Inspect requests before WordPress

NinjaFirewall WP+ Edition is a stand-alone web application firewall installed and configured as a WordPress add-on. It can hook, scan, sanitize, or reject HTTP and HTTPS requests before they reach WordPress or its add-ons. This covers PHP scripts throughout the blog installation directories and subdirectories, including scripts outside the WordPress package.

The filtering engine normalizes and transforms incoming request data to help detect evasion techniques and obfuscation. It also works with and decodes a broad range of encodings, and filters encoded PHP scripts, shell scripts, and backdoors.

Control access and request volume

• Access controls: Apply rules by IP address, user role, country, URL, and bot classification.
• Brute-force protection: Protect wp-login.php, with the option to extend protection to xmlrpc.php. Incidents can also be written to the server AUTH log. This can help administrators monitor large attacks, including distributed attempts from many IP addresses.
• Rate limiting: Block aggressive bots, crawlers, web scrapers, and HTTP attacks.
• Antispam: Protect comment and user registration forms.
• Response filtering: Scan the HTML output immediately before it is sent to a visitor's browser.
• Logging and administration: Use centralized logging, improved log management, and Syslog logging. Configuration can be imported or exported from WP-CLI.
• Uploads and communication: Use improved file upload management. Unix shared memory handles inter-process communication.

Monitor PHP documents and site changes

File Guard detects access to recently created or modified PHP files and can alert administrators with the script name, IP address, request, date, and time. File Check scans the site hourly, twice daily, or daily. It can detect changes to file contents, permissions, ownership, timestamps, and file creation or deletion.

Requirements and setup

The administration interface uses the WordPress interface, includes contextual help on each menu page, and is smartphone-friendly. The WP+ Edition requires WordPress 4.9 or later, PHP 7.1 or later, and MySQL or MariaDB with the MySQLi extension. Installation requires an administrator or superadministrator with manage_options and unfiltered_html capabilities.

Supported web servers include Apache, Nginx, LiteSpeed, and OpenLiteSpeed. The operating system must be Unix-like, such as Linux or BSD; Microsoft Windows is not compatible.

Install the plugin through WordPress, then configure the firewall in its administration screens. Set access controls, logging, rate limiting, file monitoring, and other available settings to suit the website.