Filter incoming requests

BBQ Pro adds configurable controls to BBQ Firewall, a lightweight firewall add-on for WordPress. The firewall scans GET, POST, PUT, DELETE, and other requests for patterns associated with SQL injection, executable file uploads, directory traversal, unsafe characters, long request strings, PHP remote or file execution, XSS, and XXE. It also filters requests involving bad bots, bad referrers, and bad POST content.

Adjust and test rules

Enable or disable individual firewall rules, add or remove patterns, and import or export patterns. You can add Jeff Starr’s AI Block List and use one-click testing to check patterns while refining the configuration. Dedicated tools reset settings and patterns, and inline documentation explains the settings. Whitelist IP addresses when an address needs to bypass filtering.

Review blocked activity and control access

BBQ Pro can send email alerts for blocked requests and record statistics about blocked activity. It can block a single IP address or an IP range, protect against XML-RPC exploits and user-ID phishing, and apply a specific protection option to excessively long URI requests. Administrators can also disable the firewall for logged-in users.

Choose how blocked requests are handled

For blocked requests, pick a redirect, a custom message, or a response status code. These settings let you decide what users receive when a request matches a firewall rule.

BBQ Firewall is designed to work with WordPress extensions and themes and is compatible with other security add-ons.

Set up the firewall controls

Install and activate BBQ Pro on the WordPress site where BBQ Firewall is used. Review the settings, then adjust patterns, IP controls, alerts, and response behavior to fit the site. Use pattern testing and the inline documentation as you refine the rules.