Aaron Parecki

Ok, the quickest way to "fix" this for most of my sites is going to be blocking all POST requests from ever hitting PHP in the first place. Most of my sites are read-only anyway.

The few sites that need to accept POSTs I can allow POST requests only from my home IP address, which is an awkward but feasible workaround for the time being.

nginx, in your server block: if ($request_method = POST) { return 405; }

htaccess:

RewriteCond %{REQUEST_METHOD} POST RewriteRule .* - [F,L]