This is not a discussion about detecting if a TorHS website has WordPress installed, but rather about tricking attackers that scan your website into moving along, nothing interesting here.
For starters, if you are running multiple onion websites on a single webserver (and my recommendation is that you do not do this, use one website per webserver), you will need to make sure that your server is not vulnerable to an attack where it is possible for an attacker to enumerate all the onion sites running on your server.
So don’t be lazy, set your Virtualhost containers ServerName correctly!
That said (and is the point of this little blog piece), even if you have correctly configure this, WordPress has recently added a function that adds an extra ‘dns-prefetch’ into the page code which is in of itself, not interesting other than it could cause your onion site to be short-listed for further attention by attackers scanning for virtualhost mis-configurations because this new addition to WordPress can trigger a false positive.
For example if an attacker were to trace:
$ curl -H "Host: abcdefghijklm.onion" --socks5-hostname 127.0.0.1:9050 -s --user-agent "Mozilla/5.0" abcdefghijklm.onion | sha1sum
(note: even though sha1sum is vulnerable to collision attacks, we use it here merely for illustration purposes – i.e its a short hash)
This returns:
5f18492f012c9e1d0df76c47d4a7b75c703ae6c3 -
Same trace instead using localhost as the hostname:
$ curl -H "Host: localhost" --socks5-hostname 127.0.0.1:9050 -s --user-agent "Mozilla/5.0" abcdefghijklm.onion | sha1sum
Returns:
4d0389cf2c7e362fa5b3d920c8c6c394f5d0d021 -
This is because WordPress adds an extra:
< link rel='dns-prefetch' href='//abcdefghijklm.onion /' >
…when the trace hostname is localhost.
To prevent this, go to:
wp-content/themes/[current-theme]_child/functions.php
add:
remove_action('wp_head', 'wp_resource_hints', 2);
Now trace:
$ curl -H "Host: localhost" --socks5-hostname 127.0.0.1:9050 -s --user-agent "Mozilla/5.0" abcdefghijklm.onion | sha1sum
5f18492f012c9e1d0df76c47d4a7b75c703ae6c3 -
And:
$ curl -H "Host: abcdefghijklm.onion" --socks5-hostname 127.0.0.1:9050 -s --user-agent "Mozilla/5.0" abcdefghijklm.onion | sha1sum
5f18492f012c9e1d0df76c47d4a7b75c703ae6c3 -
Hashes match! Your site is not interesting, attacker moves along…
Mauriora!