Advanced protection before WordPress
NinjaFirewall WP+ Edition is a stand-alone web application firewall that operates in front of WordPress. It can hook, scan, sanitise, or reject HTTP and HTTPS requests before they reach WordPress or its plugins. This approach extends protection to PHP scripts throughout the blog installation directories and sub-directories, including scripts outside the WordPress package.
The firewall can also filter encoded PHP scripts, hacker shell scripts, and backdoors. Its filtering engine normalizes and transforms incoming request data, helping detect evasion techniques and obfuscation tactics while supporting and decoding a broad set of encodings.
WP+ security capabilities
- Access control: Apply IP-based, role-based, country-based, URL-based, and bot-based access controls.
- Brute-force protection: Protect wp-login.php, with the option to extend protection to xmlrpc.php. Incidents can also be written to the server AUTH log.
- Rate limiting: Block aggressive bots, crawlers, web scrapers, and HTTP attacks.
- Antispam: Add protection for comment and user registration forms.
- Response body filtering: Scan the HTML output immediately before it is sent to a visitor’s browser.
- File monitoring: File Guard can detect real-time access to recently created or modified PHP files and send an alert with the script name, IP address, request, date, and time.
- File integrity monitoring: File Check can scan the website hourly, twice daily, or daily to detect file modifications.
- Logging: Use centralized logging, improved log management, and Syslog logging.
- Configuration management: Import and export the configuration from WP-CLI.
- File uploads: Use improved file upload management.
- Performance: Unix shared memory is used for inter-process communication.
Practical use cases
WP+ is designed for administrators who want requests inspected before WordPress processes them. It can help protect login endpoints during large brute-force attacks, including distributed attacks involving many IP addresses. File Guard can alert administrators when a newly created or modified PHP file is accessed, while scheduled integrity checks help identify changes made to website files.
Access controls can support different administrative policies, such as restricting traffic by country, IP address, URL, role, or bot classification. Centralized logs, Syslog, server AUTH logging, and WP-CLI configuration import and export provide options for operational monitoring and administration.
Interface and requirements
NinjaFirewall uses the WordPress interface and provides contextual help on each menu page. The administration interface is smartphone-friendly and does not include intrusive banners, warnings, or flashy colors.
The WP+ Edition requires WordPress 4.9 or later, PHP 7.1 or later, and MySQL or MariaDB with the MySQLi extension. It requires an administrator or superadministrator with manage_options and unfiltered_html capabilities. Supported web servers include Apache, Nginx, LiteSpeed, and OpenLiteSpeed. The operating system must be Unix-like, such as Linux or BSD; Microsoft Windows is not compatible.
Installation
Install NinjaFirewall WP+ Edition as a WordPress plugin, then use its administration screens to configure the firewall and review contextual help. Set access controls, logging, rate limiting, file monitoring, and other available options according to the needs of the site.
