"},"modified":"2026-11-02T04:43:45","modified_gmt":"2026-11-01T20:43:45","slug":"supply-chain-attack-plugin-wordpress-2026-cara-audit-backdoor-di-server-linux","status":"publish","type":"post","link":"https:\/\/zaf.web.id\/blog\/supply-chain-attack-plugin-wordpress-2026-cara-audit-backdoor-di-server-linux\/","title":{"rendered":"Supply Chain Attack Plugin WordPress 2026: Cara Audit Backdoor di Server Linux"},"content":{"rendered":"

Selama ini nasihat keamanan WordPress yang paling sering saya ulang adalah: hindari plugin dan template dari sumber tidak jelas. Tahun 2026 membuktikan nasihat itu belum cukup<\/a>. Kali ini backdoor justru datang dari jalur yang kita percaya, yaitu update resmi.<\/p>\n

Apa yang terjadi?<\/h2>\n

Pada April 2026 lebih dari 25 plugin di repositori WordPress.org disusupi dalam rentang sekitar 72 jam, dan diperkirakan ratusan ribu situs ikut terpapar. Beberapa bulan kemudian giliran plugin berbayar ShapedPlugin yang disusupi lewat jalur update komersialnya, lalu pada Agustus feed promosi milik beberapa plugin BdThemes diracuni penyerang. Polanya sama: admin menekan tombol Update, dan backdoor terpasang dengan sendirinya.<\/p>\n

Langkah audit di server<\/h2>\n

Berikut urutan yang saya pakai ketika memeriksa server yang dicurigai. Semua perintah dijalankan dari root instalasi WordPress.<\/p>\n

1. Verifikasi checksum core dan plugin dari WordPress.org.<\/h3>\n

wp core verify-checksums
\nwp plugin verify-checksums --all<\/code><\/p>\n

\"Output<\/p>\n

 <\/p>\n

2. Cari file PHP yang berubah dalam 30 hari terakhir, lalu cari pola obfuscation yang umum dipakai malware.<\/h3>\n

find wp-content -name \"*.php\" -mtime -30 -type f
\ngrep -rlE \"eval(base64_decode|gzinflate(|str_rot13(\" wp-content\/<\/code><\/p>\n

3. Periksa akun administrator dan plugin must-use yang sering dipakai untuk bersembunyi.<\/h3>\n

wp user list --role=administrator
\nwp plugin list --status=must-use<\/code><\/p>\n

4. Jika ditemukan indikasi, ganti semua kredensial (database, FTP\/SSH, akun admin) dan acak ulang salt agar semua sesi login lama tidak berlaku.<\/h3>\n

wp config shuffle-salts<\/code><\/p>\n

Catatan penting<\/h2>\n

Checksum hanya berlaku untuk plugin dari WordPress.org. Plugin komersial perlu dibandingkan manual dengan paket asli dari vendornya. Setelah bersih, kurangi jumlah plugin: setiap plugin adalah rantai pasok yang ikut kita warisi.<\/p>\n

Di artikel berikutnya saya bahas strategi update plugin supaya tidak menjadi korban pertama.<\/p>\n","protected":false},"excerpt":{"rendered":"

Selama ini nasihat keamanan WordPress yang paling sering saya ulang adalah: hindari plugin dan template…<\/p>\n","protected":false},"author":1,"featured_media":2225,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[272,58,7],"tags":[347,140,346,8,348],"class_list":["post-2223","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","category-server","category-wordpress","tag-backdoor","tag-malware","tag-supply-chain-attack","tag-wordpress-2","tag-wp-cli"],"yoast_head":"\nSupply Chain Attack Plugin WordPress 2026: Cara Audit Backdoor di Server Linux - Ahmad Zafrullah<\/title>\n<meta name=\"description\" content=\"Plugin resmi pun bisa membawa backdoor. Panduan praktis mengaudit instalasi WordPress di server Linux setelah gelombang supply chain attack 2026.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/zaf.web.id\/blog\/supply-chain-attack-plugin-wordpress-2026-cara-audit-backdoor-di-server-linux\/\" \/>\n<meta property=\"og:locale\" content=\"id_ID\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Supply Chain Attack Plugin WordPress 2026: Cara Audit Backdoor di Server Linux - Ahmad Zafrullah\" \/>\n<meta property=\"og:description\" content=\"Plugin resmi pun bisa membawa backdoor. Panduan praktis mengaudit instalasi WordPress di server Linux setelah gelombang supply chain attack 2026.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/zaf.web.id\/blog\/supply-chain-attack-plugin-wordpress-2026-cara-audit-backdoor-di-server-linux\/\" \/>\n<meta property=\"og:site_name\" content=\"Ahmad Zafrullah\" \/>\n<meta property=\"article:publisher\" content=\"http:\/\/www.facebook.com\/23Pstars\" \/>\n<meta property=\"article:author\" content=\"http:\/\/www.facebook.com\/23Pstars\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-01T20:43:45+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/zaf.web.id\/blog\/wp-content\/uploads\/2026\/11\/AaGY1IdHqKSX3-GALPBRog-AaGY1IdHpN1EtMU9xGpoJQ.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1680\" \/>\n\t<meta property=\"og:image:height\" content=\"944\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Zaf\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@23Pstars\" \/>\n<meta name=\"twitter:site\" content=\"@23Pstars\" \/>\n<meta name=\"twitter:label1\" content=\"Ditulis oleh\" \/>\n\t<meta name=\"twitter:data1\" content=\"Zaf\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimasi waktu membaca\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 menit\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/zaf.web.id\\\/blog\\\/supply-chain-attack-plugin-wordpress-2026-cara-audit-backdoor-di-server-linux\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/zaf.web.id\\\/blog\\\/supply-chain-attack-plugin-wordpress-2026-cara-audit-backdoor-di-server-linux\\\/\"},\"author\":{\"name\":\"Zaf\",\"@id\":\"https:\\\/\\\/zaf.web.id\\\/blog\\\/#\\\/schema\\\/person\\\/ba4e955d59a1e6a8284857e74b14e5ed\"},\"headline\":\"Supply Chain Attack Plugin WordPress 2026: Cara Audit Backdoor di Server Linux\",\"datePublished\":\"2026-11-01T20:43:45+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/zaf.web.id\\\/blog\\\/supply-chain-attack-plugin-wordpress-2026-cara-audit-backdoor-di-server-linux\\\/\"},\"wordCount\":234,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/zaf.web.id\\\/blog\\\/#\\\/schema\\\/person\\\/ba4e955d59a1e6a8284857e74b14e5ed\"},\"image\":{\"@id\":\"https:\\\/\\\/zaf.web.id\\\/blog\\\/supply-chain-attack-plugin-wordpress-2026-cara-audit-backdoor-di-server-linux\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i0.wp.com\\\/zaf.web.id\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/AaGY1IdHqKSX3-GALPBRog-AaGY1IdHpN1EtMU9xGpoJQ.png?fit=1680%2C944&ssl=1\",\"keywords\":[\"backdoor\",\"malware\",\"supply chain attack\",\"wordpress\",\"wp-cli\"],\"articleSection\":[\"Security\",\"Server\",\"WordPress\"],\"inLanguage\":\"id\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/zaf.web.id\\\/blog\\\/supply-chain-attack-plugin-wordpress-2026-cara-audit-backdoor-di-server-linux\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/zaf.web.id\\\/blog\\\/supply-chain-attack-plugin-wordpress-2026-cara-audit-backdoor-di-server-linux\\\/\",\"url\":\"https:\\\/\\\/zaf.web.id\\\/blog\\\/supply-chain-attack-plugin-wordpress-2026-cara-audit-backdoor-di-server-linux\\\/\",\"name\":\"Supply Chain Attack Plugin WordPress 2026: Cara Audit Backdoor di Server Linux - Ahmad Zafrullah\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/zaf.web.id\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/zaf.web.id\\\/blog\\\/supply-chain-attack-plugin-wordpress-2026-cara-audit-backdoor-di-server-linux\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/zaf.web.id\\\/blog\\\/supply-chain-attack-plugin-wordpress-2026-cara-audit-backdoor-di-server-linux\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i0.wp.com\\\/zaf.web.id\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/AaGY1IdHqKSX3-GALPBRog-AaGY1IdHpN1EtMU9xGpoJQ.png?fit=1680%2C944&ssl=1\",\"datePublished\":\"2026-11-01T20:43:45+00:00\",\"description\":\"Plugin resmi pun bisa membawa backdoor. Panduan praktis mengaudit instalasi WordPress di server Linux setelah gelombang supply chain attack 2026.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/zaf.web.id\\\/blog\\\/supply-chain-attack-plugin-wordpress-2026-cara-audit-backdoor-di-server-linux\\\/#breadcrumb\"},\"inLanguage\":\"id\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/zaf.web.id\\\/blog\\\/supply-chain-attack-plugin-wordpress-2026-cara-audit-backdoor-di-server-linux\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"id\",\"@id\":\"https:\\\/\\\/zaf.web.id\\\/blog\\\/supply-chain-attack-plugin-wordpress-2026-cara-audit-backdoor-di-server-linux\\\/#primaryimage\",\"url\":\"https:\\\/\\\/i0.wp.com\\\/zaf.web.id\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/AaGY1IdHqKSX3-GALPBRog-AaGY1IdHpN1EtMU9xGpoJQ.png?fit=1680%2C944&ssl=1\",\"contentUrl\":\"https:\\\/\\\/i0.wp.com\\\/zaf.web.id\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/AaGY1IdHqKSX3-GALPBRog-AaGY1IdHpN1EtMU9xGpoJQ.png?fit=1680%2C944&ssl=1\",\"width\":1680,\"height\":944,\"caption\":\"Ilustrasi rantai pasok plugin WordPress yang disusupi\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/zaf.web.id\\\/blog\\\/supply-chain-attack-plugin-wordpress-2026-cara-audit-backdoor-di-server-linux\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/zaf.web.id\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Supply Chain Attack Plugin WordPress 2026: Cara Audit Backdoor di Server Linux\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/zaf.web.id\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/zaf.web.id\\\/blog\\\/\",\"name\":\"Ahmad Zafrullah\",\"description\":\"Work to Learn is better than Learn how to Work\",\"publisher\":{\"@id\":\"https:\\\/\\\/zaf.web.id\\\/blog\\\/#\\\/schema\\\/person\\\/ba4e955d59a1e6a8284857e74b14e5ed\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/zaf.web.id\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"id\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/zaf.web.id\\\/blog\\\/#\\\/schema\\\/person\\\/ba4e955d59a1e6a8284857e74b14e5ed\",\"name\":\"Zaf\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"id\",\"@id\":\"https:\\\/\\\/i0.wp.com\\\/zaf.web.id\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/09\\\/zaf_auto_x2.jpeg?fit=300%2C300&ssl=1\",\"url\":\"https:\\\/\\\/i0.wp.com\\\/zaf.web.id\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/09\\\/zaf_auto_x2.jpeg?fit=300%2C300&ssl=1\",\"contentUrl\":\"https:\\\/\\\/i0.wp.com\\\/zaf.web.id\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/09\\\/zaf_auto_x2.jpeg?fit=300%2C300&ssl=1\",\"width\":300,\"height\":300,\"caption\":\"Zaf\"},\"logo\":{\"@id\":\"https:\\\/\\\/i0.wp.com\\\/zaf.web.id\\\/blog\\\/wp-content\\\/uploads\\\/2024\\\/09\\\/zaf_auto_x2.jpeg?fit=300%2C300&ssl=1\"},\"sameAs\":[\"http:\\\/\\\/zaf.web.id\",\"http:\\\/\\\/www.facebook.com\\\/23Pstars\",\"https:\\\/\\\/x.com\\\/23Pstars\"],\"url\":\"https:\\\/\\\/zaf.web.id\\\/blog\\\/author\\\/zaf\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Supply Chain Attack Plugin WordPress 2026: Cara Audit Backdoor di Server Linux - Ahmad Zafrullah","description":"Plugin resmi pun bisa membawa backdoor. Panduan praktis mengaudit instalasi WordPress di server Linux setelah gelombang supply chain attack 2026.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/zaf.web.id\/blog\/supply-chain-attack-plugin-wordpress-2026-cara-audit-backdoor-di-server-linux\/","og_locale":"id_ID","og_type":"article","og_title":"Supply Chain Attack Plugin WordPress 2026: Cara Audit Backdoor di Server Linux - Ahmad Zafrullah","og_description":"Plugin resmi pun bisa membawa backdoor. Panduan praktis mengaudit instalasi WordPress di server Linux setelah gelombang supply chain attack 2026.","og_url":"https:\/\/zaf.web.id\/blog\/supply-chain-attack-plugin-wordpress-2026-cara-audit-backdoor-di-server-linux\/","og_site_name":"Ahmad Zafrullah","article_publisher":"http:\/\/www.facebook.com\/23Pstars","article_author":"http:\/\/www.facebook.com\/23Pstars","article_published_time":"2026-11-01T20:43:45+00:00","og_image":[{"width":1680,"height":944,"url":"https:\/\/zaf.web.id\/blog\/wp-content\/uploads\/2026\/11\/AaGY1IdHqKSX3-GALPBRog-AaGY1IdHpN1EtMU9xGpoJQ.png","type":"image\/png"}],"author":"Zaf","twitter_card":"summary_large_image","twitter_creator":"@23Pstars","twitter_site":"@23Pstars","twitter_misc":{"Ditulis oleh":"Zaf","Estimasi waktu membaca":"2 menit"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/zaf.web.id\/blog\/supply-chain-attack-plugin-wordpress-2026-cara-audit-backdoor-di-server-linux\/#article","isPartOf":{"@id":"https:\/\/zaf.web.id\/blog\/supply-chain-attack-plugin-wordpress-2026-cara-audit-backdoor-di-server-linux\/"},"author":{"name":"Zaf","@id":"https:\/\/zaf.web.id\/blog\/#\/schema\/person\/ba4e955d59a1e6a8284857e74b14e5ed"},"headline":"Supply Chain Attack Plugin WordPress 2026: Cara Audit Backdoor di Server Linux","datePublished":"2026-11-01T20:43:45+00:00","mainEntityOfPage":{"@id":"https:\/\/zaf.web.id\/blog\/supply-chain-attack-plugin-wordpress-2026-cara-audit-backdoor-di-server-linux\/"},"wordCount":234,"commentCount":0,"publisher":{"@id":"https:\/\/zaf.web.id\/blog\/#\/schema\/person\/ba4e955d59a1e6a8284857e74b14e5ed"},"image":{"@id":"https:\/\/zaf.web.id\/blog\/supply-chain-attack-plugin-wordpress-2026-cara-audit-backdoor-di-server-linux\/#primaryimage"},"thumbnailUrl":"https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2026\/11\/AaGY1IdHqKSX3-GALPBRog-AaGY1IdHpN1EtMU9xGpoJQ.png?fit=1680%2C944&ssl=1","keywords":["backdoor","malware","supply chain attack","wordpress","wp-cli"],"articleSection":["Security","Server","WordPress"],"inLanguage":"id","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/zaf.web.id\/blog\/supply-chain-attack-plugin-wordpress-2026-cara-audit-backdoor-di-server-linux\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/zaf.web.id\/blog\/supply-chain-attack-plugin-wordpress-2026-cara-audit-backdoor-di-server-linux\/","url":"https:\/\/zaf.web.id\/blog\/supply-chain-attack-plugin-wordpress-2026-cara-audit-backdoor-di-server-linux\/","name":"Supply Chain Attack Plugin WordPress 2026: Cara Audit Backdoor di Server Linux - Ahmad Zafrullah","isPartOf":{"@id":"https:\/\/zaf.web.id\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/zaf.web.id\/blog\/supply-chain-attack-plugin-wordpress-2026-cara-audit-backdoor-di-server-linux\/#primaryimage"},"image":{"@id":"https:\/\/zaf.web.id\/blog\/supply-chain-attack-plugin-wordpress-2026-cara-audit-backdoor-di-server-linux\/#primaryimage"},"thumbnailUrl":"https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2026\/11\/AaGY1IdHqKSX3-GALPBRog-AaGY1IdHpN1EtMU9xGpoJQ.png?fit=1680%2C944&ssl=1","datePublished":"2026-11-01T20:43:45+00:00","description":"Plugin resmi pun bisa membawa backdoor. Panduan praktis mengaudit instalasi WordPress di server Linux setelah gelombang supply chain attack 2026.","breadcrumb":{"@id":"https:\/\/zaf.web.id\/blog\/supply-chain-attack-plugin-wordpress-2026-cara-audit-backdoor-di-server-linux\/#breadcrumb"},"inLanguage":"id","potentialAction":[{"@type":"ReadAction","target":["https:\/\/zaf.web.id\/blog\/supply-chain-attack-plugin-wordpress-2026-cara-audit-backdoor-di-server-linux\/"]}]},{"@type":"ImageObject","inLanguage":"id","@id":"https:\/\/zaf.web.id\/blog\/supply-chain-attack-plugin-wordpress-2026-cara-audit-backdoor-di-server-linux\/#primaryimage","url":"https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2026\/11\/AaGY1IdHqKSX3-GALPBRog-AaGY1IdHpN1EtMU9xGpoJQ.png?fit=1680%2C944&ssl=1","contentUrl":"https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2026\/11\/AaGY1IdHqKSX3-GALPBRog-AaGY1IdHpN1EtMU9xGpoJQ.png?fit=1680%2C944&ssl=1","width":1680,"height":944,"caption":"Ilustrasi rantai pasok plugin WordPress yang disusupi"},{"@type":"BreadcrumbList","@id":"https:\/\/zaf.web.id\/blog\/supply-chain-attack-plugin-wordpress-2026-cara-audit-backdoor-di-server-linux\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/zaf.web.id\/blog\/"},{"@type":"ListItem","position":2,"name":"Supply Chain Attack Plugin WordPress 2026: Cara Audit Backdoor di Server Linux"}]},{"@type":"WebSite","@id":"https:\/\/zaf.web.id\/blog\/#website","url":"https:\/\/zaf.web.id\/blog\/","name":"Ahmad Zafrullah","description":"Work to Learn is better than Learn how to Work","publisher":{"@id":"https:\/\/zaf.web.id\/blog\/#\/schema\/person\/ba4e955d59a1e6a8284857e74b14e5ed"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/zaf.web.id\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"id"},{"@type":["Person","Organization"],"@id":"https:\/\/zaf.web.id\/blog\/#\/schema\/person\/ba4e955d59a1e6a8284857e74b14e5ed","name":"Zaf","image":{"@type":"ImageObject","inLanguage":"id","@id":"https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2024\/09\/zaf_auto_x2.jpeg?fit=300%2C300&ssl=1","url":"https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2024\/09\/zaf_auto_x2.jpeg?fit=300%2C300&ssl=1","contentUrl":"https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2024\/09\/zaf_auto_x2.jpeg?fit=300%2C300&ssl=1","width":300,"height":300,"caption":"Zaf"},"logo":{"@id":"https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2024\/09\/zaf_auto_x2.jpeg?fit=300%2C300&ssl=1"},"sameAs":["http:\/\/zaf.web.id","http:\/\/www.facebook.com\/23Pstars","https:\/\/x.com\/23Pstars"],"url":"https:\/\/zaf.web.id\/blog\/author\/zaf\/"}]}},"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":2198,"url":"https:\/\/zaf.web.id\/blog\/passkey-webauthn-login-admin-wordpress-ojs\/","url_meta":{"origin":2223,"position":0},"title":"Login Tanpa Password: Passkey dan WebAuthn untuk Admin WordPress dan OJS","author":"Zaf","date":"September 15, 2026","format":false,"excerpt":"Dari sekian banyak website yang pernah saya bersihkan dari malware, jalur masuk yang paling sering adalah kredensial yang bocor atau terlalu lemah. Salah satu tren keamanan web 2026 adalah beralih ke login tanpa password menggunakan passkey dan hardware security key berbasis WebAuthn. Cara kerja singkat Saat mendaftarkan passkey, perangkat membuat\u2026","rel":"","context":"dalam "AI"","block_context":{"text":"AI","link":"https:\/\/zaf.web.id\/blog\/category\/ai\/"},"img":{"alt_text":"Ilustrasi login menggunakan passkey dan security key","src":"https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2026\/10\/AaELOpXe8EbU29t3H3xZeQ-AaELOpXeUhODt40g-Li3EA.jpg?fit=1200%2C674&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2026\/10\/AaELOpXe8EbU29t3H3xZeQ-AaELOpXeUhODt40g-Li3EA.jpg?fit=1200%2C674&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2026\/10\/AaELOpXe8EbU29t3H3xZeQ-AaELOpXeUhODt40g-Li3EA.jpg?fit=1200%2C674&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2026\/10\/AaELOpXe8EbU29t3H3xZeQ-AaELOpXeUhODt40g-Li3EA.jpg?fit=1200%2C674&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2026\/10\/AaELOpXe8EbU29t3H3xZeQ-AaELOpXeUhODt40g-Li3EA.jpg?fit=1200%2C674&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":2217,"url":"https:\/\/zaf.web.id\/blog\/bahaya-memasang-mcp-server-ai-agent-di-server-produksi\/","url_meta":{"origin":2223,"position":1},"title":"Bahaya Memasang MCP Server \/ AI Agent di Server Produksi","author":"Zaf","date":"Desember 23, 2025","format":false,"excerpt":"AI kini tidak lagi sekadar menjawab pertanyaan. Lewat Model Context Protocol (MCP), sebuah AI agent bisa membaca database, menjalankan perintah, bahkan melakukan deploy. Sebagai orang yang sehari-hari mengurus server, saya melihat MCP sebagai pintu baru yang harus diperlakukan sama seriusnya dengan port SSH. Seberapa besar risikonya? Sejumlah riset keamanan di\u2026","rel":"","context":"dalam "Security"","block_context":{"text":"Security","link":"https:\/\/zaf.web.id\/blog\/category\/security\/"},"img":{"alt_text":"Ilustrasi AI agent memegang akses ke server produksi","src":"https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2026\/11\/AaGXhdf1A_mdSucUX8JpFQ-AaGXhdf1m2KMAawBBA-Ljw.png?fit=1200%2C674&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2026\/11\/AaGXhdf1A_mdSucUX8JpFQ-AaGXhdf1m2KMAawBBA-Ljw.png?fit=1200%2C674&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2026\/11\/AaGXhdf1A_mdSucUX8JpFQ-AaGXhdf1m2KMAawBBA-Ljw.png?fit=1200%2C674&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2026\/11\/AaGXhdf1A_mdSucUX8JpFQ-AaGXhdf1m2KMAawBBA-Ljw.png?fit=1200%2C674&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2026\/11\/AaGXhdf1A_mdSucUX8JpFQ-AaGXhdf1m2KMAawBBA-Ljw.png?fit=1200%2C674&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":981,"url":"https:\/\/zaf.web.id\/blog\/serangan-adware-via-htaccess\/","url_meta":{"origin":2223,"position":2},"title":"Serangan Adware via .htaccess","author":"Zaf","date":"Desember 17, 2016","format":false,"excerpt":"Bukan pertama kalinya beberapa server kami mendapatkan serangan dengan teknik yang berbagai macam jenis, bentuk, dan dampaknya. Pagi ini\u00a0sempat kaget karena semua website yang ada dalam server Gili Air\u00a0kami diarahkan ke situs iklan ketika diakses dari perangkat mobile. Saat ditelusuri ternyata semua file .htaccess nya telah disusupi semua, untuk mendeteksi\u2026","rel":"","context":"dalam "Server"","block_context":{"text":"Server","link":"https:\/\/zaf.web.id\/blog\/category\/server\/"},"img":{"alt_text":".htaccess malware inject","src":"https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2016\/12\/Screen-Shot-2016-12-15-at-5.34.42-PM-1024x680.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2016\/12\/Screen-Shot-2016-12-15-at-5.34.42-PM-1024x680.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2016\/12\/Screen-Shot-2016-12-15-at-5.34.42-PM-1024x680.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":1954,"url":"https:\/\/zaf.web.id\/blog\/mitigasi-malware-di-web-server-dan-cara-membersihkannya\/","url_meta":{"origin":2223,"position":3},"title":"Mitigasi Malware di Web Server dan Cara Membersihkannya","author":"Zaf","date":"November 23, 2022","format":false,"excerpt":"Malware selalu menjadi hal yang merepotkan. Umumnya pembuat malware tidak membuat malware untuk sekedar ajang pamer layaknya defacement. Malware dibuat demi tujuan yang lebih besar dan masif, dan biasanya tidak berjalan secara sendiri-sendiri melainkan menjadi sebuah network atau perkumpulan. Discovery Disuatu pagi tiba-tiba salah satu website yang kami kelola menunjukkan\u2026","rel":"","context":"dalam "Security"","block_context":{"text":"Security","link":"https:\/\/zaf.web.id\/blog\/category\/security\/"},"img":{"alt_text":"Mencari induk malware","src":"https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2022\/11\/6.-cari-dan-hapus-file-ico.png?fit=795%2C241&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2022\/11\/6.-cari-dan-hapus-file-ico.png?fit=795%2C241&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2022\/11\/6.-cari-dan-hapus-file-ico.png?fit=795%2C241&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2022\/11\/6.-cari-dan-hapus-file-ico.png?fit=795%2C241&ssl=1&resize=700%2C400 2x"},"classes":[]},{"id":586,"url":"https:\/\/zaf.web.id\/blog\/masalah-mysql-service-sering-mati-pada-cloud-digitalocean\/","url_meta":{"origin":2223,"position":4},"title":"Masalah MySQL service sering mati pada Cloud DigitalOcean","author":"Zaf","date":"September 22, 2015","format":false,"excerpt":"Beberapa bulan terakhir saya\u00a0memutuskan untuk menggunakan layanan cloud server dari DigitalOcean untuk mengakomodir\u00a0semua service, baik website maupun system management yang saya\u00a0gunakan di\u00a0kantor. Butuh beberapa hari untuk proses migrasi data dari layanan sebelumnya (shared hosting) dan\u00a0berjalan cukup baik, sampai saat ini kami sudah menggunakan 3 server (droplet) untuk menampung semua kebutuhan.\u2026","rel":"","context":"dalam "Server"","block_context":{"text":"Server","link":"https:\/\/zaf.web.id\/blog\/category\/server\/"},"img":{"alt_text":"DigitalOcean Logo","src":"https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2015\/09\/digitalocean_logo-300x300.png?resize=350%2C200","width":350,"height":200},"classes":[]},{"id":127,"url":"https:\/\/zaf.web.id\/blog\/menelusuri-template-dan-plugin-yang-digunakan-pada-mesin-wordpress\/","url_meta":{"origin":2223,"position":5},"title":"Menelusuri Template dan Plugin yang Digunakan pada Mesin WordPress","author":"Zaf","date":"Desember 28, 2020","format":false,"excerpt":"Hampir sebagian besar website yang online di internet saat ini adalah menggunakan mesin WordPress (WP), termasuk blog saya ini. Ketika kita mengetahui bahwa engine yang digunakan dalam suatu web adalah WP dan menurut kita tampilan atau fitur-fiturnya cukup menarik, tidak jarang kita menjadi penasaran. Template atau plugin apa saja yang\u2026","rel":"","context":"dalam "WordPress"","block_context":{"text":"WordPress","link":"https:\/\/zaf.web.id\/blog\/category\/wordpress\/"},"img":{"alt_text":"View source fkip.unram.ac.id","src":"https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2020\/12\/Screenshot-from-2021-09-20-14-41-11.png?fit=1028%2C509&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2020\/12\/Screenshot-from-2021-09-20-14-41-11.png?fit=1028%2C509&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2020\/12\/Screenshot-from-2021-09-20-14-41-11.png?fit=1028%2C509&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2020\/12\/Screenshot-from-2021-09-20-14-41-11.png?fit=1028%2C509&ssl=1&resize=700%2C400 2x"},"classes":[]}],"jetpack_likes_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p4zLnS-zR","jetpack_featured_media_url":"https:\/\/i0.wp.com\/zaf.web.id\/blog\/wp-content\/uploads\/2026\/11\/AaGY1IdHqKSX3-GALPBRog-AaGY1IdHpN1EtMU9xGpoJQ.png?fit=1680%2C944&ssl=1","_links":{"self":[{"href":"https:\/\/zaf.web.id\/blog\/wp-json\/wp\/v2\/posts\/2223","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zaf.web.id\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zaf.web.id\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zaf.web.id\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zaf.web.id\/blog\/wp-json\/wp\/v2\/comments?post=2223"}],"version-history":[{"count":2,"href":"https:\/\/zaf.web.id\/blog\/wp-json\/wp\/v2\/posts\/2223\/revisions"}],"predecessor-version":[{"id":2227,"href":"https:\/\/zaf.web.id\/blog\/wp-json\/wp\/v2\/posts\/2223\/revisions\/2227"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/zaf.web.id\/blog\/wp-json\/wp\/v2\/media\/2225"}],"wp:attachment":[{"href":"https:\/\/zaf.web.id\/blog\/wp-json\/wp\/v2\/media?parent=2223"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zaf.web.id\/blog\/wp-json\/wp\/v2\/categories?post=2223"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zaf.web.id\/blog\/wp-json\/wp\/v2\/tags?post=2223"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}